Privacy Policy

1 Introduction, Mission & Data Controller

Welcome to ConvertHEICtoPDF (accessible at https://convertheictopdf.com). This platform is an independent, free, web-based image conversion utility developed and operated by RT ("we", "us", or "our").

We built ConvertHEICtoPDF with an unwavering commitment to data privacy, computational transparency, and user autonomy. Unlike commercial file conversion portals that force users to transmit personal photos to remote cloud servers, our utility performs file transformations 100% locally on your own client hardware.

If you have questions, regulatory inquiries, or privacy concerns regarding this Privacy Policy or our operational practices, you may contact our designated data privacy controller directly at info@convertheictopdf.com.

2 Client-Side Browser Execution Architecture (Zero-Upload Guarantee)

Understanding how our technology operates is fundamental to understanding your privacy rights. When you use ConvertHEICtoPDF:

Because your files never touch our servers, our infrastructure never possesses, logs, caches, indexes, or retains any copy of your photos. You can even disconnect your internet connection entirely after loading the website, and file conversions will continue to execute seamlessly offline.

3 Types of Information We Do NOT Collect

To eliminate ambiguity, we explicitly state that we do NOT collect, harvest, store, or process any of the following categories of data:

• User Imagery & Documents: We do not inspect, view, store, or analyze your photos, graphics, receipts, or PDFs.
• EXIF & Metadata Harvesting: We do not extract or record sensitive metadata such as GPS coordinates, camera models, capture timestamps, lens settings, or facial recognition vectors.
• AI Training Datasets: Your files are never utilized, scraped, or contributed to machine learning, neural network, or generative AI training pipelines.
• User Accounts & Credentials: We do not offer or require account registration, usernames, passwords, phone numbers, or credit card information.
• Biometric Data: We do not perform facial analysis, gaze tracking, or biometric categorization of any kind.

4 Information Collected via Standard Web Infrastructure

Like virtually all websites delivered globally over Content Delivery Networks (CDNs), our web hosting infrastructure (e.g., Cloudflare, Vercel) automatically logs standard, non-personally identifiable diagnostic HTTP requests to ensure site availability, mitigate Distributed Denial of Service (DDoS) attacks, and maintain network reliability. These standard server access logs may include:

• Browser type and version (User-Agent string)
• Operating system family (e.g., Windows, macOS, iOS, Android, Linux)
• Referring website URL and exit pages
• Date, time, and duration of the web page request
• Internet Protocol (IP) address (frequently anonymized or aggregated by CDN edge servers)
• HTTP response status code (e.g., 200 OK, 404 Not Found)

These logs are utilized strictly for technical infrastructure administration, cybersecurity incident response, and performance monitoring. They are never joined with user identities, nor do they ever contain or reference file conversion contents.

6 Cookies, Analytics, and Local Client Storage

Cookies are small text files placed on your computer or mobile device by websites you visit. ConvertHEICtoPDF categorizes cookies and browser storage technologies into three distinct tiers:

7 European Union General Data Protection Regulation (GDPR) Compliance

For individuals residing within the European Economic Area (EEA), the United Kingdom (UK GDPR), and Switzerland, we process website navigation telemetry in compliance with Regulation (EU) 2016/679.

Legal Basis for Processing: We process minimal server diagnostic logs under Article 6(1)(f) (Legitimate Interests) to guarantee website stability, cyber defense, and content delivery. For non-essential cookies and targeted advertising, processing is executed under Article 6(1)(a) (Consent), which you may grant or revoke through browser privacy controls or consent management dialogues.

Your Statutory Rights Under GDPR:

• Right of Access (Article 15): You have the right to request confirmation regarding whether your personal data is processed.
• Right to Rectification (Article 16): You may request correction of inaccurate personal data.
• Right to Erasure / "Right to be Forgotten" (Article 17): You may request deletion of personal data where applicable. (Because we store zero file data, no user files ever exist to be erased).
• Right to Restriction of Processing (Article 18): You may request restriction of telemetry processing under statutory conditions.
• Right to Data Portability (Article 20): You may request receipt of provided data in a structured, machine-readable format.
• Right to Object (Article 21): You may object to data processing based on legitimate interests or direct marketing at any time.
• Right to Lodge a Complaint: You have the right to lodge a formal complaint with your national Data Protection Authority (DPA) regarding our privacy practices.

8 California Consumer Privacy Act (CCPA / CPRA) Notice

This section applies specifically to residents of the State of California under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (CPRA):

California consumers possess statutory rights to: (i) know what personal information has been collected, disclosed, or sold; (ii) request deletion of personal information; (iii) correct inaccurate information; and (iv) exercise these rights without experiencing discriminatory pricing or degraded service quality.

To submit a CCPA inquiry or exercise your privacy rights, please email us at info@convertheictopdf.com.

9 Children's Online Privacy Protection Act (COPPA)

Protecting the privacy of young children is especially critical. ConvertHEICtoPDF is a general audience utility tool and does not knowingly collect, harvest, or solicit any personal information from children under the age of 13 (or under 16 within applicable European jurisdictions).

Because all file processing takes place client-side without registration or identity verification, our servers hold zero records pertaining to any individual child. If a parent or guardian believes that personal information has inadvertently been provided to us, please notify us immediately at info@convertheictopdf.com, and we will take immediate steps to expunge any corresponding records from our server logs.

10 Data Security Architecture & Cryptographic Integrity

We adhere to the cybersecurity principle of "security by design and default." Our security measures include:

• Enforced HTTPS / TLS 1.3: All web communication between your browser and our edge delivery servers is encrypted using modern Transport Layer Security (TLS 1.3) with HSTS headers.
• Strict Content Security Policy (CSP): We implement protective security headers (`X-Content-Type-Options: nosniff`, `X-Frame-Options: SAMEORIGIN`, `Referrer-Policy: strict-origin-when-cross-origin`) to prevent cross-site scripting (XSS), clickjacking, and MIME confusion attacks.
• Zero Server-Side Storage Attack Surface: Traditional converters represent high-value targets for hackers because millions of user photos sit unencrypted on database volumes. By maintaining zero cloud storage repositories, we eliminate the risk of server-side data breaches, leaks, or unauthorized snooping.

11 External Hyperlinks & Non-Affiliation Disclaimers

Our platform contains hyperlinks pointing to external websites, software documentation, and standards organizations (such as Apple Inc., Adobe Inc., Google LLC, GitHub, and W3C). Once you follow an outbound link, you leave our domain and are governed by the privacy policies and operational terms of the third-party website. We assume no responsibility or liability for third-party privacy practices or external website content.

Apple, iPhone, macOS, iOS, HEIC, and HEIF are registered trademarks of Apple Inc. Adobe, Photoshop, and PSD are registered trademarks of Adobe Inc. ConvertHEICtoPDF is an independent utility and is not affiliated with, sponsored by, or endorsed by Apple Inc., Adobe Inc., Google LLC, or Microsoft Corporation.

12 Policy Updates & Official Contact Information

We reserve the right to revise or update this Privacy Policy periodically to reflect technological advancements, evolving legal requirements, or architectural changes. Any amendments become effective immediately upon being published on this page, accompanied by an updated "Effective Date" at the top of this document. We encourage users to review this page periodically to remain informed about how we protect user privacy.