Privacy Policy

1. Who we are

The PDF Builder service ("the Service") is owned and operated by , a sole proprietor registered in Ukraine, tax ID , registered address . Contact for personal-data questions: .

2. What data we process

2.1 Provided directly by you

• Email — identification, account recovery, notifications.
• Password — stored as a bcrypt hash, plus a salt for PBKDF2. Recovering the original password is technically impossible.
• ERP connection credentials — URL, database name, login, password, websites field name. Encrypted with a key derived from your password (KEK). Without your password, decryption is impossible — for us, or for anyone else.
• Projects — JSON structures of the PDF templates you create in the editor.

2.2 From your Odoo, through the connector

• Connection — your Odoo's public address, database name, Odoo and connector versions and company name, sent when you connect it. The API token is stored only as a hash and the HMAC secret encrypted; neither is ever part of a link.
• Field structure — the names, labels and types of the Odoo models and fields your templates use, so Studio can list them. Cached for up to one hour.
• Records for previews — only with “Live previews” on. Each connection has a privacy mode. In structure only (the default for new connections) Studio never asks your Odoo for a record and previews show generated sample values. With live previews, Studio reads the one record you preview, on request, and caches it for up to 4 days so the canvas stays fast. You can switch the mode in your cabinet at any time.
• Documents Odoo asks us to render — when Odoo prints, emails or shows a document in its portal, it sends the record data with the request. We use it only to produce that PDF; the result is kept for up to 30 minutes so a retried request is not charged twice, and a usage log keeps the date, page count and source, not the content.

2.3 Collected automatically

• IP and User-Agent — for security audit (sign-ins, password resets, account deletions). Stored in the action log.
• Technical cookies: pdf_session (httpOnly session token) and pdf_csrf (CSRF double-submit). Both are strictly necessary for the Service to function.

2.4 What we do NOT collect

• No third-party analytics (Google Analytics, Plausible, etc.) without explicit consent.
• No advertising cookies or tracking pixels.

3. Legal bases for processing

We process data under (GDPR Art. 6): performance of the contract with you (registration, access to the Service), consent, and legitimate interests (security, fraud prevention — the audit log).

4. Where data is stored

The Postgres database and Redis run on servers in the EU (Germany), hosted by Hetzner Online GmbH. Off-site backups are stored encrypted with the same provider, in the EU. Data is not transferred to third countries without additional safeguards (Standard Contractual Clauses).

5. Retention periods

• Account and related data — until you delete it or request deletion. Inactive accounts are removed after 24 months, with prior notice.
• Audit log — up to 12 months. The email is retained in the log even after the account is deleted (for incident investigation); the foreign key to the user is nulled.
• Backups — up to 30 days.

6. Your rights

• Access (Art. 15): request a copy of your data via "Account → Export" or by writing to us.
• Rectification (Art. 16): edit it in "Account" or contact us.
• Erasure (Art. 17): the "Delete account" button in "Account". The action is irreversible.
• Portability (Art. 20): JSON export is available in "Account".
• Objection (Art. 21): contact us.
• Lodging a complaint: with the supervisory authority of your jurisdiction (e.g. your local DPA in the EU).

7. Security

• Transport — HTTPS only (HSTS, modern TLS ciphers).
• Passwords — bcrypt with cost factor 12.
• ERP credentials — Fernet (AES-128-CBC + HMAC); the key is never stored on the server in plaintext.
• Sessions in Redis are additionally encrypted with a key from the environment, so a Redis backup alone does not expose the KEK.
• Rate limiting and account lockout protect against brute force.

8. Subprocessors

We rely on the following providers: Hetzner Online GmbH (hosting, EU), Resend (transactional email), and Paddle (Paddle.com Market Ltd — payments and merchant of record, where a subscription applies). The current list is available on request at .

9. Changes to this policy

We may update this policy. Material changes will be announced via the email on file at least 14 days before they take effect.