Privacy notice: what is kept, and for how long

Last revised 8 November 2026

Who holds it

CECO L.L.C. (Kosovo, Business ID 812382810) is responsible for the documents you upload here and for the decisions about them described below. Write to admin@cecopdf.com about anything on this page, including asking for a copy of what is held about you, or objecting to it.

Your documents

Uploaded so they can be corrected, and deleted after 90 days. They are not read by anyone, not used to train anything, and not shared with anyone. You can delete one yourself at any time, and you do not have to give a reason.

There is exactly one way any part of a document is kept for any other purpose, and it is the next section. It happens only when you press the button that does it.

If you choose to report a region

When we refuse a correction, you can send us the part of the page we could not handle. Only if you choose to: there is no setting that does it for you and no box that starts ticked.

What is sent is the region shown to you before you send it — the words you selected and a margin around them, at most 120 pixels on each side — together with which check refused, the measurements that check made, and any note you type. Not the file, not its name, not the other pages, not anything you corrected.

It is kept for 365 days, so that this kind of page can be measured against future versions of the tool. Erasing everything, below, erases these too.

Counting free usage

A cookie this site signs, plus a short one-way fingerprint of your browser and your network address. Hashed with a key held on the server, kept for one day, and used only to count corrections against the free allowance. It is not anonymous and we are not going to pretend otherwise: hashing an address makes it hard to read, not impossible.

If you rate CECO PDF

After a job that gave you a download, the page asks one optional question: how was CECO PDF, from 1 to 5. It asks everyone, once per job, and nothing depends on the answer. If you answer, four things are kept: the score, the tool it was about, the day (a date, without the time), and a one-way code made, with a key held on the server, from a random number your browser makes for that one question. A rating never carries the identifier of your document or your job, and the server refuses one that does, so nothing in a rating can be matched to you, your account or your files, by us or anyone else. The one limit to that: on a day when few jobs used a tool, the day and the tool alone narrow a rating down to those few jobs. Nobody here tries to match them.

Nothing that names you is kept with a rating: no account, visitor, email address, network address, document, file name or job identifier, and your browser sends it without its cookies. Your network address (for IPv6, the network it belongs to) is used only in memory, to allow at most 10 ratings an hour from one place, and is never written down. Because nothing in a rating names you, ratings are kept with no end date, and erasing everything has nothing of yours to find in them. The average and the number of ratings appear on the site only once there are 50 or more. So that it does not ask twice, your browser keeps its own list of the jobs it has asked about; that list never leaves your browser, and erasing everything clears it.

Where visitors come from, and which assistants read the site

When another site sends someone to one of our public pages, the visit is counted under the sending site's name only: chat.mistral.ai, chat.openai.com, chatgpt.com, claude.ai, copilot.microsoft.com, gemini.google.com, meta.ai, perplexity.ai, or “google”, “bing” or “other”. A link tagged as coming from ChatGPT counts as chatgpt.com. A visit with no referring site, or from our own pages, is not counted.

When an AI assistant or a crawler that names itself (ChatGPT-User, Claude-User or Googlebot, for example) fetches one of our public pages, the fetch is counted under that name, with the page (only if it is one of our listed public pages; any other is counted as “other”) and whether the request came from an address its operator publishes.

These are counted in the server's memory and written about once a minute as totals: each stored total holds the day, those names and how many, and nothing else: no network address, no browser or user-agent string, no page you came from, no query, no cookie, account or other identifier. The address is compared in memory and never stored. The counts are deleted after 90 days, and daily totals per source and per agent are kept for 3 years. To check the addresses, the server downloads the published address lists of Anthropic, Apple, Common Crawl, DuckDuckGo, Google, Microsoft, Mistral, OpenAI and Perplexity about once a day; nothing about any visitor is sent to them.

Google Analytics, only if you accept

To see which pages and which adverts bring people here, this site can use Google Analytics, which Google runs. It is used only after you press Accept on the question at the foot of the screen; until then your browser sends nothing to Google and holds no cookie of Google's. Decline is as easy as Accept, and nothing else on the site depends on your answer.

Once you accept, Google Analytics sets its own cookies in your browser. It receives:

• the address of the page you are on, only when it is one of our public pages or a tool's own page, with nothing after a “?” or “#” except the codes an advert adds to its link (utm_source, utm_medium, utm_campaign, utm_term, utm_content, utm_id, gclid, gbraid, wbraid, fbclid), unless one holds an email address; any other page is sent as /app;
• the page you came from, cut the same way, and another site by its name only;
• what your browser and device tell it (their kind and version, the language, and to Google Analytics's script the screen's size), and the network address every request carries;
• when you buy, the amount, the currency and which plan, and nothing else about the purchase.

It never receives a document, a file name, a word from a document, your email address, your account or a document's identifier. Google may combine what it receives with what it already knows, under its own privacy terms, and may process it in the United States. Google signals and Google's ad personalisation are switched off for this site.

To withdraw, press Cookie settings at the foot of any page and choose Decline: nothing more is sent to Google from that page on, and any cookie of Google's on this site is deleted. Your answer itself is kept in your browser's storage, not in a cookie, and is never sent to us.

If you sign with your own mark

A mark you place with Fill & sign goes into the PDF as a picture of your own signature or initials. The PDF's record says where it went and when, how it was made (drawn, typed or uploaded), that you confirmed it was yours, and a fingerprint of it (a hash). Your account's trail notes how many marks a save placed and where each answer and mark went, never what they say. Neither keeps a copy of the mark. Until you save, your mark stays in the page's memory, not in your browser's storage.

If you edit or redact a document

What you lay over a page with Edit PDF goes into the PDF, as annotations. The PDF's record says what kind each one is and where it went, and keeps the words of a text box or a note only as a fingerprint (a hash). A redaction's record says which regions of which pages were redacted, how much was removed from each, and the mark drawn, with the label if you chose one; it never holds what was removed. Your account's trail counts the steps and the regions, never their words.

Each step and each redaction is a new version of the document, and the versions before it are kept with the document, so that undo can bring them back, until you delete the document. When you search a document for words to redact, the words found are shown to you and kept nowhere; where they are on the page is held in the server's memory, so that the redaction can be held to the search, and is gone when later searches take its place or the server restarts.

If you connect an assistant

When you connect an assistant such as Claude or ChatGPT to your account, through the MCP server, we keep a record of the connection: the assistant's name as it gives it, the address it sends you back to, when you connected it and when it was last used, what you allowed it to do, and a one-way fingerprint (a hash) of each of its tokens, never the tokens themselves. An access token works for an hour and a refresh token for 30 days. Disconnecting the assistant on your account page ends it at once, and its record is deleted 90 days later. Erasing everything disconnects every assistant and deletes these records.

The assistant never receives your files: you upload them on our pages, through a link it gives you. An upload link keeps a record of the documents uploaded through it. A confirmation page keeps the words of each correction the assistant asked for, the ones you ticked and when you confirmed. Both are deleted 24 hours after they were made. The statement you make when you confirm is kept as every statement made before a correction is, and your account's trail notes that it was made on a confirmation page, without the words.

What the assistant does receive about a document (its identifier, its pages, the words it searched for and where they are, and counts) passes through the assistant's own service, under that service's terms. Each request an assistant makes is logged as the tool, the outcome, how long it took and which connection made it: never what it asked for or what it got back.

Your email address, if you give one

Kept until you ask for it to be removed, together with the exact words you agreed to. Used to sign you in, to tell you about a purchase you made, and — if you asked to be told — once, when a plan opens.

Signing in with Google

If you choose it, Google tells us one thing: the email address of the account you picked, and whether Google has verified it. We ask for nothing else — no contacts, no files, no profile — and we cannot see anything else. Signing in with an emailed link instead involves no third party at all.

Paying

Payments are taken by Paddle, who are the seller of record. They handle the card and the tax; we never see a card number. What comes back to us is which plan was bought and the address that bought it.

Who at CECO can see your documents

Nobody, in the ordinary course of things. Documents are stored under the account that uploaded them and no part of the service displays their contents to anyone else.

There is an operator's view of the service, used to keep it running and to answer questions about payments. It shows counts, timings, plans and failure codes — how many corrections were made, which ones did not verify, what was bought — and it is built so that it cannot show the text of a document, the words corrected, or a filename. Reaching it requires an address named in the server's own configuration and a sign-in from the last few hours.

What is never logged

The text of your documents, the words you corrected, and the filenames. Those are the parts that carry names and identification numbers, so they are dropped at the logging boundary rather than trusted not to appear.

The name of your file

We do not keep it. A filename in this line of work is often the name of the person the document is about, so what reaches us is its length and its extension — which is why a document is listed as “8c.pdf” if you look at it from another browser.

Your own browser remembers the name so the list is readable, in this browser only. It is not sent to us, it goes when you delete the document, and erasing everything erases it too.

The one exception is yours to make. A verification certificate (Business) can print a name for the document, and when you issue one you are shown the name your browser remembers so you can keep it, change it or leave it out. Whatever you choose is printed in the certificate and kept nowhere else; the certificate file is stored with the document and deleted with it.

Erasing everything

You do not have to ask, and you do not have to write to anyone. There is a button in the application that removes every document you have uploaded, any region you reported to us, the record of your usage, and your address if you left one. It happens immediately and cannot be undone.