Privacy & Cookie Policy
Last updated: 2026-06-16
What we collect
Two things, and only these. (1) Operational data needed to run the service: the requesting IP address, the type of conversion, and basic request metadata — used for rate-limiting and abuse prevention. (2) If, and only if, you accept the Analytics category in the cookie banner: aggregate, first-party usage statistics (page views and conversion types). Our analytics are self-hosted — there is no third-party analytics SaaS and no cross-site tracking.
What we don't collect
The contents of your files, file names, email addresses, names, or account information. There is no signup, so there is nothing to leak. We never sell your data and never use your files to train models.
File handling
Files are converted in the cloud, not in your browser. They travel over an encrypted connection (TLS), are processed in memory or on a short-lived temporary disk for the duration of the conversion only, and are automatically deleted within minutes of the response being sent. They are never shared with third parties.
Cookies & storage
We show a consent banner and only set non-essential cookies after you accept them. The categories:
• Strictly necessary (always on): a `bastos_consent` cookie that remembers your choice, a rate-limit token enforcing the free daily quota, and a local theme preference stored in your browser. These need no consent under GDPR.
• Analytics (optional, off until you accept): enables our first-party, self-hosted usage statistics. No cross-site tracking, no advertising use.
• Marketing (optional, off until you accept): if advertising is enabled on a page, Google AdSense may set advertising cookies. EU/UK consent for those is collected by Google's own certified consent message, in addition to this banner.
You can change or withdraw your choice at any time by clearing site cookies or via the consent controls.
Third parties
Core conversion runs on our own infrastructure; no third party sees the contents of your files. The only third party that may be involved is Google AdSense, and only on pages where advertising is enabled and only if you accept the Marketing category. If a third-party CDN is ever placed in front of static assets, this section will be updated.
Data retention
Uploaded files: deleted within minutes of conversion. Operational logs (incl. IP) for rate-limiting/abuse: kept short-term, then discarded. Consent choice: stored for up to 12 months. Aggregate analytics: retained in aggregate, not tied to your identity.
Your rights
Under the GDPR and equivalent regulations you have the right to information, access, rectification, erasure, and to withdraw consent. As we store nothing that identifies you long-term, most requests resolve quickly. To exercise a right or ask a question, contact us below.
Contact
Privacy questions: contact@bastosconvert.com. See also our legal notice for the publisher and host details.
Legal notice →