Draft — needs legal review. This page describes how the site works today, in plain words. It has not been checked by a lawyer and is not yet a binding policy. Items marked UNKNOWN are still to be decided.
Draft dated 31 October 2026.
Who runs this site
The data controller is Abdilahi Qayre, an individual who runs this site. Location: Manchester, United Kingdom. Contact for privacy questions: hello@pdfmerci.com (mailbox not set up yet). We follow the UK GDPR and the EU GDPR. EU representative under Article 27 of the EU GDPR: UNKNOWN: to be decided after legal review.
Tools that run on your device
Most tools are marked “on device”. They work inside your browser: your file is read from your own device, processed there, and the result is saved straight back to it. The file is never sent to us or anyone else, and we cannot see it. Passwords you type into Protect or Unlock stay in your browser too. When you close the tab, the file is gone from the page.
Tools that run on our server
A few tools can’t run in a browser: Word, PowerPoint, Excel and HTML to PDF, plus the optional “Better layout” and server OCR and compress choices. These are switched off today, so nothing is uploaded. When they are switched on, this is how they will work:
- Each server tool is labelled “on our server” before you choose a file. On-device stays the default wherever both exist.
- Your file goes over HTTPS straight into temporary storage, is converted, and the result is offered for download.
- Your file and the result are deleted as soon as you have downloaded the result. Anything left over is deleted automatically within 60 minutes. A failed conversion is retried up to three times and then deleted.
- We don’t open, read, keep copies of, or train anything on your files. Your file name is never sent to us: the upload is stored under a random ID, and your browser names the result.
- For each job we keep a small record: the tool, file type, size, page count, status and times. It contains no file content. How long these records are kept: UNKNOWN: retention period.
- To stop abuse, uploads have a bot check (Cloudflare Turnstile) and an hourly limit per visitor. The limit is counted against a scrambled (keyed hash) form of your IP address, not the address itself, and resets every hour; old counters are deleted after the hour ends.
- Hosting and storage provider: Cloudflare (Cloudflare Workers). Server location: UNKNOWN: region.
No tracking
There are no analytics, ads, tracking pixels, fingerprinting or social media widgets. The site loads nothing from other websites, except the Cloudflare bot check, and only when you use a server tool. See Cookies for what is stored on your device.
Server logs
Like any website, our hosting provider may keep standard request logs, such as IP address, time, page requested and browser type, to keep the service running and secure. The site runs on Cloudflare Workers. We have switched off Cloudflare's optional Workers request logging, and our own code does not log IP addresses. Cloudflare still processes your IP address to deliver the site and protect it from attacks, and keeps aggregate traffic statistics (request counts, not individual visits) for up to three months; Cloudflare’s security event records (requests its firewall blocks or challenges, which can include IP addresses) are available to us for up to the last 31 days. Cloudflare does not publish a fixed retention period for its own network records; its privacy policy says it keeps personal information only as long as needed for its business purposes or legal obligations.
Machine drafts
Any AI-generated text, such as a future summary or translation, is labelled “Machine draft — not certified”. It is never a sworn or certified translation.
Your rights
Because on-device tools never send us your files, we hold no file data about you. For anything we do hold, such as server job records or logs, you can ask to see it or delete it at hello@pdfmerci.com (mailbox not set up yet).
Legal basis
- On-device tools: we receive no personal data, so no legal basis is needed.
- Server tools (when switched on): processing your file and keeping the job record is needed to provide the service you asked for (contract, Article 6(1)(b) GDPR).
- Security and abuse prevention, including the hourly limit, the Cloudflare Turnstile bot check and Cloudflare’s security records: our legitimate interest in keeping the site safe and available (Article 6(1)(f) GDPR).
Complaints
You can complain to the UK Information Commissioner’s Office (ico.org.uk) or to the data protection authority in the EU country where you live, where you work or where you think the problem happened (Article 77 GDPR). You can also go to court (Article 79 GDPR). We’d like the chance to help first, so please contact us at hello@pdfmerci.com (mailbox not set up yet).
Changes
We will update this page before any change in how files are handled, such as switching the server tools on.