Privacy Policy

1. Introduction

This Privacy Policy explains how Mostly Tiny Ltd ("we", "us", "our") collects, uses, shares and protects your personal data when you use mostlypdf.com, and the rights you have over that data. It applies to personal data for which we act as the controller. Effective date: 2026-09-22.

2. Who we are and how to contact us

Mostly Tiny Ltd is the controller responsible for your personal data. You can contact us about this policy, or to exercise your rights, at hello@mostlytiny.io.

Hackney Depot, 5 Sheep Lane, London E8 4QS, United Kingdom

3. EU/UK representative and Data Protection Officer

Where we are required to designate a representative in the EEA or UK because we are established outside it but offer services to, or monitor, people there, and where we are required to appoint a Data Protection Officer, their contact details are available on request at hello@mostlytiny.io.

4. Personal data we collect

We collect: information you provide directly (for example if you sign in, your email and optional display name; the files you upload and their converted outputs, used only to run the tool you chose; for paid features, a billing record (card data is held by Stripe); product usage; and, only with your consent, how you arrived); information collected automatically when you use mostlypdf.com, such as your IP address, device and browser type, pages viewed, and cookie identifiers; and, where relevant, information we receive from third parties.

We collect personal data in the categories above for the purposes set out in this policy.

5. Where we get your data

Where we do not collect personal data directly from you, we obtain it from sources such as our service providers, analytics and advertising partners, publicly available sources, and other third parties you have authorised to share it.

6. How and why we use your data

We use your personal data to: provide, operate and improve mostlypdf.com and our services; create and manage your account; respond to enquiries and provide support; personalise your experience; send service and, where permitted, marketing messages; keep the service secure and prevent fraud; and comply with our legal obligations.

7. The AI assistant

When you use the AI assistant, the text of the document you ask about and your question are sent to Anthropic, PBC, which provides the model and processes them on our behalf under its commercial terms, which do not permit training on them. Anthropic is in the United States; the transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Do not use the assistant on a document you are not allowed to share with a service provider.

8. How we learn where visitors come from

Fathom Analytics counts visits to mostlypdf.com without cookies and without identifying you, including which website, campaign or AI assistant referred a visit. In the UK we rely on the statistical-purposes exception in the Privacy and Electronic Communications Regulations. You can object at any time by switching off "Analytics" in Cookie settings, which turns Fathom off for your browser.

If you accept Analytics or Marketing cookies, our site also remembers in your browser how you first and most recently arrived (campaign tags, the referring site and the page you landed on) and attaches it to your account when you sign up, so we can see which channels bring us customers. If you do not accept, we keep none of this. The one exception is a referral code, if you followed a friend's referral link: we keep it only to credit that referral.

When you sign up, subscribe or cancel, our servers record that event against your account in PostHog (EU), to measure how our business is doing. We rely on our legitimate interests for this; you can object by emailing hi@mostlypdf.com.

9. Our legal bases for processing

Where the EU or UK GDPR applies, we process your personal data on one or more lawful bases under Article 6: your consent; the performance of a contract with you; compliance with a legal obligation; protection of vital interests; the performance of a task in the public interest; or our legitimate interests (or those of a third party), except where overridden by your interests or rights.

Where we rely on legitimate interests, these include operating and securing our services, understanding how they are used, and limited marketing — you may object at any time. Where we process special categories of personal data under Article 9 (for example health or biometric data), we do so only with your explicit consent or another condition permitted by law.

10. Who we share your data with

We share personal data with: service providers and processors who operate mostlypdf.com on our behalf (for example Google Cloud and Firebase (europe-west2): hosting, sign-in, database, file storage and processing; Cloudflare: edge security and Turnstile bot protection; Stripe: payments; Resend: email; Fathom Analytics: cookie-free statistics; PostHog (EU): product analytics; Anthropic: the AI assistant, which receives the text of the document you ask it about; and MostlyID (sign-in) and MostlyPrivacy (this banner and these documents)), who may only use it on our instructions; professional advisers, payment providers, and law-enforcement or regulators where required; and parties to a corporate transaction such as a merger or acquisition. We do not sell your personal data for money.

11. Advertising and measuring our adverts

We may advertise MostlyPDF on Google, on Microsoft Advertising (Bing, Microsoft Copilot and partner sites) and in ChatGPT. Only if you accept "Marketing" cookies do we load those platforms' tags and, when you arrive from one of our adverts, keep the click identifier the platform added to the link (gclid, gbraid or wbraid for Google; msclkid for Microsoft; oppref for ChatGPT).

If you then subscribe, we tell only the platform whose advert you clicked that it led to a purchase: the click identifier, the time, the value and currency, and — for matching — your email address as a one-way SHA-256 hash. We never send your raw email address, the QR codes you create or your scan data.

Our legal basis is your consent. You can withdraw it at any time in Cookie settings: we then delete the click identifier from your browser and report nothing further, including for a subscription that starts after you withdrew.

Google receives this data under the Google Ads Data Processing Terms (as our processor for enhanced conversions, and as an independent controller for its advertising services); Microsoft and OpenAI receive it as independent controllers. Their privacy notices: policies.google.com/privacy, privacy.microsoft.com/privacystatement and openai.com/policies/privacy-policy. All three are in the United States; transfers rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

12. International data transfers

Some of our service providers are located outside your country, including outside the EEA, the UK or Australia. Where we transfer personal data internationally we rely on a lawful transfer mechanism — such as an adequacy decision, the EU Standard Contractual Clauses (with the UK International Data Transfer Addendum where relevant), or another safeguard permitted by law — and take steps to keep your data protected. Details are available on request at hello@mostlytiny.io.

13. How long we keep your data

We keep personal data only as long as necessary for the purposes described in this policy, after which we delete or anonymise it. The criteria we use to set retention periods include the nature and sensitivity of the data, the purpose of processing, and our legal, accounting and reporting obligations (files you upload and their outputs are deleted shortly after processing; text sent to the AI assistant is not kept by us after the answer is returned; account data while your account is active; billing records as tax law requires; request logs briefly for security).

14. How we protect your data

We use appropriate technical and organisational measures — including encryption in transit, access controls and regular review — to protect personal data against loss, misuse and unauthorised access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

15. Cookies and similar technologies

We use cookies and similar technologies on mostlypdf.com. For the cookies we use, their purpose and duration, and how to control them, see our Cookie Policy.

16. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, including profiling, unless permitted by law. Where we ever do, we will tell you, explain the logic involved, and offer the right to obtain human review.

17. Children’s privacy

mostlypdf.com is not directed to children. We do not knowingly collect personal data from children below the age of digital consent that applies to them (16 under the GDPR, subject to lower national ages down to 13), and we do not knowingly sell or share the personal information of consumers we know to be under 16. If you believe a child has given us data, contact us at hello@mostlytiny.io and we will delete it.

18. Your rights under the GDPR

If the EU or UK GDPR applies to you, you have the right to: be informed; access your personal data; have inaccurate data rectified; have your data erased; restrict processing; data portability; and object to processing, including to direct marketing. Where processing is based on consent, you may withdraw it at any time without affecting processing carried out beforehand.

To exercise any of these rights, contact us at hello@mostlytiny.io. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, telling you within the first month. You also have the right to lodge a complaint with your data protection supervisory authority.

19. UK supervisory authority

If you are in the UK, the UK GDPR and the Data Protection Act 2018 apply, and you may complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

20. How to complain to us

If you are unhappy with how we have handled your personal data, email hi@mostlypdf.com with "Complaint" in the subject. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at any time.

21. If you are in the United States

We do not sell personal information. Measuring our adverts, described above, can count as "sharing" under some US state privacy laws; it happens only if you accept Marketing cookies, and we treat a Global Privacy Control signal from your browser as a refusal. To ask what we hold about you, or to have it corrected or deleted, email hi@mostlypdf.com.

22. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new effective date and, where changes are significant, take reasonable steps to notify you.

23. Contact us

For any privacy question, request or complaint about how we handle your personal data, contact Mostly Tiny Ltd at hello@mostlytiny.io.

Hackney Depot, 5 Sheep Lane, London E8 4QS, United Kingdom