Skip to main content
Convert·Into
Legal

Privacy Policy

Your statements contain some of your most sensitive data. This policy explains, in plain terms, what we collect, how we use it, and how quickly we delete it.

Effective 1 July 2026 · Last updated 1 July 2026

1. Overview

This Privacy Policy explains how Convert·Into handles personal data when you visit our website, create an account, or use the service to convert documents. It should be read alongside our Terms of Service.

We are committed to data minimisation: we collect only what we need, keep it only as long as necessary, and protect it with strong technical controls.

2. Who we are

Convert Into operated by Outwave Technologies, a company registered in Quebec, Canada, acts as the data controller for the personal data described in this policy. Where we process files on behalf of a firm, we may act as a processor under that firm’s instructions.

3. What data we collect

We collect the following categories of data:

  • Account data: your name, email address and, for paid plans, billing details processed by our payment provider.
  • Uploaded files: the documents you submit for conversion and the outputs we generate from them. These may contain financial and personal information.
  • Usage data: logs, device and browser information, and diagnostic events that help us operate and secure the service.
  • Support data: the content of any messages you send us.

4. Your uploaded files

The files you convert are the most sensitive data we touch, and we treat them accordingly. They are encrypted in transit and at rest, processed in an isolated, single-tenant environment, and returned only to your session.

We do not read your files for any purpose other than producing your output, we do not sell them, and we never use them to train machine-learning models. Both the source file and its output are deleted whenever you choose to remove them.

5. How we use data & our legal bases

We use personal data to provide and improve the service, process payments, respond to support requests, keep the service secure, and comply with our legal obligations.

Depending on the activity, our lawful bases are: performance of our contract with you (to deliver conversions and manage your account), our legitimate interests (to secure and improve the service), your consent (for optional communications), and compliance with legal obligations (such as tax and accounting records).

6. Sharing & sub-processors

We do not sell personal data. We share it only with service providers who help us run Convert·Into, under contracts that require them to protect it and use it only on our instructions. These include cloud hosting, payment processing and email delivery providers.

We keep our list of sub-processors deliberately short, and a current list is available on request. We may also disclose data where required by law or to protect our rights, users or the public.

7. Data retention

Uploaded files and their outputs are retained only as long as needed to provide the service, and deleted whenever you remove them. Account data is kept for as long as your account is active and for a reasonable period afterwards. Billing and transaction records are retained as required by law.

Professional and Enterprise customers can configure custom retention windows for converted files. When data is no longer needed, we delete or anonymise it.

8. How we protect data

We use TLS 1.3 in transit and AES-256 encryption at rest, with keys managed in a hardware security module. Access is role-scoped, logged and reviewed, and our infrastructure is continuously monitored with a tested incident-response plan.

You can read more in our Security overview. No system is perfectly secure, but we design ours so that a single failure does not expose your data.

9. International transfers

We may process data in countries outside your own, including where our sub-processors operate. Where we transfer data internationally, we rely on appropriate safeguards such as standard contractual clauses or a recognised adequacy decision.

10. Your rights

Depending on where you live, you have rights over your personal data, which may include:

  • Access: request a copy of the data we hold about you.
  • Rectification: ask us to correct inaccurate or incomplete data.
  • Erasure: ask us to delete your data where there is no overriding reason to keep it.
  • Restriction & objection: limit or object to certain processing, including direct marketing.
  • Portability: receive your data in a structured, machine-readable format.
  • Withdraw consent: where processing is based on consent, at any time.

11. Cookies

We use essential cookies to run the service and keep you signed in, and limited analytics to understand how the site is used. You can control non-essential cookies through your browser or our cookie settings, where offered.

12. Children

Convert·Into is intended for business use and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the service evolves or as the law changes. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you directly.

14. Contact us

For any privacy question or to exercise your rights, contact our data team at privacy@convertin.to. If you are in Quebec and are not satisfied with our response, you have the right to complain to the Commission d’accès à l’information (CAI), or to your local data protection authority elsewhere.

Exercise your rights

To access, correct or delete your data, or to raise a concern, contact our data team at privacy@convertin.to. See also our Terms of Service and Security overview.