LightPDF

The privacy policy mentions using third-party tracking tools and data analysis services but does not explicitly state whether user content or uploaded files are used to train AI models. The vague language about 'data analysis services' and lack of clear AI training disclosure creates moderate risk.

“We may use third party track tools (such as Facebook, Twitter, Google, Google Analytics) to track the information on how users use the products”

The feedback section grants LightPDF unrestricted rights to use any submitted comments, ideas, or feedback without compensation or restriction. This is a broad license grant that could extend to user-generated content.

“If you choose to submit comments, ideas, or feedback, you agree that we are free to use them without any restriction or compensation to you.”

The policy explicitly permits sharing personal data with multiple categories of third parties including service providers, payment processors, data analysis providers, and third-party tracking tools. Data may be transferred outside the EU with limited protections.

“We may share your personal identification information with such Service Providers to fulfill orders, deliver packages, send postally or email, manage customer lists, analyze data, provide marketing assistance”

The policy allows users to delete data and states deletion is initiated immediately, but acknowledges latency in deletion from servers and backup storage. Data may be retained for legal compliance. This creates moderate risk due to undefined retention periods for backups.

“there might be some latency in deleting this information from our servers and backup storage; and (2) we may retain this information if necessary to comply with our legal obligations”

The terms state that uploaded files can be used by their owner only, suggesting user ownership of files. However, the copyright section reserves all rights to LightPDF materials, and feedback is explicitly owned by LightPDF. Moderate risk due to ambiguity about generated content.

“Every file uploaded this way can be used by its owner only while none of the others can access it.”

The policy states alignment with GDPR and mentions appropriate security measures, but does not explicitly reference SOC2, HIPAA, or ISO certifications. Only GDPR compliance is mentioned, creating moderate risk for enterprises requiring multiple compliance standards.

“The operations of LightPDF are in accordance with the European Union's General Data Protection Regulation (GDPR), or the law of the location you are based on.”