Controller and contact
EURL ZENATI, 60 rue François Ier, 75008 Paris, France, SIREN 981 830 227, is the controller of the data processing needed to run BeauPDF, to keep it secure and to handle the requests it receives.
For any question or request about your data, use the contact details.
Data we use
- Documents and results: the files you send, their content, name, format and size, and the files produced.
- Operations: the selected tool and options, technical identifiers, dates, processing status and any error codes.
- Document register: each uploaded or generated file is linked to its technical owner, its origin, the relevant operation and its expiry date. This information lets us return results to the correct user and manage their deletion.
- Session and connection: a technical session identifier, session data and, within the infrastructure, the IP address and browser information needed for communication and security.
- Account: your email address verified by a code, your full name if you provide it, your language and account status. This information is used to provide your personal space; your email is not used for marketing.
- Local preferences: display settings and recently opened tools, stored in your browser.
- Contact requests: your contact details, message and the information you choose to send.
Visiting a page, editing locally or selecting files creates no account and sends no document. An account with a verified email address is required when you start processing.
Purposes and legal bases
Files, settings and the session enable us to carry out your request and return the result. For data about you that is necessary for this service, the legal basis is performance of the requested service, under Article 6(1)(b) of the GDPR.
Account creation, sending the sign-in code and access to your space also serve to perform the service you request. Only your email is required; your name can be left blank or removed at any time.
Preventing unauthorised access, limiting abuse and diagnosing incidents are based on our legitimate interest in protecting and maintaining the service. Replies to general contact requests rely on our legitimate interest in following up enquiries; requests to exercise rights are handled to meet our legal obligations.
Uploading files is optional when browsing, but running a tool requires a verified account. Required settings are shown in the interface. Processing cannot succeed without this information and authentication. Contact requests need a reply address if you want a response.
If your documents contain data about other people, you are responsible for having a legal basis and the permissions needed to process and transmit it. In a professional context, you determine the purposes of document processing; check your obligations and the applicable contractual framework before uploading.
Hosting and recipients
Accounts and your data are hosted on Scaleway, provided by Scaleway SAS, in Paris (European Union).
Sign-in codes are sent by Scaleway Transactional Email, a service of Scaleway SAS (France), from servers located in France.
The recipients are the authorised people at EURL ZENATI for operating the service and handling requests, the host and the technical providers involved in delivering the service. The competent authorities may receive information where the law requires it.
The hosting provider describes its data processing practices in its privacy policy and contractual documentation. You can ask us for details through the Contact page.
Contact messages
Emails sent to our contact address are routed by Forward Email and then received and processed in Gmail (Google). These providers process the content of the messages, any attachments and the data needed to deliver them. This route may involve processing outside the European Union; it is separate from the storage of your data in your account.
The privacy policies of Forward Email and Google describe their practices. Prefer an example without confidential data when you report a problem to us.
Retention periods
- Uploaded files and results: they become eligible for deletion 30 days with an account after each file is created on the server. Cleanup is scheduled every 15 minutes. An incident may delay deletion; this period is not a guarantee of deletion to the exact second.
- Operation records: the same 30-day rule applies from their creation date. Expired items are not reactivated.
- Account and profile: they are retained while your account remains open, even after files expire. You can delete them from your profile.
- Document register: document records expire with their corresponding files and are deleted by periodic cleanup. This register is not a long-term storage space.
- Local preferences: they remain in your browser until you delete them or clear the site’s data. They are not a copy of your documents.
- Contact requests: les échanges sont conservés pour traiter et suivre la demande ; la règle de suppression après 30 jours dans un compte des fichiers déposés dans les outils ne s’applique pas aux e-mails. Les éléments nécessaires à une obligation légale ou à la gestion d’un litige peuvent être conservés séparément pendant la durée correspondante.
Les journaux techniques de l’hébergeur ont une durée distincte de celle des fichiers, dépendant des paramètres du service d’infrastructure et du suivi des incidents. Le délai de 30 jours dans un compte ne s’applique pas à l’ensemble des données de connexion. Les fichiers téléchargés sur votre appareil ne sont pas concernés par le nettoyage du service.
Encrypted daily technical backups are kept for 7 days. They include accounts, metadata and file contents, including data already deleted from the service. They are reserved for disaster recovery. A restoration must not reactivate expired or deleted data.
Storage in your browser
Cookies or equivalent storage maintain the account session and authorise access to your operations. Local storage also remembers your display preferences and recently opened tools. BeauPDF does not include advertising trackers or track your browsing across different websites.
During sign-in, tab storage temporarily holds your email address and sign-in token identifier. These are cleared after sign-in or when the tab closes; requests older than 24 hours are not resumed automatically. The emailed code is never stored there.
You can delete these items in your browser settings. This resets preferences and may interrupt access to an ongoing session; it does not immediately delete files already sent to the server.
Your rights
Under the conditions set by the GDPR, you can ask for access to your data, its rectification or erasure, the restriction of a processing operation and the portability of the data concerned. You can also object, on grounds relating to your situation, to processing based on legitimate interest, and give instructions on what happens to your data after your death.
Send your request to the contact details for personal data, from the email address of your account when the request concerns it. We may ask for the information strictly necessary to verify your link with the data. There is no need to send a copy of your identity document unprompted.
A reply is normally given within one month of receiving the request. This period may be extended by two months because of the complexity or the number of requests; you are then informed of the extension and its reasons within the first month.
You can lodge a complaint with the CNIL without having to contact us first.
Security and changes
The measures for transmission, access control and retention are presented on the Security page. The service makes no automated decision producing legal effects concerning you.
This policy may change with the service. Its update date is shown below. Information about a new purpose must be given to you before the corresponding processing.
Last updated: 24 September 2026.