Privacy Policy

OrbConvert is an online file conversion service. You can upload files, convert them between formats, and download the results — with or without an account. This Privacy Policy explains what personal information we process when you do that, and why.

We wrote this policy to be read, not just linked at the bottom of a signup form. Where the answer depends on how you use the service — guest versus account, free versus paid — we explain the difference instead of papering over it.

This policy is part of your agreement with us alongside our Terms of Service. If you use the OrbConvert API, everything here applies to API usage too.

OrbConvert ("OrbConvert", "we", "us") operates the file conversion platform available at orbconvert.com, its API at api.orbconvert.com, and related services.

For the purposes of applicable data protection law, OrbConvert is the controller of the personal information described in this policy — we decide why and how it is processed.

You can reach us about anything in this policy at privacy@orbconvert.com, or by the other contact routes in the Contact section at the end.

We only collect the categories of information the service actually needs. Below is the complete list — if something is not on it, we do not collect it as part of running OrbConvert.

• Account information (if you register): your email address, an optional display name, and a password stored only as a bcrypt hash. If you sign in with Google or GitHub, we also store your provider account ID, the name your provider shares with us, and (for Google) your profile picture URL.
• File and job data: the files you upload, their filenames, sizes, detected types, the conversion requested (input and output formats), job status, timing, and any error codes. For accounts, jobs are linked to your user ID; for guests, jobs are linked to a rotating guest identifier (see below).
• API data (if you use the API): your API keys and their names, when each key was last used, and usage counters (number of conversions per day and month).
• Email and notification data: a record of transactional emails we send you (type, recipient address, subject, delivery status), and your notification preferences.
• Billing data (if you buy a paid plan): your plan, subscription status, and Stripe customer, subscription, and invoice references. Card numbers are entered on Stripe's checkout pages — we never see or store them.
• Technical and security data: your IP address and browser user-agent in security-relevant records (failed logins, administrative and admin-panel sessions, audit events), and rate-limiting counters keyed by IP.

If you use the service as a guest (without an account), we do not ask who you are. Your browser generates and stores a random guest identifier (a random string, not a fingerprint of your device), which is sent with your requests so daily guest limits can be enforced. Guest jobs are recorded against a one-way hashed version of that identifier.

We use the information above for these purposes, and only these:

• Creating and authenticating your account, verifying your email address, handling password resets, and keeping you signed in.
• Performing the conversion, compression, or optimization you asked for, and giving you the result to download.
• Enforcing the plan limits that apply to you — daily and monthly conversion counts, file size caps, and storage usage.
• Sending you transactional email: welcome and verification messages, password reset and security notices, and — if you keep them enabled in Settings — completion, failure, storage, usage, and billing notifications.
• Operating the API: authenticating your API keys, metering their usage, and rate-limiting requests.
• Processing payments and keeping billing records when you purchase a paid plan or coupon.
• Protecting the service: detecting brute-force logins, rate-limiting abuse, recording administrative actions, and diagnosing errors.
• Understanding aggregate service usage — which tools and format pairs are used, and how many jobs succeed — to decide what to improve. This is aggregate, not individual profiling.

We do not use your files or personal data to train machine learning models, and we do not sell personal information. These are facts about how the system is built, not marketing promises: there is no code path that sends your data to advertising or model-training services.

Where the GDPR or similar law applies, we rely on different legal bases depending on the activity: performing our contract with you (account, conversion, API, and billing operations), our legitimate interest in keeping the service secure and functioning (security logs, error diagnosis, aggregate statistics), and legal obligations (records we must keep, such as invoices). If you have questions about the basis for a specific activity, contact privacy@orbconvert.com.

This is the part that matters most for a file conversion service, so here is the complete lifecycle of an uploaded file:

• 1. Upload: your file is uploaded over an encrypted connection and placed in temporary processing storage. If cloud storage (S3 or Cloudflare R2) is configured for the deployment, the working copy lives there; otherwise it stays on the server's local processing directory.
• 2. Processing: the conversion runs in an isolated processing job. Conversion settings you choose (such as bitrate or quality options) live in memory only while your job runs and are not written to the database — including archive passwords, which are deliberately never persisted.
• 3. Download: once complete, the output is saved to storage and you get a download link that is tied to your account (or your guest identifier) and a short-lived signed token. Nobody else can use your download link.
• 4. Input deletion: the moment your output exists, your original uploaded file is deleted from storage — we do not keep both.
• 5. Output deletion: the converted output is kept so you can download it, then permanently deleted. How long depends on your plan (see the retention table below). A cleanup job runs every hour and removes anything past its expiry.
• 6. Record removal: when the output is deleted, the job record that described it (filename, formats, sizes, timestamps) is deleted from the database too.

Output retention by plan (defaults; administrators can adjust these per plan):

Things that are true, stated plainly:

• We can see job metadata (filename, size, formats, timing, status) as part of operating the service. Administrators can view this metadata for support and abuse handling.
• Administrators cannot browse a library of your files, and the admin interface exposes job metadata only — not your original uploads or outputs.
• Your files are never shared with third parties. Conversion happens on our infrastructure; nothing is sent to an external processing service.
• Failed jobs: if a conversion fails, the job record (with the filename and error) is kept in your history with a 7-day expiry — the same hourly cleanup removes it. The input file is deleted immediately on failure. Abandoned upload files that never became a job are removed after at most 24 hours.
• Database backups, described in the Data Security section, contain job records but not your file contents.
• Files are not used to train models, and there is no advertising or analytics code that reads file contents.

Registration asks for an email address and a password; a display name is optional. Passwords are stored as bcrypt hashes — we cannot read them, and our staff will never ask you for one.

• Email verification: after registration we send a verification link containing a single-use token that expires after 24 hours. The token itself is stored only until it is used or expires.
• Password reset: reset links contain a single-use token that expires after one hour. Reset requests for addresses that do not exist return the same response as successful ones, so nobody can use the reset form to discover which emails are registered.
• Social sign-in: if you use Google or GitHub sign-in, the provider shares your account ID, email, and (Google) name and picture with us. We never receive or store your provider password, and signing in with a provider does not give us permission to post or act on your behalf elsewhere.
• Sessions: when you sign in, we create a short-lived access token and a refresh token that lasts 30 days. You can end sessions by changing your password; administrators can revoke refresh tokens for security reasons.
• Profile: you can set or change your display name and bio at any time in Settings. An avatar image, if your account has one, is stored like any other file and shown beside your name in the product; the account settings do not currently offer a way to change it.

We keep a security record of failed login attempts (with the attempted email address, IP, and browser details) to detect brute-force attacks. Login endpoints are rate-limited for the same reason.

If you use the OrbConvert API, we process the following:

• API keys: when you create a key, it is shown to you once in full. After that, we display only its name and an 8-character prefix, plus when it was created and last used. Keys can be revoked at any time, and you can have up to 5 active keys on Pro (20 on Business). Free plans have no API access.
• Usage records: per-day and per-month conversion counters tied to your account, used to enforce your plan's API limits.
• Request logs: like any web service, the infrastructure handles your requests (with IP addresses) for delivery, rate limiting, and error diagnosis. API errors are recorded with sanitized details — request IDs, endpoint, status, error code — never your file contents or credentials.
• Authentication: API requests are authenticated with your key in a header, exactly as documented in our API documentation. We do not publish the internal format of tokens beyond what the docs describe.

The Job Builder is a visual tool that helps you compose multi-step conversion workflows and generate the corresponding API calls. The workflow you build stays in your browser — it is not saved to your account unless you copy the generated request elsewhere. When you run a workflow, the jobs it creates are processed like any other conversion and follow the same retention rules in section 5.

OrbConvert sets and uses browser storage for these purposes. The table below covers the ones that carry personal data or identity; the itemised, complete inventory — including the short-lived session entries — is in our Cookie Policy:

If your browser still holds keys from our previous branding ("Zyvenix-*"), the app migrates them to the new names and deletes the old ones on your next visit.

Today we do not use advertising cookies, cross-site tracking cookies, or fingerprinting: the storage listed above is what the site needs to function, and it stays on your device under your control. OrbConvert is free to use, and advertising may be introduced at any point as one of the ways it is supported. This page describes what we do now — it is not a commitment about a date — so here is exactly what will hold if and when advertising becomes active: it is served through a third-party advertising partner, and that partner and the cookies it sets are disclosed here; in the regions where the law requires your consent (the EEA, the United Kingdom and Switzerland) no advertising script and no advertising cookie is loaded before you have given that consent; and outside those regions you can still refuse, with the same result. A banner asks for that consent whenever an advertisement could actually load, and it is never shown otherwise. The itemised list of what is stored, and of what advertising will add to it, is in our Cookie Policy.

We keep this section deliberately boring: OrbConvert currently does not run any third-party analytics, advertising, or session-recording tools. There is no Google Analytics, no Plausible, no PostHog, no Sentry, no Clarity, and no social pixels on the site today. Advertising may be introduced at any point — when it is, the storage section above says exactly how it is gated and it is named there, alongside the cookies it sets.

What we do have is our own internal, privacy-respecting usage data:

• Public aggregate statistics: total jobs, success/failure counts, popular format pairs — computed from anonymized job records and shown in the admin panel for capacity planning.
• Per-account usage counters (see section 7) so you can see your own usage and we can enforce plan limits.
• The application code includes a small hook for future analytics events, but no analytics script is loaded — the events go nowhere today.

If we ever add an analytics provider, we will update this section, publish the Cookie Policy first, and — for anything that isn't strictly necessary — give you a consent choice before it runs.

We rely on a small number of third-party services to operate. Each receives only what it needs to do its job:

These providers are processors or sub-processors acting on our instructions — we do not give them your data to use for their own purposes beyond what their services require. Each maintains its own privacy policy, which we link from our docs as they are formalized.

We share personal information only with:

• The service providers listed in section 10, limited to what each needs to function.
• Payment and subscription data within Stripe, so your subscription and invoices can be managed (for example, when you use the billing portal).
• Law enforcement or regulators where we are legally required to respond to a valid legal process.
• Other parties in connection with a business transaction (merger, acquisition, or asset sale) — if that ever happens, we will notify you before any transfer.

We do not sell your personal information, and we do not share it for third-party advertising or tracking. Within OrbConvert, access to your data is role-restricted: support staff can see the tickets you send; administrators can see job metadata and account records needed to run the service, but the admin panel does not expose your files' contents (see section 5).

OrbConvert is a global internet service: depending on where you are and how the deployment is configured, your information may be processed in a country other than your own — including by the providers in section 10 (for example, Stripe and Resend process data in the United States).

Where the GDPR or similar law applies to a transfer, we rely on recognized safeguards such as adequacy decisions or the provider's standard contractual clauses where available. Because our provider inventory and infrastructure locations may change, we keep the specifics in an internal register — you can request the current status by writing to privacy@orbconvert.com.

How long we keep each category of data — and what happens after:

When a retention window ends, deletion is carried out by an automated job — we do not depend on someone remembering to press a button. Data that must be kept for legal reasons (like billing records) is kept only for that reason and no longer than necessary.

No internet service can promise perfect security, but here is concretely how OrbConvert protects your information:

• Encryption in transit: all traffic to and from orbconvert.com and the API goes over HTTPS (TLS 1.2+), enforced by the gateway that fronts the service.
• Passwords are hashed with bcrypt; we never store or see them in plain text.
• Download links are bound to the owning account or guest identifier and use short-lived signed tokens — a leaked link stops working quickly, and links can't be replayed by others.
• API keys and OAuth cloud-storage tokens are stored server-side only; cloud-storage tokens are additionally encrypted at rest.
• Rate limiting on login, registration, and general API traffic to blunt brute-force and abuse.
• Role-based access control in the admin panel, with an append-only audit log of administrative actions. Audit and error records are automatically scrubbed of secrets, tokens, and file paths before being written.
• Least-privilege file access: the file-serving endpoint verifies ownership before serving any file — there is no public directory of user files.
• Infrastructure-level headers and protections (HSTS, clickjacking protection, referrer policy) applied at the gateway.

We do not claim any formal security certification (such as ISO 27001 or SOC 2) — if that ever changes, this section will say so explicitly. If you believe you have found a security issue, please report it to security@orbconvert.com rather than testing against production accounts.

You always have these choices, regardless of where you live:

• Access and export: Settings → Privacy lets you download a JSON export of your account information and conversion history at any time.
• Correction: you can change your name and bio yourself in Settings. To correct anything else on your account — including your email address, which requires re-verification — contact support.
• Notification choices: Settings → Notifications controls which non-critical emails you receive (completion, failure, storage and usage warnings, billing, product updates). Security-critical messages — password resets, verification, security alerts — are always sent for your protection.
• Deletion: you can delete your account and its data at any time (see the next section).
• API keys: view, create, and revoke in Settings.
• Browser storage: clear your local storage and cookies at any time — the site simply signs you out and regenerates a guest identifier next visit.

If you are in the European Economic Area, the United Kingdom, or a jurisdiction with comparable law, you additionally have the rights to request access, rectification, erasure, restriction, and portability of your personal data, to object to processing based on legitimate interests, to withdraw consent for consent-based processing, and to lodge a complaint with your supervisory authority.

To exercise any of these rights, email privacy@orbconvert.com from the address on your account (or tell us which account you mean). We verify we are talking to the account owner before making changes — normally by answering through the account's own email. We aim to respond within 30 days and will tell you if we need longer for a complex request. You never need to pay to exercise a data protection right.

Deletion is self-service: Settings → Privacy → Danger Zone. You confirm with your password (or, for social sign-in accounts, by typing your exact email address), and the account is deleted immediately — not queued for 30 days.

When your account is deleted:

• Your user record, password, profile (name, bio, avatar link), email address, and sign-in provider link are deleted.
• Your refresh tokens, API keys, notification preferences, quota records, and usage counters are deleted.
• Your subscription and invoice references are removed with the account.
• Any remaining output files tied to your account are deleted from storage at the time of deletion. The job records that described them are detached from your identity (the user link is removed) and deleted when their retention window ends.
• Some records survive in detached form: audit logs keep the action and timestamp but lose both the link to your user ID and your email address. Email delivery records for messages already sent are retained detached for delivery auditing.
• Billing documents required for tax and accounting purposes may be retained as required by law, detached from your account.

Guest users don't need to delete anything — there is no account. Clearing your browser storage for orbconvert.com removes your guest identifier and its local data; the associated anonymous job records expire through the normal retention cleanup.

OrbConvert is a professional file-processing tool and is not directed at children, and we do not knowingly collect personal information from children. If we learn that an account belongs to a child, we will delete it.

We have not set a specific minimum age of eligibility, because eligibility rules depend on the legal entity's jurisdiction — this is a pending item in our legal review, tracked in the internal notes. Parents or guardians who believe their child has created an account can write to privacy@orbconvert.com.

We may update this policy as the service evolves — for example, if we add an analytics provider, change retention periods, or finalize legal entity details. When we do, the "Last updated" date at the top of this page changes, and meaningful changes are summarized at the top of the page so you don't have to diff the text yourself.

The current version always lives at https://orbconvert.com/privacy. For significant changes to how we handle personal information, we will also notify signed-in users through the service (for example, an in-product notice or an email to your account address where appropriate). We don't promise notification methods the product can't actually deliver.

If you keep using OrbConvert after a change takes effect, you are agreeing to the updated policy. If a change is unacceptable to you, you can delete your account at any time — your files and data go with it.

The fastest way to reach the right people:

• Privacy questions, data requests, and everything covered by this policy: privacy@orbconvert.com
• General product help and support: support@orbconvert.com — or use the contact page
• Security reports: security@orbconvert.com
• Legal inquiries: legal@orbconvert.com
• Post: OrbConvert, attn: Privacy — a postal address will be added once the legal entity details are finalized (see the note in section 2).

We are a small team, but every message to these addresses is read by a human. For anything sensitive, prefer email over social channels.