Information we collect
We collect the information you provide directly, plus limited technical data required to run the service. This includes:
- Account data such as your email address, authentication provider, and role/usage limits stored with your profile.
- PDFs and template data that you upload or save, including detected fields, coordinates, labels, and template settings stored with your saved forms.
- Schema metadata such as CSV/Excel/JSON/TXT column headers and types. The actual CSV/Excel/JSON rows stay in your browser and are not uploaded.
- Usage and diagnostic metadata like request timestamps, session identifiers, and rate-limit signals.
- Limited website measurement data such as page views, referrer information, browser/device metadata, and conversion attribution signals collected through Google tagging and similar abuse-prevention or analytics integrations.
- Billing metadata required for subscriptions and credit refills, such as Stripe customer and subscription identifiers, plan identifiers, checkout/payment status, and cancellation schedule fields.
- Contact form details (name, company, email, phone, and message) when you reach out for support.
How we use information
We use your information to:
- Provide PDF detection, template editing, and Search & Fill features.
- Authenticate users, enforce usage limits, and keep your saved forms tied to your account.
- Process Stripe-backed subscriptions, credit refill purchases, and related billing state synchronization.
- Run optional AI rename and schema mapping workflows when you enable them.
- Measure product usage, page performance, and marketing conversions.
- Respond to support requests and communicate about your account.
- Protect the service against abuse, fraud, and automated traffic.
Billing and payments
Paid subscriptions and credit refill transactions are processed by Stripe. We do not store full payment card numbers on DullyPDF servers.
To support subscriptions and refill fulfillment, we store billing metadata (such as Stripe customer id, subscription id, checkout session id, and webhook event ids) and account billing state (for example subscription status and cancellation schedule).
AI processing and third-party services
When you enable AI rename or schema mapping, we send limited inputs to third-party AI providers. These inputs can include PDF page images, detected field labels, and schema headers. We do not send your CSV/Excel/JSON row data.
DullyPDF uses service providers such as Firebase (authentication), Google Cloud Storage and Firestore (data storage), Stripe (payment processing), Google reCAPTCHA (abuse protection), Google Ads / Google tag (conversion measurement), and email delivery services for the contact form.
Retention
Session data and request logs are retained only for limited periods configured for performance and troubleshooting. Contact messages are retained as needed to respond to you. Saved forms normally remain stored until you delete them. If a subscription downgrade leaves an account above the base saved-form cap, DullyPDF can lock access to some saved forms while still preserving the stored records.
Under the current base-plan policy, DullyPDF keeps the earliest-created saved forms up to the base limit accessible and marks the remainder locked in place until the account upgrades again. Related Fill By Link, group, API Fill, and signing draft flows can be blocked while a source template is locked, but the stored records are preserved instead of being purged as part of the downgrade itself.
Security
We use access controls and encryption in transit to protect your data. No method of transmission or storage is fully secure, so we cannot guarantee absolute security.
Your choices
You can:
- Disable AI workflows and keep processing limited to detection and local editing.
- Delete saved forms from your profile to remove stored PDFs and template metadata.
- Manage or cancel active subscriptions from your profile billing section.
- Contact us to request account deletion or access questions at justin@dullypdf.com.
Children's privacy
DullyPDF is not intended for children under 13, and we do not knowingly collect information from children.
Changes to this policy
We may update this policy from time to time. The \"Last updated\" date above shows when it was last changed.