Privacy Policy

UrsaPDF Inc. ("UrsaPDF", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your information when you use our website (ursapdf.com), the UrsaPDF desktop software, and related services (collectively, the "Service").

1. Information We Collect

We collect only the information needed to operate the Service:

• Account Information: Email address and a password hash when you create an account.
• License Information: License key, plan tier, and (for desktop sign-in) a one-time token used to authenticate the desktop app to your account.
• Payment Information (from Paddle): Your email, billing country, and Paddle transaction/subscription IDs. Card numbers, CVVs, and bank account details are collected and held by Paddle only and are never transmitted to or stored by UrsaPDF.
• Usage Data: Anonymous, aggregated feature usage statistics (opt-in). You can disable this at any time.
• Website Analytics: Standard server log data (IP address, browser type, referrer, pages viewed) for security and basic traffic analysis.
• Support Communications: When you email us, we retain the message and your reply to resolve your inquiry.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Authenticate your account and license, including desktop sign-in.
• Process payments, manage subscriptions, and prevent fraud (via Paddle).
• Respond to support requests and other communications you initiate.
• Send you important service notices (e.g., billing events, security alerts, Terms changes). Marketing emails are sent only with your consent, and you may opt out at any time.
• Improve the Service based on aggregated, non-identifying usage patterns.

3. Data Storage and Security

Account and license data is stored on secure servers with encryption at rest and in transit. We use industry-standard safeguards including TLS/SSL for all client-server communication, hashed (bcrypt) passwords, role-based access controls for staff, and audited backup procedures. Payment data is held by Paddle under PCI-DSS Level 1 controls; see Paddle's Privacy Policy for details on how they handle it.

4. Data Sharing

We do not sell your personal information. We share data only with the parties below, and only the minimum required for them to perform their function:

• Paddle.com: For payment processing, fraud prevention, tax calculation, and order/receipt delivery. Paddle acts as an independent data controller for the payment data it holds. See Paddle's Privacy Policy.
• Service Providers: Hosting (Hetzner), transactional email (for receipts and account notices), and web analytics. Each provider is bound by a data-processing agreement.
• Legal and Safety: When we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or to protect the rights, property, or safety of UrsaPDF, our users, or others.
• Business Transfers: In connection with a merger, acquisition, financing, or sale of assets, in which case we will notify affected users.

5. Cookies and Similar Technologies

We use only the cookies necessary to operate the Service:

• Essential cookies: To keep you signed in and to remember your session.
• Analytics cookies (optional): Aggregated, non-identifying traffic analysis. We do not use advertising or cross-site tracking cookies.

Paddle's checkout may set its own cookies when you reach the payment page; see Paddle's cookie notice on the checkout screen.

6. Your Rights

Depending on your jurisdiction (including the EU/EEA/UK under the GDPR, California under the CCPA/CPRA, and other applicable laws), you have some or all of the following rights:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your account and associated data.
• Object to or restrict certain processing (e.g., marketing).
• Data portability for the data you provided to us.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us at privacy@ursapdf.com. We respond within 30 days. For payment data held by Paddle, please contact Paddle directly or use the request form at paddle.net.

7. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence, including the United States and the European Union. Where required (e.g., transfers from the EU/EEA/UK to a third country), we use appropriate safeguards such as the European Commission's Standard Contractual Clauses. Paddle's own data-transfer practices are described in their privacy policy.

8. Data Retention

We keep your account data for as long as your account is active. If you request deletion, we delete or anonymize your account data within 30 days, except where we are required to retain it (e.g., tax/audit obligations, or to resolve disputes). License-related records may be retained for up to 7 years for warranty and tax purposes.

9. Children's Privacy

The Service is not intended for children under 16 (or such higher age as your jurisdiction requires for consent to data processing). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact privacy@ursapdf.com and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users and by updating the "Last updated" date on this page. Continued use of the Service after changes constitutes acceptance of the revised policy.

11. Contact

For privacy-related inquiries or to exercise your rights:

• Data Controller: UrsaPDF Inc.
• Email: privacy@ursapdf.com
• Business Address: Available on request via support@ursapdf.com

For payment-data inquiries, contact Paddle at paddle.net as the independent controller of that data.