Utilitly – GDPR Compliance

1. Introduction to GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data privacy law establishing a framework for the collection, processing, and storage of personal data belonging to EU citizens. At Utilitly.com, we adhere strictly to the principles of data minimization and privacy by design.

2. Hybrid Processing Architecture

The most effective way to secure data is to never possess it, and most of our tools are built that way. Some are not, and the distinction is the most important thing on this page.

In-browser tools — no transmission

Twenty-two of our 26 tools process your file entirely inside your own browser: Merge, Split, Rotate, Reorder Pages, Delete Pages, PDF to Image, Image to PDF, Extract Images, Annotate, Watermark PDF, Add Page Numbers, PDF Text Extractor, True Text Editor, AI Author, Sign PDF, Protect PDF, Unlock PDF, and the five image tools. No document data is uploaded, which means no cross-border transfer takes place and no personal data contained in those documents reaches our infrastructure or anyone else's. This is verifiable in your browser's DevTools Network tab.

Protect PDF and Unlock PDF joined this group in August 2026. They previously sent both the document and the password to an external service; they now encrypt and decrypt on your own machine using qpdf compiled to WebAssembly, and neither the file nor the password leaves the browser. Both are covered by automated tests that run them with the network disconnected and assert that no request leaves our own domain.

External processing — your document is transferred

Four tools send your file over an encrypted HTTPS connection to a third-party processing service: Compress PDF, PDF to Office, Office to PDF and Advanced OCR. Using any of these four constitutes a disclosure of the document to an additional processor. Encryption in transit does not change that, and we do not currently publish verified retention terms for those services.

3. Data Subject Rights

We do not store your documents ourselves. For the twenty-two in-browser tools there is no document data anywhere for us to access, rectify, or delete. For account data (such as your email address, held via our authentication partner Clerk), you retain full rights to request deletion of your account and associated metadata at any time.

4. Sub-processors

We use third-party processors for authentication (Clerk) and billing (Stripe), both of which operate under Data Processing Agreements.

In addition, the four tools described in section 2 route your document to external document-processing services. If you require the identity of those services, their locations, and their retention terms in order to complete your own GDPR assessment, contact us at the address below and we will provide them. Do not use those four tools for personal data governed by GDPR until you have done so.

5. Contact our DPO

If you have specific questions about our GDPR compliance or need to execute a data subject access request (DSAR) regarding your account data, please contact our Data Protection Officer at:

Email: support@utilitly.com

Please include "GDPR Inquiry" in the subject line.