Last updated: September 10, 2026
PDFHaul ("Service") is operated by Bultech ("we", "us", "our"). We are committed to protecting your privacy and handling your information with transparency and care. This Privacy Policy explains how we collect, use, and protect your information when you use our PDF processing tools, including our website and mobile app (iOS and Android). By using PDFHaul, you agree to the practices described in this policy.
PDFHaul operates from Canada and follows the Personal Information Protection and Electronic Documents Act (PIPEDA). We also align with GDPR and CCPA/CPRA principles.
When you create an account, we collect your email address, name (optional or provided via Google OAuth), a hashed and salted password, authentication identifiers such as your Google OAuth ID, and your account preferences and settings.
When you upload files to PDFHaul, those files are stored temporarily for processing and automatically deleted within approximately two hours from active systems. Our cloud provider may retain low-level storage remnants for up to approximately 24 hours as part of normal infrastructure operation. We do not manually view or inspect file contents, and we do not store filenames or file contents in logs.
PDFHaul is not intended for sensitive or regulated documents such as medical records, legal filings, financial statements, or government IDs. Use at your own discretion.
We collect technical information to operate and improve the Service. This includes your IP address (used for security and service analytics), browser type, device type and OS details, device model and mobile OS version, pages visited and features used, processing metadata such as operation type, file size, and duration, and error logs and diagnostic information.
When you use a tool or run a workflow while signed in, we record a summary of that activity in your account: the tool or workflow used, the number of files processed, and the timestamp. This history is visible to you on your dashboard and is retained for 90 days, after which it is automatically deleted. No filenames, file contents, or personal data beyond your account ID are stored in activity history.
We maintain logs for operational and security purposes, including authentication logs, security event logs (such as failed logins and rate-limit triggers), operational logs that record processing history without file contents, and error logs. Operational and error logs are retained for 30 days; security logs are retained for 90 days. Logs never contain file contents or filenames.
Our website uses three categories of cookies. Essential cookies handle session management and authentication and are required for the Service to function. Analytics cookies, set by Google Analytics 4, measure usage patterns, page views, and feature adoption; these persist for up to two years. Advertising cookies are set by Google AdSense (which displays ads on our website), Google Ads (which measures conversion events such as sign-ups driven by paid campaigns), and Microsoft Advertising (which measures conversion events for users who arrive via Microsoft/Bing ad campaigns); all use pseudonymized identifiers and do not involve your file contents.
For visitors in the European Economic Area (EEA) and United Kingdom, we use Google's Consent Management Platform (CMP) to obtain and record your consent before non-essential cookies are set. You can review or withdraw your consent at any time by clicking "Manage cookies" in the footer of our website.
Disabling essential cookies may limit functionality. Analytics and advertising cookies can be declined via our cookie notice or your browser settings.
The mobile app does not use browser cookies. Instead, authentication tokens are stored in your device's encrypted secure storage (iOS Keychain or Android Keystore) and are never shared with third parties.
The PDFHaul mobile app may request access to your camera and photo library. Camera access is used to scan documents and capture photos for conversion to PDF; images are processed locally and uploaded only when you initiate a conversion. Photo library access is used to select images you explicitly choose for conversion to PDF.
You can revoke either permission at any time in your device settings. Revoking a permission disables the corresponding feature but does not affect other app functionality.
You may optionally connect your Google Drive account to import PDF files directly into PDFHaul and export processed results back to your Drive. This connection is separate from signing in with Google and entirely optional.
When you connect Google Drive, we request OAuth access using two scopes: read-only access to Drive files you select for import, and permission to create new files in your Drive for export. We do not access any Drive content beyond the specific files you explicitly select through the Google file picker.
Google Drive access is governed by Google's Privacy Policy.
You may optionally connect your Dropbox account to import PDF files directly into PDFHaul and export processed results back to your Dropbox. This connection is entirely optional and separate from your PDFHaul account.
When you connect Dropbox, we request OAuth access using the following permissions: read access to file and folder metadata (to display your folder structure), read access to file contents (to download files you select for import), and write access to file contents (to upload processed files on export). We do not access any Dropbox content beyond the specific files and folders you explicitly interact with.
Dropbox access is governed by Dropbox's Privacy Policy.
You may optionally connect your Microsoft OneDrive account to import PDF files directly into PDFHaul and export processed results back to your OneDrive. This connection is entirely optional and separate from your PDFHaul account.
When you connect OneDrive, we request OAuth access to read files you select for import and to write processed files on export. We do not access any OneDrive content beyond the specific files and folders you explicitly interact with.
OneDrive access is governed by Microsoft's Privacy Statement.
We use the following third-party tools across our web and mobile platforms:
All third-party tools operate under their own data processing terms. We do not share file contents or filenames with any of these services.
PDFHaul offers a Model Context Protocol (MCP) server that allows AI assistants and MCP-compatible clients to interact with your PDFHaul account programmatically. Access is controlled via API keys you generate from your developer settings. This section describes how data is handled when you use these features.
API Keys
When you create an API key, we store a bcrypt hash of the key and a short non-secret prefix used for lookup. The full raw key is displayed to you only once at creation and is never stored in plaintext. We record the timestamp of each API key's last use. You can revoke API keys at any time from your developer settings, which immediately invalidates them.
Audit Logs
Every tool call made through the MCP server is recorded in an audit log. Each entry contains: the name of the tool called, your API key ID (an opaque identifier), your user ID, the duration of the operation in milliseconds, and whether it succeeded or failed. Audit logs never contain filenames, file contents, or any personal data beyond your account ID. Audit logs are retained for 90 days and then automatically deleted.
Rate Limiting
We apply per-key rate limits to protect service availability. Rate limit counters are held in memory only and are not persisted to disk or database. They reset automatically on a rolling hourly window.
Third-party AI Clients
When you connect PDFHaul to an AI assistant (such as Claude) via the MCP server, your PDF operations are initiated by that third-party client on your behalf. PDFHaul processes only the specific tool calls it receives and does not receive, store, or have access to the content of your conversations with the AI assistant. Your use of the AI client is governed by that provider's privacy policy.
The PDFHaul browser extension for Chrome and Edge provides the same PDF tools available on our website without requiring you to leave your current tab. This section describes how the extension differs from the website in how it handles sign-in and data storage.
Sign-in. The extension uses Chrome's built-in account chooser (rather than the website's sign-in page) to sign in with the Google account currently signed into your browser profile, using the openid, email, and profile scopes. This is a different technical mechanism than the website's sign-in flow, but it authenticates the same PDFHaul account described in Section 2.1 and does not create a separate account.
Local storage. The extension stores your session token, and, if you sign in, your account's access and refresh tokens, in Chrome's local extension storage on your device. This storage is isolated from webpages and other extensions, but unlike our mobile app's encrypted Keychain or Keystore storage, it is not encrypted at rest. Stored tokens are removed when you sign out.
Permissions. The extension requests broad host access so it can detect when you navigate to a PDF file and offer to open it in the extension's own viewer instead of your browser's default viewer, and so it can save processed files to your Downloads folder. We do not collect, log, or transmit your general browsing history. The extension only acts on a URL when you view or process it as a PDF through the extension.
Files you process through the extension follow the same collection, deletion, and retention practices described elsewhere in this policy.
We use the information we collect to provide and maintain the Service, authenticate and secure user accounts, process your files and deliver results, authenticate and authorize MCP server requests, maintain audit logs of MCP tool calls for security and debugging, enforce rate limits to protect service availability, prevent fraud, abuse, and security incidents, improve performance and develop new features, send service-related notifications, send marketing communications to users who have consented (you may opt out at any time via the unsubscribe link in any email or through your account settings), serve and measure advertising in the mobile app, and comply with legal requirements.
We do not sell or rent your personal information. We may share data with our cloud provider for hosting, processing, and storage; Resend, Inc. for transactional and marketing email delivery; payment processors (we never store card data); Google LLC for Drive integration, Analytics, Ads, AdSense, and AdMob under their respective data processing terms; Dropbox, Inc. for Dropbox integration under their data processing terms; Sentry for anonymized diagnostic data; and authorities where required by law.
In all cases, we do not share file contents or filenames with any third party.
We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest through our cloud provider, password hashing with salts, isolated and sandboxed processing environments, strict access control for administrative systems, automated file deletion within approximately two hours, and encrypted on-device token storage via iOS Keychain and Android Keystore.
Uploaded files are deleted within approximately two hours. Cloud provider residual storage may persist for up to approximately 24 hours but is not accessible to us. Activity history (tool and workflow usage summaries) is retained for 90 days and then automatically deleted. MCP and developer API audit logs are retained for 90 days and then automatically deleted. Account data is retained until you request deletion. System logs are retained for 30 to 90 days depending on type. Rate limit counters are held in memory only and are not persisted.
You may request to access your personal data, correct or update your information, delete your account and associated data, download your data in a portable format, withdraw consent for non-essential data collection, and opt out of personalized advertising through your device settings.
To exercise any of these rights, contact us at [email protected].
We may update this Privacy Policy periodically. If changes are significant, we will notify you via email or a notice on our website or app. Your continued use of the Service after an update indicates acceptance of the revised terms.