Privacy Policy

Last updated: 2026-05-24

This policy describes how Bulk Convert("we", "us") processes personal data when you visit bulkconvert.io or use our file-conversion service. We follow the EU General Data Protection Regulation (GDPR).

1. Data controller

Pure Studio (Dirck Mulder), based in The Netherlands (KVK 98665103, BTW NL005345618B56). For privacy questions: privacy@bulkconvert.io.

2. What we collect and why

2.1 Files you upload

Files you submit for conversion are uploaded to our processing partner CloudConvert, converted, and made available for download. CloudConvert deletes both the source and converted files after 24 hours. We do not inspect file contents and do not retain copies. Legal basis: contract (Art. 6(1)(b) GDPR) — we cannot deliver the service without processing your file.

2.2 Account & payment data

When you purchase a paid plan, Stripe collects your email address, billing details, and payment method on our behalf. We receive only the Stripe customer/subscription identifiers and your email address (used to deliver your API key by email via Resend). Legal basis: contract.

2.3 Product analytics

With your consent, we use PostHog(EU-hosted) to understand which features are used. PostHog stores a randomly-generated identifier in your browser; it does not link to your real name unless you log in to a paid account. Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time by clearing cookies or by selecting "Reject" in the cookie banner.

2.4 Advertising and conversion measurement

With your consent, we use the Google Ads tag and Meta Pixelto measure which ads led to a purchase, and to optimise our campaigns. Without consent, Google receives only anonymous "consentless pings" that cannot be linked to your identity. Legal basis: consent. You can withdraw consent at any time.

2.5 Logs and abuse prevention

Our hosting provider Vercel logs your IP address and user-agent on each request, and our rate-limiter Upstash temporarily stores a hashed IP to enforce per-day conversion limits. These are retained for up to 30 days and are not used for marketing. Legal basis: legitimate interest in running a stable, abuse-resistant service (Art. 6(1)(f)).

3. Who we share data with (subprocessors)

We use the following processors. All EU/US transfers rely on Standard Contractual Clauses (SCC) as the legal transfer mechanism.

• CloudConvert — File format conversion (EU/Global).
• Stripe — Payment processing (EU/US (SCC)).
• PostHog — Product analytics (EU-hosted) (EU).
• Google Ads — Advertising and conversion measurement (EU/US (SCC)).
• Meta — Advertising and conversion measurement (EU/US (SCC)).
• Resend — Transactional email delivery (EU/US (SCC)).
• Vercel — Website hosting and edge delivery (EU/US (SCC)).
• Upstash — Rate limiting (Vercel KV) (EU).

4. How long we keep your data

• Uploaded files: deleted by CloudConvert after 24 hours.
• Server logs and rate-limit keys: up to 30 days.
• Billing records (Stripe): 7 years, as required by Dutch tax law.
• Analytics events: 12 months, then aggregated.

5. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you;
• Correct or delete it;
• Restrict or object to processing;
• Receive your data in a portable format;
• Withdraw consent for analytics and advertising;
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

To exercise any of these rights, email privacy@bulkconvert.io. We respond within 30 days.

6. Cookies

We use strictly-necessary cookies for the rate limiter and your session. Analytics and advertising cookies are only set after you select "Accept" in our cookie banner. Your choice is stored in localStorage for 6 months, after which we ask again.

7. Changes to this policy

We may update this policy as the service evolves. Material changes are announced on this page; the "Last updated" date at the top always reflects the most recent revision.

Questions? Contact us.