Privacy Policy

eflowpdf is operated by [Company legal name], [registered address] (“we”, “us”). This policy covers the marketing site (eflowpdf.com), the publisher dashboard (app.eflowpdf.com), and the catalog reader, wherever it is opened: on a workspace’s own eflowpdf.com address (such as harvest-lane.eflowpdf.com), on a publisher’s custom domain, or embedded in another website.

We deal with two groups of people, and collect very different information from each:

• Publishers: our customers and their team members, who sign in to upload and publish catalogs.
• Readers: anyone who opens a published catalog. Readers never need an account.

Publishers see how their catalogs are read. We designed that measurement so that it does not identify you and does not follow you around. The reader sets no tracking cookies, includes no advertising or third-party tracking scripts, and keeps no identifier that links your visits from one day to the next or from one site to another.

What is recorded when you read a catalog

• That the catalog was opened, which pages you viewed and for how long (capped at 10 minutes per page).
• Which hotspots (clickable areas) you clicked, what you typed into the catalog’s search box, and whether you used share or download.
• The hostname of the page that linked to or embedded the catalog (for example, “example.com”), never the full address, and whether the catalog was embedded.
• Your device class (phone, tablet or desktop), worked out from your browser’s user-agent string.
• A random session ID that the reader creates when the catalog opens, so page turns in one visit can be grouped together. It is kept in your browser’s session storage, not in a cookie, and is gone when you close the tab.

The reader also stores two things in your browser that identify nobody: a flag in local storage once you have seen the “drag a page to flip” hint, so it is not shown again, and, only on catalogs protected with a password, a strictly necessary cookie after you enter the right password, so you are not asked again for 30 days.

How unique readers are counted without storing your IP address

To tell ten readers from one reader opening a catalog ten times, our server combines a random salt that changes every day with the publisher’s workspace ID, your IP address and your user-agent string, and runs them through a one-way hash (SHA-256). Only a shortened hash is stored. A new salt is created every day (UTC) and the old one is deleted within an hour after its day ends, so the hash cannot be turned back into an IP address and cannot be linked to your visits on any other day or to other publishers’ catalogs. Your IP address and user-agent string are never stored.

Approximate location

When an event arrives, we look up an approximate country and region (for example, “US, Ohio”) in an IP geolocation database that runs on our own servers. No request is sent to a third party, no city-level or precise location is kept, and the IP address is discarded as soon as the lookup is done. [If the DB-IP Lite database is used, add the attribution its CC BY 4.0 licence requires: “IP geolocation by DB-IP”.]

Links, videos and embedded content

Hotspots can link to the publisher’s shop or other websites, which have their own privacy policies. YouTube and Vimeo videos are only loaded when you open one, using YouTube’s privacy-enhanced mode (youtube-nocookie.com) and Vimeo’s “do not track” setting. Fonts and page images are served from our own servers [and our CDN provider].

Who is responsible for reader data

We collect reader analytics on behalf of the publisher whose catalog you are reading, and show it to them only as totals and breakdowns (for example, views per page or clicks per hotspot). For this data the publisher is the controller and we act as their processor, under our Data Processing Addendum. [Counsel: confirm this allocation.]

• Account details: your name, email address and password. Passwords are stored only as a salted scrypt hash. If you choose “Sign in with Google”, Google shares your name, email address and profile picture with us.
• Workspace details: workspace name and address, time zone, branding (logo and colors), custom domains, team members and their roles, and the email addresses of people you invite.
• Your content: the PDFs you upload, the page images we render from them, the text we extract so catalogs can be searched, hotspots, and any gallery images or videos you add.
• Security records: each sign-in session stores the IP address and browser user-agent of the device it was created on, so you can recognise your sessions and we can detect abuse. An audit log records security- and billing-relevant actions (such as publishing, member changes and plan changes): who did what, and when. IP addresses are also held for a short time (usually about a minute) to rate-limit sign-in attempts and other requests.

Cookies

The dashboard uses only strictly necessary cookies: a session cookie that keeps you signed in (for up to 30 days, renewed while you use it) and a short-lived copy of it that expires after a minute. There are no advertising or analytics cookies, and the marketing site sets no cookies at all.

Subscriptions are processed by Stripe. You enter your card details on Stripe’s secure checkout and billing pages; they never reach our servers. We keep your Stripe customer and subscription IDs, your plan, your billing status and the end of the current billing period, and Stripe tells us when a payment succeeds or fails.

Stripe’s handling of your information is described in the Stripe Privacy Policy.

• To provide the service: render and host your catalogs, serve them to readers, and show you analytics.
• To keep the service and your account secure, prevent abuse and enforce our Terms of Service.
• To bill you, and to send service emails: sign-in and password-reset links, invitations, processing notices and billing notices.
• To answer your support requests and to comply with legal obligations.

We do not sell personal information, share it for advertising, or use your catalogs’ content for anything other than providing the service to you. [Legal basis for each purpose under GDPR, e.g. contract, legitimate interests, legal obligation.]

We share information only with providers that help us run eflowpdf, and only what each one needs:

• [Hosting provider and region]: servers, database and file storage.
• [Email delivery provider]: sends service emails.
• [CDN provider, if any]: delivers page images and the reader quickly.
• Stripe: payments, if you subscribe.
• Google: only if you choose to sign in with Google.

[Link to a maintained sub-processor list and describe how customers are notified of changes.]

• Reader events are kept for up to 13 months and then deleted. Daily totals derived from them, which contain nothing about individual readers, are kept while the catalog exists so publishers can compare periods.
• Your content stays until you delete it; deleted catalogs are removed from storage.
• Account and workspace data is kept while your account is open. [Deletion timeline after an account is closed, backup retention period, and how long billing records are kept for tax purposes.]

Publishers can view and update their account details in the dashboard, delete catalogs at any time, and ask us for a copy of their data or for their account to be deleted. Depending on where you live, you may also have the right to access, correct, delete, restrict or object to the processing of your personal information, to data portability, and to complain to a data protection authority. [Jurisdiction-specific rights (GDPR, UK GDPR, CCPA/CPRA) and how to exercise them.]

Readers: because reader analytics are not linked to your identity and the daily hash cannot be traced back to you, we generally cannot find the events of one particular reader. Questions about a catalog should go to the business that published it.

All traffic is encrypted with TLS, passwords are hashed, and access to production systems is limited to people who need it. Each workspace’s data is kept separate from every other workspace’s. [Summary of security practices and incident notification commitments.]

[Where data is stored and processed, and the safeguards used for transfers outside the EEA/UK (for example, Standard Contractual Clauses).]

eflowpdf is a business service and is not directed at children. Publisher accounts are for people aged 18 or over. [Confirm the age threshold.]

If we change how we handle personal information, we will update this page and its date, and tell publishers by email or in the dashboard before material changes take effect.

Privacy questions and requests: [privacy contact email], [postal address]. For anything else, write to support@eflowpdf.com. [EU/UK representative and data protection officer, if required.]