Privacy Policy

1. In short

• Your files are processed on your device. Merging, splitting, compressing, editing, redaction, form filling and OCR run on your computer or in your browser. Whole files are never uploaded to our servers.
• The AI reads only the pages you allow. That page text or image is sent to an AI model provider for processing, and we do not store it.
• We keep only what we need: account data, credit usage records and payment records.

2. Data we collect

• Account data: email address, name and profile picture (if you sign in with Google, Microsoft, Apple or another provider), and an account ID.
• Plan & payment data: your plan, order history (order number, amount, currency, status, time) and subscription status. Card and bank details are handled directly by the payment providers; we never receive or store them.
• AI usage records: token and credit counts, the AI model used, the kind of action (e.g. chat or data extraction) and the time. Document content and conversations are not included.
• Daily allowance records: for limited features on the free plan we record the feature, the date and a fingerprint (SHA-256 hash) of a file identifier. File names or locations cannot be read from it.
• Feature usage statistics: how many times each tool is used per day (e.g. “merge: 3”), with a random device ID created by the app, app version, platform, country (derived from the IP address, which is not stored) and your account ID if you are signed in. No file names, locations or document content. You can turn this off in the app’s Settings → Usage statistics.
• Technical error reports: when something goes wrong in the app, it sends the error message, technical trace (stack trace), app version, platform, language and the kind of view that was open, plus your account ID if you are signed in. File locations, file names and email addresses are masked on your device before sending. Document content is never sent.
• Feedback: the message you write, its type, your email (if you are signed in or enter it) and — if you tick “Include technical info” — the app version, platform and recent error messages. A 👍/👎 rating of an AI answer stores only the rating, your comment and the answer’s length; the answer text is not sent.
• Website data: cookieless, aggregated visit statistics via Cloudflare Web Analytics, and technical server logs (e.g. IP address, request time) for security.

3. Document content and the AI assistant

When the AI assistant needs a document's content, the app asks for your permission and names the file and pages to be read (unless you choose "Always allow" in the settings). The permitted page text or images are sent through our server to Google (Gemini API) for processing, and the answer is returned to your app.

Our server stores neither document content nor conversations; it only records usage for credit billing. Google processes that data under the Gemini API terms. Chat history is stored locally on your device and can be deleted from the app at any time.

You control AI access to document content: "Ask every time" (default), "Always allow" or "Never".

4. How we use data

• To provide the service: sign-in, keeping your plan and credits in sync across web and desktop, and running the AI assistant.
• To process payments, issue receipts or tax invoices and meet tax obligations.
• To keep the service secure and prevent abuse.
• To find and fix errors, and to answer and follow up on your feedback.
• To understand which features are used so we know what to improve, and to detect abuse (such as many free accounts from one device).
• To send transactional emails: replies to your feedback and a reminder before a Rupiah plan ends. We do not send newsletters or promotional email without your consent.
• To contact you about your account, payments or important changes.

We process data to perform our agreement with you, to meet legal obligations (such as tax) and with your consent (such as when you let the AI read a page).

5. Processors we use

We use the following providers, some of which process data outside Indonesia, and share only what each one needs:

• Supabase: database, authentication and server functions (AWS data centre in Canada).
• Google: the Gemini AI model, only for pages you allow; also a sign-in provider if you choose it.
• Midtrans: Rupiah payments (QRIS, bank transfer, e-wallets).
• Creem: international card payments; Creem acts as the merchant of record and handles the buyer's local tax.
• Cloudflare: hosting of this website and the web app, content delivery and cookieless visit statistics.
• GitHub: distribution of desktop app updates.
• Telegram: internal notifications for our team (such as new orders, new feedback or service problems), which may include a buyer’s or feedback sender’s email address.

We do not sell your personal data.

6. Storage on your device

The app keeps settings, chat history, AI recipes and recent folders on your device. In the desktop app, the sign-in session and signatures are encrypted with the operating system keychain. In the web app they are kept in this site's browser storage (localStorage/IndexedDB). This website uses no tracking cookies.

7. How long we keep data

• Account data: while your account is active; deleted after you ask us to delete your account.
• AI usage and allowance records: used for billing; daily allowance records are deleted automatically after 7 days.
• Technical error reports and AI request logs: deleted automatically after 30 days.
• Feature usage statistics: deleted automatically after about 13 months.
• Feedback: as long as needed to follow it up, and deleted when you ask (including when you ask us to delete your account).
• Order and payment records: as long as tax law requires (up to 10 years).

8. Your rights

You can ask to access, correct or delete your personal data, withdraw consent and object to certain processing. Email support@smartmergepdf.com from your account address. We respond within the time required by law (within 3×24 hours for requests under Indonesian law).

9. Security

We protect data with encrypted connections (HTTPS), database access rules (each user can read only their own data), API keys kept on the server only and a strict content security policy in the web app. If a personal data breach occurs, we will notify you and the relevant authorities as the law requires.

10. Children

The service is intended for users aged 18 and over, or under the supervision of a parent or guardian.

11. Changes

We may update this policy. We will announce important changes in the app or by email before they take effect.

12. Contact

PT Dico Solusi Digital, Jl. Blok AG 11 No. 7, Citra Indah, Kabupaten Bogor, Jawa Barat, Indonesia. Email: support@smartmergepdf.com. See also the contact page.