1. Controller
The controller under the General Data Protection Regulation (GDPR) is Alexander Schönwald, Germany. Email: info@localproof.site.
2. Local PDF processing
PDF files, page images, search terms, redactions, highlights and watermarks are processed only in the temporary memory of your browser. localproof has no upload endpoint for documents and does not transmit document content to the website operator or Google.
Refreshing or closing the tab clears the active document. The PWA service worker caches only the application shell for offline use, never your PDF files.
3. Hosting and server logs
When the website is requested, the hosting provider necessarily processes connection data such as IP address, time, requested resource, referrer, user agent and response status to deliver and secure the website. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is reliable and secure operation.
The hosting provider, server location and concrete deletion period must be added here before the public launch once hosting has been selected.
4. Essential local storage and PWA cache
We store your consent choice under “localproof_consent_v1” in local storage. It contains the consent version, whether analytics was accepted and the decision time. This is necessary to remember and prove your choice. The legal bases are Art. 6(1)(c) and (f) GDPR and Section 25(2) TDDDG.
The service worker may store static app files on your device so localproof can work offline. You can remove both in your browser’s site-data settings. No PDF content is stored there.
5. Contact by email
If you contact us, we process your email address, message and any information you provide to answer your request. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual matters, otherwise Art. 6(1)(f) GDPR. We delete correspondence when the matter is complete unless statutory retention duties apply.
6. Google Analytics — consent required
Google Analytics 4 is integrated under measurement ID G-2JKB3ZGBB1. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The tag uses basic consent mode and is neither loaded nor allowed to send requests to Google before you actively accept analytics.
With consent, Google Analytics may process online identifiers, browser and device details, visited pages, interactions, approximate location and truncated technical connection information. Typical cookies are “_ga” and “_ga_<container-id>”, with a configured maximum lifetime of up to two years. The legal bases are your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
The implementation disables Google Signals, advertising personalisation and User-ID, and does not renew the Analytics cookie expiry when activity continues. The Google Analytics property should retain event and user data for two months with reset on new activity disabled.
Google may process data in the United States. Google states that it is certified under the EU–US Data Privacy Framework and also uses standard contractual clauses where applicable. You can withdraw consent at any time through “Cookie settings”. Withdrawal affects future processing and does not alter the lawfulness of earlier processing.
7. Consent management
Analytics is off by default. Accepting and rejecting are equally available; necessary storage cannot be disabled because it records your selection. You may change your decision at any time using the persistent cookie-settings button. Refusing analytics has no effect on the PDF editor.
8. Recipients, transfers and retention
Apart from the hosting provider and, only after consent and activation, Google Analytics, we do not disclose website data unless legally required. Retention depends on the purposes described above. We delete or anonymise data when the purpose ends and no legal duty requires longer storage.
9. Your rights
Subject to the legal requirements, you have rights of access, rectification, erasure, restriction, data portability and objection (Arts. 15–21 GDPR). You may withdraw consent at any time with future effect (Art. 7(3) GDPR) and lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Contact: info@localproof.site.
10. No automated decisions and updates
We do not use automated decision-making or profiling. We apply appropriate technical and organisational safeguards and update this policy when the service, providers or legal requirements change.