Tagafolio privacy policy
Last updated: 3 November 2026
1. Who we are
Tagafolio (tagafolio.com) is provided by CODE FACTORY, SL, with tax ID ESB61788733, registered office at Carrer de la Rutlla, 56 Local A, 08221 Terrassa (Barcelona), Spain ("we", "us"). We are the data controller for the personal data described in this policy.
Contact for anything about privacy: info@tagafolio.com.
2. The short version
- Your documents never leave your device. Tagafolio checks and fixes PDFs inside your web browser. We never receive your documents, their text, their images or their file names. This is enforced by the website's security policy, which stops the page from sending documents anywhere, and you can verify it in your browser's developer tools.
- Checking needs no account and we collect nothing about the files you check.
- If you create an account or buy a plan, we keep only what is needed for that: your email address, your sign-ins and your plans.
- No advertising, no tracking, no third-party analytics. We only count anonymous events (visits, checks, fixes, downloads, reports) per day, with no cookies or identifiers (see 3.6). We do not sell or share personal data for marketing.
3. What we process, why, and on what legal basis
3.1 Using the free checker (no account)
The PDF you choose is read by software running in your own browser. Nothing about it is sent to us. Your browser stores two preferences on your own device: the page language and the light/dark theme. They never leave your device.
When you visit the website, our hosting provider's web server records technical data in its logs: your IP address, date and time, the page or file requested, and your browser type. These logs never contain document data. Legal basis: our legitimate interest in operating and securing the website (GDPR art. 6(1)(f)). Retention: 7 days; logs are anonymised.
3.2 Your account
To use paid features you sign in with your email address. There is no password: we email you a 6-digit code (and a sign-in link).
| Data | Why | Kept for |
|---|---|---|
| Email address | To identify your account and send sign-in codes | Until you delete your account |
| Page language when you signed up | To email you in your language | Until you delete your account |
| Sign-in code and link | To sign you in. Stored only as an irreversible hash | 15 minutes, or until used |
| Session | To keep you signed in. Your browser holds a random token in a cookie; we store only its hash | 30 days from your last visit, or until you sign out |
| Date your account was created and of your last sign-in | Security and support | Until you delete your account |
| Rate-limit counters | To block repeated sign-in attempts. Stored as a keyed hash of your email address or IP address, so neither is stored in readable form | 1 hour |
Legal basis: performing our contract with you (GDPR art. 6(1)(b)); for rate limiting, our legitimate interest in protecting accounts (art. 6(1)(f)).
Sign-in emails are sent through our hosting provider's email service.
3.3 Plans and payments
Payments are handled by Paddle (Paddle.com Market Limited), our reseller and merchant of record: Paddle sells the plans to you, takes the payment, issues the invoice and handles taxes. Paddle processes your payment details, name and billing address as an independent controller under its own privacy policy (paddle.com/legal/privacy). We never see your card details.
From Paddle we receive and keep:
| Data | Why |
|---|---|
| Paddle's customer number for you | To link your Tagafolio account to your purchases and open Paddle's customer portal for you |
| For each purchase: plan, date, Paddle's transaction or subscription number, status and end date | To give you access to what you bought, and to handle renewals, cancellations and refunds |
| For a One shot purchase: downloads left and the date it expires | To apply its limits (3 downloads of one document within 30 days) |
Legal basis: performing our contract with you (art. 6(1)(b)). Kept for: until you delete your account. Paddle keeps its own records, including invoices, as required by tax law.
3.4 The document fingerprint
A One shot purchase covers one document, including edited and re-exported versions of it. To recognise the same document, Tagafolio computes a fingerprint in your browser when you are signed in and check or download a file: 100 numbers calculated from short sequences of words in the document's text, plus its page count. When you check a file, the fingerprint is sent to our server only to compare it with your purchases (to show whether the document is already paid for) and is not stored. It is not the text and the text cannot be recovered from it. Someone who already had a candidate text could, in theory, test whether it matches the fingerprint.
We store the fingerprint with your One shot purchase from its first download, and compare fingerprints of later downloads with it. Legal basis: performing our contract (art. 6(1)(b)). Kept for: as long as the purchase record, until you delete your account.
3.5 Emails you send us
If you write to us, we use your message and email address to answer. Legal basis: our legitimate interest in answering (art. 6(1)(f)), or taking steps for a contract (art. 6(1)(b)). Kept for: as long as needed to handle your request, and no longer than 1 year.
3.6 Anonymous usage counts
To know how Tagafolio is used, the page tells our server when one of these happens: a visit (the page loads), a check, a click on "Fix file", a click on "Get fixed file", a check report or a fix report. The message contains only the name of the event: no cookie, no identifier and nothing about your document. We keep one counter per day for each event (for example, "4 November: 37 checks") and never record individual events. To stop one source from inflating the counts, the server briefly uses a keyed hash of the sender's IP address, deleted within an hour (as for sign-in attempts in 3.2). These counts are not personal data. Legal basis, for the brief use of the hashed IP address: our legitimate interest in understanding and protecting our service (art. 6(1)(f)).
4. Cookies and local storage
We use only what is strictly necessary, so no consent banner is needed:
| Name | Type | Purpose | Duration |
|---|---|---|---|
tagafolio_session | Cookie (only if you sign in) | Keeps you signed in. Not readable by scripts, sent only over secure connections, not sent to other sites | 30 days |
tagafolio.theme, pdfua.lang | Local storage in your browser | Your theme and language choice. Never sent to us | Until you clear your browser data |
We use no advertising, analytics or third-party cookies. The payment page (checkout.html) loads Paddle's payment form, which sets Paddle's own cookies: see Paddle's privacy policy.
5. Who receives personal data
- IONOS SE (Germany): hosts the website, the database and the email service, as our processor under a data processing agreement.
- Paddle.com Market Limited (United Kingdom): payments, invoices and taxes, as an independent controller (see 3.3).
We do not sell personal data or share it with anyone else, except where the law requires it.
Transfers outside the EU: Paddle is in the United Kingdom, which the European Commission recognises as providing adequate protection (adequacy decision). IONOS processes data in the EU.
6. Your rights
You can, at any time:
- Access and take your data: "Account → Download my data" gives you everything we hold about your account, as a JSON file.
- Delete your account: "Account → Delete my account" removes your account, sign-ins and plan records from our database at once. Paddle keeps its own records of your purchases, as tax law requires.
- Correct your data, restrict or object to processing, or ask us anything about it: write to info@tagafolio.com.
If you think we have not respected your rights, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or the authority in your country.
7. Security
Documents are never sent to us. Our website enforces this with a Content-Security-Policy that your browser applies. Sign-in codes, sign-in links and session tokens are stored only as hashes. Connections are encrypted (HTTPS). Access to our servers and database is restricted to us.
8. Children
Tagafolio is not intended for children under 14, and we do not knowingly create accounts for them.
9. Changes
If we change this policy, we will publish the new version here with its date. If a change affects how we use your data in a significant way, we will tell account holders by email before it applies.