# Privacy Policy How Modern Paper, Inc. collects, uses, and protects your personal data when you use PDF Blocks. ## Introduction This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our service, and the choices you have associated with that data. Modern Paper, Inc. ("us", "we", or "our") operates the pdfblocks.com website, the PDF Blocks API, and related services (the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy. Terms used in this Privacy Policy have the same meaning as in our [Terms & Conditions](/docs/trust/terms) unless otherwise defined. ## Our Two Roles: Controller and Processor When you visit our website or manage your account, we act as a **data controller** — we determine how your account and website data are handled, as described below. When you submit documents or data to the API for processing, **you** (or your organization) are the controller and we act as a **processor** on your behalf: we process that content only to perform the operation you request. Business customers may request our Data Processing Addendum (DPA) to govern that processing. ## Information We Collect We collect the following types of information to provide, secure, and improve the Service: - **Account and identity** — your email address, a hashed password, two-factor authentication settings, and, if you sign in with Google or Microsoft, the identifiers those providers return. - **Account and organization** — your account or company name and plan. - **Billing** — handled by Stripe. We store Stripe customer and subscription identifiers and your plan status. We do not store full payment-card numbers. Any billing address is collected by Stripe on their checkout, subject to Stripe's privacy notice. - **API usage metadata** — an API-key digest, the action requested, request counts, input and output byte sizes, status codes, and timestamps. - **Support** — the messages and attachments you send to our support team. - **Technical and log data** — your Internet Protocol (IP) address, browser type and version, device information, and security events, generated automatically when you use the Service. ## How We Handle Uploaded Documents When you send a document to the API, it is received, processed in memory to perform the operation you requested, and returned to you in the response. Documents are **not retained after the response is returned** and are not written to durable storage. Large uploads may be briefly buffered to a temporary file for the duration of a single request and are deleted when the request completes. We do not read, log, or use the contents of your documents for any purpose other than performing your requested operation, and we do **not** use them to train machine-learning models. We record only request metadata — the action, byte counts, an API-key digest, status, and timestamp — for billing, security, and abuse prevention. When you process documents through the API, we act as a processor on your behalf, and that processing — including where it takes place — is governed by our [Data Processing Addendum](/docs/trust/dpa). It is separate from the data we process as a controller, which is handled as described below. ## Use of Data Modern Paper, Inc. uses the collected data for the following purposes: - To provide and maintain the Service - To notify you about changes to our Service - To provide customer support - To process billing and manage your subscription - To monitor usage and detect, prevent, and address technical issues and abuse - To gather analysis or valuable information so that we can improve the Service - To send you news, special offers, and general information about our products and services, unless you have opted not to receive such information You may opt out of marketing communications at any time by following the unsubscribe link in any email we send. ## Legal Basis for Processing Personal Data under the General Data Protection Regulation (GDPR) If you are from the European Economic Area (EEA), our legal basis for collecting and using the personal information described in this Privacy Policy depends on the Personal Data we collect and the specific context in which we collect it. Modern Paper, Inc. may process your Personal Data because: - We need to perform a contract with you - You have given us permission to do so - The processing is in our legitimate interests and is not overridden by your rights - To comply with the law ## Cookies and Analytics We use only essential cookies needed to operate the Service — for your session, security, and preferences. We do **not** currently use third-party advertising or analytics cookies, and we do not use third-party analytics services. If we adopt analytics in the future, we will update this policy and, where required, request your consent first. You can instruct your browser to refuse cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service. ## Retention of Data We keep account data for the life of your account and for a limited period afterward to meet legal, tax, and dispute-resolution needs. Usage metadata is retained for billing history. Server and security logs are kept for a shorter period. **Uploaded documents are not retained** beyond the request that processes them. ## Subprocessors We rely on the following third parties to provide the Service. They may access personal data only to perform tasks on our behalf and are obligated not to disclose or use it for any other purpose: - **Amazon Web Services and Microsoft Azure** — hosting and infrastructure. Account data is stored in the United States; documents are processed in the region you address and are not retained. - **Stripe** — payment processing and billing. - **Google and Microsoft** — optional single sign-on. We may update this list as our providers change. Customers under a Data Processing Addendum will be notified of material changes to subprocessors as required by that addendum. ## Transfer of Data The personal data we process as a controller — your account, billing, and website and usage data — is processed and stored on servers located in the **United States**. This does **not** include the contents of documents you submit to the API. Those documents are processed by us as a processor on your behalf, under our [Data Processing Addendum](/docs/trust/dpa), in the region of the API endpoint you address — one of several regions worldwide, including the United States, the European Union, the United Kingdom, Canada, Australia, Japan, India, and Brazil — and are not retained after processing. If you are located outside the United States, the controller data described above may be transferred to and maintained on computers located in a jurisdiction where data protection laws may differ from those where you live. Where we transfer personal data out of the EEA, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), which are available on request. Your submission of information represents your agreement to that transfer. Modern Paper, Inc. will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place, including the security of your data. ## Disclosure of Data ### Business Transaction If Modern Paper, Inc. is involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy. ### Legal Requirements Modern Paper, Inc. may disclose your Personal Data in the good faith belief that such action is necessary to: - Comply with a legal obligation or a valid request by a public authority - Protect and defend the rights or property of Modern Paper, Inc. - Prevent or investigate possible wrongdoing in connection with the Service - Protect the personal safety of users of the Service or the public - Protect against legal liability ## Security of Data The security of your data is important to us. We use commercially reasonable safeguards, including encryption in transit (TLS) and hashing of credentials and API keys. However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee its absolute security. ## Your Data Protection Rights under the General Data Protection Regulation (GDPR) If you are a resident of the European Economic Area (EEA), you have certain data protection rights. Modern Paper, Inc. aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data. In certain circumstances, you have the following rights: - **The right to access, update, or delete** the information we have on you — where possible, directly in your account settings, or by contacting us for assistance. - **The right of rectification** — to have your information corrected if it is inaccurate or incomplete. - **The right to object** — to object to our processing of your Personal Data. - **The right of restriction** — to request that we restrict the processing of your personal information. - **The right to data portability** — to receive a copy of your information in a structured, machine-readable, and commonly used format. - **The right to withdraw consent** — to withdraw your consent at any time where we relied on your consent to process your personal information. We may ask you to verify your identity before responding to such requests. You also have the right to lodge a complaint with a Data Protection Authority about our collection and use of your Personal Data. ## Your California Privacy Rights (CCPA/CPRA) If you are a California resident, you have the right to know, access, correct, and delete the personal information we hold about you, and to be free from discrimination for exercising these rights. We do **not sell or share** your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioral advertising. To exercise a right, contact us at [privacy@pdfblocks.com](mailto:privacy@pdfblocks.com). ## Links to Other Sites Our Service may contain links to other sites that are not operated by us. If you click a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. ## Children's Privacy Our Service does not address anyone under the age of 18 ("Children"). We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers. ## Changes to This Privacy Policy We may update our Privacy Policy from time to time. We will post any updated policy on this page and update the "last updated" date at the top. For material changes, we will take reasonable steps to notify you, such as by email or a prominent notice on our Service. You are advised to review this Privacy Policy periodically for any changes. ## Contact Us If you have any questions about this Privacy Policy or wish to exercise a privacy right, please write to us at [privacy@pdfblocks.com](mailto:privacy@pdfblocks.com). If you are in the EEA or the United Kingdom, you may also contact your local data protection authority.