bulkconvert.io

Privacy Policy

Last updated: 2026-11-09

This policy describes how Bulk Convert("we", "us") processes personal data when you visit bulkconvert.io or use our file-conversion service. We follow the EU General Data Protection Regulation (GDPR).

1. Data controller

Pure Studio (Dirck Mulder), based in The Netherlands (KVK 98665103, BTW NL005345618B56). For privacy questions: privacy@bulkconvert.io.

2. What we collect and why

2.1 Files you upload

Files you submit for conversion are processed by our conversion infrastructure, converted, and made available for download. Both the source and converted files are deleted after 24 hours. We do not inspect file contents and do not retain copies. The conversion sub-processor is identified in §3 below. Legal basis: contract (Art. 6(1)(b) GDPR) — we cannot deliver the service without processing your file.

2.2 Account & payment data

When you purchase a paid plan, Stripe collects your email address, billing details, and payment method on our behalf. We receive only the Stripe customer/subscription identifiers and your email address (used to deliver your API key by email via Resend). Legal basis: contract.

2.3 Product analytics and error reports

We count visits with hub-events, our own analytics service, which runs on our own server hosted by Hetzner Online (see §3). It sets no cookies and stores no identifier on your device. It records the page path without the query string, the referring site as a domain only, campaign tags (utm_source, utm_medium, utm_campaign), your country, your device type, browser and operating system family, which links to other sites you follow, and product events such as a finished conversion with its two file formats. Your country is looked up from your IP address, and the IP address and full user agent are never stored. Visitors are counted with a hash that changes every day, so visits cannot be linked across days.

Errors in the site are reported to hub-errors, our own error tracking on the same server: the error message, the stack trace, the page path and your browser and operating system family. IP addresses, email addresses, cookies and query strings are removed before anything is stored.

Legal basis: legitimate interest in knowing which pages and features are used and in fixing errors (Art. 6(1)(f) GDPR). You can object by emailing us, see §5.

2.4 Advertising and conversion measurement

With your consent, we use the Google Ads tag and Meta Pixelto measure which ads led to a purchase, and to optimise our campaigns. Without consent, Google receives only anonymous "consentless pings" that cannot be linked to your identity. Legal basis: consent. You can withdraw consent at any time.

2.5 Logs and abuse prevention

Our database, on Hetzner servers in Germany, temporarily holds your IP address to enforce per-day conversion limits. These are retained for up to 30 days and are not used for marketing. Legal basis: legitimate interest in running a stable, abuse-resistant service (Art. 6(1)(f)).

3. Who we share data with (subprocessors)

We use the following processors. All EU/US transfers rely on Standard Contractual Clauses (SCC) as the legal transfer mechanism.

  • CloudConvert — File format conversion (EU/Global).
  • Stripe — Payment processing (EU/US (SCC)).
  • Google Ads — Advertising and conversion measurement (EU/US (SCC)).
  • Meta — Advertising and conversion measurement (EU/US (SCC)).
  • Resend — Transactional email delivery (EU/US (SCC)).
  • Hetzner Online — Server hosting for the application, its database and sign-in (EU (Germany)).

4. How long we keep your data

  • Uploaded files: deleted from conversion infrastructure after 24 hours.
  • Server logs and rate-limit keys: up to 30 days.
  • Billing records (Stripe): 7 years, as required by Dutch tax law.
  • Analytics events: 90 days, after that only daily totals.
  • Error reports: 90 days after the error was last seen.

5. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you;
  • Correct or delete it;
  • Restrict or object to processing;
  • Receive your data in a portable format;
  • Withdraw consent for advertising;
  • Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

To exercise any of these rights, email privacy@bulkconvert.io. We respond within 30 days.

6. Cookies

We use strictly-necessary cookies for the rate limiter and your session. Our analytics sets no cookies. Advertising cookies are only set after you select "Accept" in our cookie banner. Your choice is stored in localStorage for 6 months, after which we ask again.

7. Changes to this policy

We may update this policy as the service evolves. Material changes are announced on this page; the "Last updated" date at the top always reflects the most recent revision.

Questions? Contact us.