POLITIQUE DE CONFIDENTIALITÉ

1. Data Controller (Responsable del Tratamiento — GDPR Art. 13 & LSSI-CE Art. 10)

The data controller responsible for operating kaijuconverter.com is Pablo Cirre Gómez, with registered professional address at Calle Trajano nº 8, Local B, 18002 Granada, España (Spain). You can reach the Data Controller directly via email at hello@kaijuconverter.com, via our Support & Privacy Contact Form, or through centraldecomunicacion.es.

2. What Data We Process & How Files Are Handled

We adhere strictly to the principle of data minimization (GDPR Art. 5(1)(c)):

• Client-Side In-Browser Conversions (Zero Server Upload): Eligible image and text conversions executed via HTML5 Canvas / WebAssembly run 100% locally inside your web browser. Your files never leave your device (`0 bytes` transmitted to our servers).
• Server-Side Isolated Conversions: When a conversion requires server-side processing (such as LibreOffice, FFmpeg, ImageMagick, Ghostscript, QPDF, Tesseract OCR, Pandoc, Calibre, or 7-Zip), the uploaded source file is stored in a non-public directory (`storage/app/private/uploads`) and automatically deleted within 30 minutes. The converted output file (`storage/app/private/outputs`) is automatically deleted within 60 minutes for guest users or 24 hours for registered users.
• 1-Click Immediate File Shredding: Immediately after converting a file, you can click the "Delete file from server now" button in the conversion widget (`DELETE /convert/{jobId}`), which permanently unlinks both the source upload and the converted output from our disk in real time (0-second retention).
• IP Addresses & Security Logs: Processed temporarily for rate limiting (`throttle`), DDoS protection, and abuse prevention under legitimate interest (GDPR Art. 6(1)(f)).
• Account & Authentication Data: If you sign in via Google OAuth or create an account, we store your name, email address, and plan quota status.
• Payment & Billing Data (Stripe): When you purchase a 24-Hour Day Pass (€1.99 one-time) or a subscription (Starter €3/month, Pro €9/month, Business €12/month, API €29/month), payment is processed directly by Stripe Payments Europe, Limited (PCI-DSS Level 1 certified). KaijuConverter never sees, processes, or stores your credit/debit card numbers; we only store the Stripe customer ID, subscription status, and plan tier required to provision your quota.

3. Advertising, Google AdSense & Google Consent Mode v2 Disclosures

To keep our core file conversion tools free for everyone, we display advertisements served by Google AdSense (`ca-pub-5070758158276189`) on informational and free-tier pages. Paid subscribers and active 24h Day Pass users enjoy an ad-free experience. In compliance with Google's EU User Consent Policy and GDPR, we disclose that:

• Third-party vendors, including Google (`Google Ireland Limited`), use cookies (such as DoubleClick / DART cookies, `__gads`, `__gpi`, and `IDE`) to serve ads based on a user's prior visits to kaijuconverter.com or other websites on the Internet.
• Google's use of advertising cookies enables Google and its partners to serve ads to our users based on their visit to our site and/or other sites on the Internet.
• Default Denial via Google Consent Mode v2: On your first visit, all advertising and analytics storage signals (`ad_storage`, `ad_user_data`, `ad_personalization`, and `analytics_storage`) are set to `denied` by default. Personalized advertising cookies are only activated if you explicitly click "Accept" on our cookie banner.
• How to Opt Out of Personalized Ads: Users may opt out of personalized advertising at any time by visiting Google Ads Settings (adssettings.google.com), by visiting www.aboutads.info/choices/, or by clicking "Cookie Preferences" in our website footer to reject non-essential cookies.
• For complete details on how Google processes data, please review Google's official disclosure: How Google uses information from sites or apps that use our services.

4. Analytics: Google Analytics 4 & Microsoft Clarity

Only when you grant explicit consent (`cookie_consent = accepted`), we use:

• Google Analytics 4 (`G-LM6KNL63MH`): Collects anonymized traffic and conversion funnel metrics (`_ga`, `_ga_*` cookies, 2-year retention). If you reject cookies, `analytics_storage` remains `denied`.
• Microsoft Clarity (`w89963ef0i` — Microsoft Ireland Operations Limited): Helps us detect broken UI flows and layout shifts through aggregated heatmaps and session telemetry (`_clck`, `_clsk` cookies). Microsoft Clarity scripts are strictly blocked from loading unless you have accepted cookies, and are immediately disabled if you withdraw consent. See Microsoft's Privacy Statement.

For a complete list of cookies, durations, and purposes, please consult our Cookie Policy.

5. Subprocessors & Third-Party Service Providers (GDPR Art. 28)

We do not sell, rent, or trade your personal data. We engage only the following vetted subprocessors under GDPR Data Processing Agreements (DPAs) and Standard Contractual Clauses (SCCs):

6. Data Retention Schedule (GDPR Art. 5(1)(e))

• Source uploaded files (`uploads/`): Permanently unlinked from disk within 30 minutes of upload (or immediately upon manual deletion).
• Converted output files (`outputs/`): Permanently unlinked from disk within 60 minutes for guest users, 24 hours for registered users, or immediately (0 seconds) when you click "Delete file from server now".
• Temporary scratch directories (`processing/` & `tmp/`): Destroyed immediately upon job completion and swept by our automated forensic cron every 5 minutes.
• Account & billing records: Retained while your account is active and for the legally mandated tax/accounting period under Spanish law (Law 58/2003).

7. Your Rights Under GDPR (Arts. 15–22) & LOPDGDD

Under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), you have the right to:

• Right of Access (Art. 15): Obtain confirmation and a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data.
• Right to Erasure / "Right to be Forgotten" (Art. 17): Delete your converted files immediately via the UI button or request full account erasure.
• Right to Restriction & Objection (Arts. 18 & 21): Restrict or object to processing based on legitimate interests.
• Right to Data Portability (Art. 20): Receive your account data in a structured, machine-readable format (JSON/CSV).
• Right to Withdraw Consent (Art. 7(3)): Withdraw cookie consent at any time with a single click via the "Cookie Preferences" button in the footer, without affecting the lawfulness of prior processing.

To exercise any of these rights, email hello@kaijuconverter.com or use our Contact Page. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) at www.aepd.es (C/ Jorge Juan, 6, 28001 Madrid, Spain).