This policy describes the processing of your personal data within the MacedFileConvert service, in accordance with the General Data Protection Regulation (GDPR).
1. Data controller
The data controller is MACED CONSULTING (SAS), 66 avenue des Champs-Élysées, 75008 Paris, reachable at contact@macedfileconvert.com. No data protection officer (DPO) is appointed; for any question regarding your data, write to contact@macedfileconvert.com.
2. Data collected
- Account: email address, password (hashed), optional name, settings (language, 2FA).
- Files: the files you upload and the conversion results, on a temporary basis.
- Usage: technical logs, operations performed (quotas), IP address (security and abuse prevention).
- Device identifier: a pseudonymous identifier stored via a cookie (
ff_device), associated with the IP address, in order to limit free trials without an account and to prevent the creation of multiple free accounts (abuse prevention). - Payment: handled by our provider (Stripe); we do not store your banking data.
3. Purposes and legal bases
- Provision of the service (performance of the contract);
- Management of accounts, billing and support (performance of the contract);
- Security, abuse prevention and enforcement of quotas (legitimate interest);
- Compliance with legal obligations (accounting, etc.).
4. Retention periods
- Files: deleted automatically after the retention period, within 1 hour for anonymous conversions and the free plan, within 48 hours for the Premium plan, within 7 days for the Pro plan. Manual deletion is possible at any time.
- Account: kept as long as the account is active, then deleted on request.
- Billing data: kept for 10 years (legal accounting obligation).
5. Recipients and subprocessors
- Host: OVH SAS (2 rue Kellermann, 59100 Roubaix, France, data hosted in the European Union);
- Payment: Stripe;
- AI translation/summary functions: Anthropic (API Claude), the text to be processed is transmitted to the provider. OCR and transcription are performed locally.
6. Transfers outside the European Union
The storage and conversion of your files take place within the European Union. However, certain features rely on subprocessors that may process data outside the EU: payment (Stripe) and the AI functions (Anthropic, to which the text to be processed is transmitted). These transfers are governed by the European Commission's Standard Contractual Clauses (SCC), incorporated into the data processing agreements (DPA) concluded with these providers. The AI functions are optional: you can use the Service without resorting to them.
7. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection. To exercise them: contact@macedfileconvert.com. You may also lodge a complaint with the CNIL (www.cnil.fr).
8. Cookies
The Service uses only first-party cookies, with no advertising purpose or resale to third parties:
- Strictly necessary cookies: authentication and session maintenance (e.g.
ff_refresh), security. Essential to operation, they do not require consent. - Anti-fraud cookie (
ff_device): a pseudonymous device identifier stored to limit the number of free trials that can be run without an account and to prevent the creation of multiple free accounts. Stored on the basis of legitimate interest (abuse prevention), it does not require prior consent.HttpOnlycookie, kept for up to 12 months. You can delete it at any time from your browser.
The Service does not use audience measurement or advertising tracking cookies. Should audience measurement ever be added, it would be subject to your prior consent.
9. Security
We implement appropriate technical and organizational measures:
- Encryption at rest: your files (uploaded and conversion results) are stored encrypted on our servers.
- Encryption in transit: all communications with the Service are protected by HTTPS (TLS).
- Access restricted to the owner: files attached to an account are only accessible to that account; downloading a result requires a link protected by a non-guessable secret token, without which no file is served.
- Automatic deletion: files are purged after the retention period (see § 4).
- Passwords: never stored in clear text, hashed (Argon2). Two-factor authentication (2FA) is available on your account.
- Hosting in the European Union (see § 5).
Despite these measures, no transmission or storage of data can be guaranteed to be completely secure.