Privacy Policy

1. Introduction

This Privacy Policy explains how Mostly Tiny Ltd ("we", "us", "our") collects, uses, shares and protects your personal data when you use mostlypdf.com, and the rights you have over that data. It applies to personal data for which we act as the controller. Effective date: 2026-06-30.

2. Who we are and how to contact us

Mostly Tiny Ltd is the controller responsible for your personal data. You can contact us about this policy, or to exercise your rights, at hello@mostlytiny.io.

Hackney Depot, 5 Sheep Lane, London E8 4QS, United Kingdom

3. EU/UK representative and Data Protection Officer

Where we are required to designate a representative in the EEA or UK because we are established outside it but offer services to, or monitor, people there, and where we are required to appoint a Data Protection Officer, their contact details are available on request at hello@mostlytiny.io.

4. Personal data we collect

We collect: information you provide directly (for example If you sign in: account email and optional display name. The PDF and document files you upload for processing and their converted outputs, used solely to perform the tool you selected. For paid features, a billing customer record per identity (card data is held by Stripe, not us). And request logs such as IP address and timestamps for security and rate-limiting.); information collected automatically when you use mostlypdf.com, such as your IP address, device and browser type, pages viewed, and cookie identifiers; and, where relevant, information we receive from third parties.

We collect personal data in the categories above for the purposes set out in this policy.

5. Where we get your data

Where we do not collect personal data directly from you, we obtain it from sources such as our service providers, analytics and advertising partners, publicly available sources, and other third parties you have authorised to share it.

6. How and why we use your data

We use your personal data to: provide, operate and improve mostlypdf.com and our services; create and manage your account; respond to enquiries and provide support; personalise your experience; send service and, where permitted, marketing messages; keep the service secure and prevent fraud; and comply with our legal obligations.

7. Our legal bases for processing

Where the EU or UK GDPR applies, we process your personal data on one or more lawful bases under Article 6: your consent; the performance of a contract with you; compliance with a legal obligation; protection of vital interests; the performance of a task in the public interest; or our legitimate interests (or those of a third party), except where overridden by your interests or rights.

Where we rely on legitimate interests, these include operating and securing our services, understanding how they are used, and limited marketing — you may object at any time. Where we process special categories of personal data under Article 9 (for example health or biometric data), we do so only with your explicit consent or another condition permitted by law.

8. Who we share your data with

We share personal data with: service providers and processors who operate mostlypdf.com on our behalf (for example Google Cloud Platform / Firebase (authentication, database, storage, hosting and functions; data hosted in the UK, europe-west2); Stripe (payments); Resend (transactional and sign-in emails); Cloudflare (edge and Turnstile bot-protection).), who may only use it on our instructions; professional advisers, payment providers, and law-enforcement or regulators where required; and parties to a corporate transaction such as a merger or acquisition. We do not sell your personal data for money.

9. Sale and sharing of personal information

The categories of personal information we have "sold" or "shared" (as defined under the CCPA/CPRA) in the preceding 12 months, and the categories of third parties to whom it was disclosed, are described in the California section below. If we share personal information for cross-context behavioural advertising, you can opt out as described there.

10. International data transfers

Some of our service providers are located outside your country, including outside the EEA, the UK or Australia. Where we transfer personal data internationally we rely on a lawful transfer mechanism — such as an adequacy decision, the EU Standard Contractual Clauses (with the UK International Data Transfer Addendum where relevant), or another safeguard permitted by law — and take steps to keep your data protected. Details are available on request at hello@mostlytiny.io.

11. How long we keep your data

We keep personal data only as long as necessary for the purposes described in this policy, after which we delete or anonymise it. The criteria we use to set retention periods include the nature and sensitivity of the data, the purpose of processing, and our legal, accounting and reporting obligations (Files you upload and their converted outputs are processed to perform your chosen tool and deleted shortly after processing. Account data (if you sign in) is kept while active and deleted when you delete it. Request logs are kept briefly for security. Billing records are retained by Stripe and by us as required by tax law (UK: generally six years).).

12. How we protect your data

We use appropriate technical and organisational measures — including encryption in transit, access controls and regular review — to protect personal data against loss, misuse and unauthorised access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

13. Cookies and similar technologies

We use cookies and similar technologies on mostlypdf.com. For the cookies we use, their purpose and duration, and how to control them, see our Cookie Policy.

14. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, including profiling, unless permitted by law. Where we ever do, we will tell you, explain the logic involved, and offer the right to obtain human review.

15. Children’s privacy

mostlypdf.com is not directed to children. We do not knowingly collect personal data from children below the age of digital consent that applies to them (16 under the GDPR, subject to lower national ages down to 13), and we do not knowingly sell or share the personal information of consumers we know to be under 16. If you believe a child has given us data, contact us at hello@mostlytiny.io and we will delete it.

16. Your rights under the GDPR

If the EU or UK GDPR applies to you, you have the right to: be informed; access your personal data; have inaccurate data rectified; have your data erased; restrict processing; data portability; and object to processing, including to direct marketing. Where processing is based on consent, you may withdraw it at any time without affecting processing carried out beforehand.

To exercise any of these rights, contact us at hello@mostlytiny.io. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, telling you within the first month. You also have the right to lodge a complaint with your data protection supervisory authority.

17. UK supervisory authority

If you are in the UK, the UK GDPR and the Data Protection Act 2018 apply, and you may complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

18. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to: know what personal information we collect, use, disclose and sell or share; delete personal information we hold about you; correct inaccurate personal information; opt out of the sale or sharing of your personal information; limit the use and disclosure of your sensitive personal information; and not be discriminated or retaliated against for exercising these rights.

To exercise the right to know, delete or correct, contact us at hello@mostlytiny.io or use any "Your Privacy Choices" link on mostlypdf.com; we will not require you to create an account to make a request, and you may use an authorised agent. To opt out of sale or sharing, use the "Do Not Sell or Share My Personal Information" link on mostlypdf.com or send a Global Privacy Control signal, which we honour.

19. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new effective date and, where changes are significant, take reasonable steps to notify you.

20. Contact us

For any privacy question, request or complaint about how we handle your personal data, contact Mostly Tiny Ltd at hello@mostlytiny.io.

Hackney Depot, 5 Sheep Lane, London E8 4QS, United Kingdom