Privacy policy
Last updated
wrxstack collects only what it needs to run PDF Loft: your account details, the files you choose to process, billing records and security logs. We do not sell personal data, our staff do not open or read your documents, analytics load only if you consent, and you can export or delete your account at any time.
1. Who we are
wrxstack operates PDF Loft and is the controller of the personal data described in this policy, which means we decide why and how it is processed. For documents that an organisation uploads about other people, that organisation decides why those documents are processed, and we process them on its instructions.
IndiaEmail: contact@wrxstack.com
2. What we collect
- Account details: your name, email address, password (stored only as a one-way hash), language, time zone, the accounts you belong to and your role in each, and your sign-in methods, including passkeys and two-factor settings.
- Documents: the files you upload, the results you produce, the documents you save to your library, and their annotations, versions and templates.
- Signature requests: the names and email addresses of the signers you invite, and, for each signer, the signature, the time, the network address and the browser used, which form the audit trail of the signed document. A signer does not need an account.
- Billing records: your plan, billing country, invoices, tax details you provide (such as a GSTIN) and payment status. Our payment processors collect your card or bank details directly. We never see or store a full card number.
- Usage and security records: tasks run and limits used, sign-in events, network addresses, device and browser type, and error reports. These records never contain the content or names of your documents.
- Analytics: how pages and features are used, collected only after you consent.
- Messages: what you send us when you contact support or make a request.
3. Why we use it, and the legal basis
| Purpose | Legal basis |
|---|---|
| Providing the service: accounts, tools, library, signatures, teams | Performance of our contract with you |
| Billing, invoices and tax records | Contract, and our legal obligations under tax law |
| Security: preventing fraud, abuse and unauthorised access | Our legitimate interest in protecting you and the service, and legal obligations |
| Service emails: verification, sign-in alerts, receipts, failed payments, trial reminders | Performance of our contract with you |
| Analytics to improve the product | Your consent, which you can withdraw at any time |
| Responding to requests and complaints | Legal obligations, and our legitimate interest in helping you |
Under India's Digital Personal Data Protection Act, 2023, we process your personal data for the purposes you give it to us for, and on the basis of your consent where the Act requires it. We do not sell personal data, we do not use your documents to train AI models, and we do not use your documents for advertising.
4. How your documents are handled
- Every upload is scanned for viruses before it is processed.
- Uploaded inputs are deleted when the job that used them ends, and an upload no tool runs on is deleted 1 hour after it arrives. Results you do not save to your library are deleted 2 hours after they are produced.
- A private document can be opened only by the person who created it. The owner and admins of a team account cannot open it.
- Our staff do not open your documents. Support staff and administrators can see only metadata such as names, sizes, dates and status, in a read-only view that is logged.
- When you run an AI tool, the content of that document is sent to an AI model provider to produce the result, under terms that forbid the provider from training on it or keeping it. No document content is sent to a model provider unless you run an AI tool.
6. International transfers
Our service providers may process personal data outside the country where you live. Where data from the European Economic Area, the United Kingdom or another region with transfer rules leaves that region, we rely on safeguards the law recognises, such as standard contractual clauses. Transfers out of India follow the Digital Personal Data Protection Act and any restrictions made under it.
7. How long we keep it
- Account and library data: while your account exists. When you delete your account, deletion is scheduled with a 14-day grace period, during which you can cancel it. After that, the account and its data are deleted permanently.
- Unsaved results: 2 hours. Uploaded inputs: until the job ends, or 1 hour after upload when no tool runs on them. Documents saved to your library: until you delete them.
- Account export files: 24 hours after they are produced.
- Invoices and payment records: for the period tax and accounting law requires, even after the account is deleted.
- Completed signature requests: the audit trail stays with the signed document for as long as its owner keeps it, because it is the evidence of the signature.
- Security records: for a limited period, as long as needed to investigate abuse and meet legal obligations.
- Free trial records: a one-way fingerprint of your email mailbox and the plans whose free trial it has used, kept after the account is deleted so that the same mailbox cannot start the same trial again. It does not contain your email address and cannot be used to contact you.
- Backups: encrypted and kept for a limited period. Deleted data leaves the backups as they are replaced.
8. Security
We protect personal data with encryption in transit and at rest, one-way hashing of passwords, two-factor sign-in, passkeys, account-level access checks on every request, and short-lived download links. The security page describes these measures. If a personal data breach affects you, we will notify you and the authorities as the law requires.
9. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you, and receive a copy of it;
- correct data that is inaccurate or incomplete;
- delete your account and its data;
- withdraw consent at any time, including for analytics, without affecting processing before you withdrew it;
- object to, or ask us to restrict, processing based on our legitimate interests;
- receive your data in a portable format;
- under India's Digital Personal Data Protection Act, nominate another person to exercise your rights if you die or become unable to;
- complain to our Grievance Officer, and then to a data protection authority, such as the Data Protection Board of India or the authority where you live in the European Economic Area or the United Kingdom.
You can export your data and delete your account yourself in your account settings. An export is produced on request and is available to download for 24 hours. For any other request, email contact@wrxstack.com. We may ask you to confirm your identity, and we reply within one month, or sooner where the law requires.
10. Children
PDF Loft is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.
12. Grievance Officer
In line with India's Information Technology Act, 2000 and the rules made under it, our Grievance Officer handles complaints about personal data and the service. Write to contact@wrxstack.com with "Grievance" in the subject. We acknowledge a grievance within 24 hours where the rules require it, and resolve it within 15 days.
13. Changes to this policy
We will update this policy when our practices change. For a material change we tell you by email or in the product before it applies. The date at the top of this page shows when it last changed.