A conversion service needs remarkably little about you. Here is the whole list:
The files you hand over for conversion, compression or text extraction, held only while the job runs.
Account details if you create one: an email address, a hashed password and which plan you are on.
A subscription reference and status from our payment provider. Card numbers are handled by them and never reach our servers.
Technical signals sent by your browser: user agent, operating system, viewport size and the page that referred you.
Your IP address, used for rate limiting, abuse prevention and country-level statistics.
Cookies and local storage entries covering your theme choice and your session.
Whatever you type into the contact form: name, email address and message.
Some tools collect nothing at all. The unit converter does its arithmetic in the page itself, and the image editor previews your adjustments locally, so neither sends anything to us.
02
Why we use it
Each piece of data above exists for one of five reasons, and no others:
To run the job you asked for and give you the result back.
To bill the plan you chose and keep your access in the right state.
To keep the queue healthy: spotting abuse, blocking floods and enforcing limits.
To understand which tools people actually use, in aggregate, so we know where to spend effort.
To answer you when you write in.
We do not build advertising profiles from your activity, we do not sell or rent personal data, and nothing you upload is used to train a model.
03
How a file is handled
This is the part most people came here for, so it is written plainly. The same rules apply to every tool: converters, compressors and OCR alike.
While the job runs
Your upload travels over an encrypted HTTPS connection into temporary storage that only the worker running your job can reach. It exists there for the length of the conversion and nothing else reads it.
Once it finishes
The source file is deleted the moment the job completes. The output stays available for you to download and is then purged within one hour, collected or not. There is no archive, no backup copy and no second location.
What we never do
We do not open your files to look at them, index their contents, extract metadata for our own use or pass them to anyone else. Automated processing is the only thing that touches them.
04
How long anything survives
Retention is deliberately short. Where we can delete something, we do:
Uploaded source files: removed as soon as processing ends.
Output files: purged within one hour of being produced.
Server logs holding IP and user agent: kept up to 30 days for security work, then deleted.
Account and billing records: kept while the account is open, and afterwards only as long as tax and accounting law requires.
Contact form messages: kept until your question is resolved, then cleared.
Analytics: aggregated and anonymised, with nothing that identifies an individual.
05
Cookies and local storage
Two kinds of small data live in your browser while you use BigZet.
Necessary
These keep the site working: the light or dark theme you picked, your session, and the state of a job you have in flight. They carry no advertising identifier and cannot be switched off without breaking the tools.
Measurement
Google Analytics records which pages get used, how long a visit lasts and roughly where in the world it came from, at country or city level. It tells us which converters earn their place. You can opt out with the Google Analytics opt-out browser add-on, or by blocking the script in your browser.
Your browser settings can clear or block any of this at any time. Clearing the necessary entries simply resets your theme and your session.
06
Importing from your own cloud storage
Instead of uploading from disk, you can pick a file out of a cloud account you already control.
Google Drive
We ask for the narrowest access that makes a file picker work, and you select the files yourself inside the Google picker. Only the files you choose are transferred to us. We never browse or scan the rest of your Drive. The access token stays in the active browser session and is never written to our servers. An imported file is deleted on the same schedule as any upload. You can withdraw our access at any time at myaccount.google.com/permissions.
Dropbox
The Dropbox chooser works the same way. Only the files you explicitly select come across, your Dropbox credentials never touch our servers, and the imported file is processed and deleted exactly like a local upload.
Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
07
Companies involved in running BigZet
We keep the list of outside services short, because every addition is another place your data could sit. Each runs under its own privacy policy:
Google Analytics, for aggregate traffic measurement. policies.google.com/privacy
Google Drive API, only when you choose to import a file. policies.google.com/privacy
Dropbox API, only when you choose to import a file. dropbox.com/privacy
Web3Forms, which delivers contact form messages to our inbox. web3forms.com/privacy
Our payment provider, which processes card details and subscription renewals on its own systems.
None of these ever receives a file you uploaded for conversion.
08
Your rights over your data
Depending on where you live, you can exercise some or all of the following:
Access: ask for a copy of the personal data we hold about you.
Rectification: have anything inaccurate corrected.
Erasure: have your data deleted from our systems.
Restriction: ask us to stop a particular use while a question is open.
Objection: object to a specific kind of processing.
Portability: receive your data in a structured, machine-readable file.
Because the entry tier needs no account and retention is measured in minutes, most of these are already satisfied by design. Write to us to use any of them, and to complain to your national data protection authority if our answer does not satisfy you.
09
Where processing happens
BigZet is reachable worldwide and your job may run on a server in a country other than your own. Using the service means accepting that transfer.
We work to the standard set by the General Data Protection Regulation for visitors in the European Economic Area and the United Kingdom, and to the California Consumer Privacy Act for residents of California. Where a transfer leaves those areas, it relies on the safeguards those regimes require.
10
Children
BigZet is built for general and professional use and is not aimed at children under 13, or under 16 in the European Economic Area. We do not knowingly collect personal data from them.
If you believe a child has sent us personal data, tell us and we will delete it without asking for anything further.
11
Changes to this policy
This policy is revised when our practices, providers or legal obligations change. The revision date at the top of the page moves whenever that happens.
Where a change materially affects what we collect or how long we keep it, we say so on the site rather than quietly editing the text.
12
Questions and complaints
Privacy questions reach a person, not a queue. Use the contact page and tell us what you need: an explanation, a copy of your data, or its deletion.
We aim to answer within two working days, and inside one month for a formal data request.
Read next
The engineering behind these promises, the agreement they sit inside, and a way to reach us.