Privacy Policy

1. Introduction

This Privacy Policy explains how Mostly Tiny Ltd ("we", "us", "our") collects, uses, shares and protects your personal data when you use mostlypdf.com, and the rights you have over that data. It applies to personal data for which we act as the controller. Effective date: 2026-10-06.

2. Who we are and how to contact us

Mostly Tiny Ltd is the controller responsible for your personal data. You can contact us about this policy, or to exercise your rights, at privacy@mostlytiny.io.

Studio M, Hackney Depot, 5 Sheep Lane, London E8 4QS, United Kingdom

3. Our representative in the European Union

Mostly Tiny Ltd is established in the United Kingdom. We are appointing a representative in the European Union under Article 27 of the EU GDPR and will name them here. Until then, people in the EU can contact us directly at privacy@mostlytiny.io.

4. Personal data we collect

We collect: information you provide directly (for example if you sign in, your email and optional display name; the files you upload and their converted outputs, used only to run the tool you chose; for paid features, a billing record (card data is held by Stripe) and a record of AI and API usage charged to your wallet; product usage; and, only with your consent, how you arrived); information collected automatically when you use mostlypdf.com, such as your IP address, device and browser type, pages viewed, and cookie identifiers; and, where relevant, information we receive from third parties.

We collect personal data in the categories above for the purposes set out in this policy.

5. Where we get your data

Besides what you give us, we receive your sign-in identity and plan from Mostly Tiny ID and payment status from Stripe. We have no advertising partners.

6. How and why we use your data

We use your personal data to: provide, operate and improve mostlypdf.com and our services; create and manage your account; respond to enquiries and provide support; personalise your experience; send service and, where permitted, marketing messages; keep the service secure and prevent fraud; and comply with our legal obligations.

7. The AI assistant

When you use the AI assistant, the text of the document you ask about and your question are sent to Anthropic, PBC, which provides the model and processes them on our behalf under its commercial terms, which do not permit training on them. Anthropic deletes them from its systems within 30 days, unless the law requires it to keep them longer or it needs them to enforce its usage policies. Anthropic is in the United States; the transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Do not use the assistant on a document you are not allowed to share with a service provider.

8. Tools that process files on our servers

Many tools run entirely in your browser, and your file never leaves your device. Others — and any tool your browser cannot run — upload the file to our servers in London to process it. Turning HTML, Markdown, an email or a web page into a PDF is done by MostlyRender, our own rendering service, on our behalf.

9. How we learn where visitors come from

Fathom Analytics counts visits to mostlypdf.com without cookies and without identifying you, including which website, campaign or AI assistant referred a visit. In the UK we rely on the statistical-purposes exception in the Privacy and Electronic Communications Regulations. You can object at any time by switching off "Analytics" in Cookie settings, which turns Fathom off for your browser.

We also keep our own anonymous daily totals of visitors who arrive from an advert: how many land, open our editor, sign up and buy, by ad platform and landing page. The ad platform and page name travel in the web address of our own pages; nothing is stored on or read from your device, no cookie is used, and the totals are never linked to you or your account. Because no storage on your device is involved, this counting continues whatever you choose in Cookie settings.

If you accept Analytics or Marketing cookies, our site also remembers in your browser how you first and most recently arrived (campaign tags, the referring site and the page you landed on) and attaches it to your account when you sign up, so we can see which channels bring us customers. If you do not accept, we keep none of this. The one exception is a referral code, if you followed a friend's referral link: we keep it only to credit that referral.

When you sign up, subscribe or cancel, our servers record that event against your account in PostHog (EU), to measure how our business is doing. We rely on our legitimate interests for this; you can object by emailing privacy@mostlytiny.io.

10. Emails we send you

We email you what you need to use MostlyPDF: sign-in links, receipts, billing and security notices, and messages about your account. These are part of the service, so you cannot turn them off while your account is open.

We may also send you tips and offers about MostlyPDF. The sign-up form has a box for these, ticked by default: untick it and we never send them. In the UK this is the "soft opt-in" in regulation 22 of the Privacy and Electronic Communications Regulations; our lawful basis under the UK GDPR is our legitimate interest in telling customers about the product they signed up for, and you can object at any time.

We email you about other Mostly Tiny products (MostlyQR, MostlySign, MostlyPrivacy, MostlyRender and Vekta) only if you asked us to, by ticking a box that is never ticked for you, either when you sign up or later in a product. Our lawful basis is your consent. We send at most one such email a month across all of them.

Every marketing email says why you are getting it, has an unsubscribe link, and supports your email app's one-click unsubscribe button. One click stops that kind of email; the linked preferences page lets you choose exactly what you get, or stop all marketing email from every Mostly Tiny product at once. You can also change this in your Mostly Tiny account at id.mostlytiny.io/settings. Withdrawing is as easy as agreeing, and never affects service email.

To show we had your agreement, we record each choice: which box, the exact wording you saw, when, and a keyed one-way hash of your IP address. We store your choices against a one-way hash of your email address. If an address bounces permanently or a message is reported as spam, we stop all marketing email to it. Our do-not-email list keeps only that hash, never your address, so it continues to protect you after you close your account.

11. Our legal bases for processing

Where the EU or UK GDPR applies, we process your personal data on one or more lawful bases under Article 6: your consent; the performance of a contract with you; compliance with a legal obligation; protection of vital interests; the performance of a task in the public interest; or our legitimate interests (or those of a third party), except where overridden by your interests or rights.

Where we rely on legitimate interests, these include operating and securing our services, understanding how they are used, and limited marketing — you may object at any time. Where we process special categories of personal data under Article 9 (for example health or biometric data), we do so only with your explicit consent or another condition permitted by law.

12. Who we share your data with

We share personal data with: service providers and processors who operate mostlypdf.com on our behalf (for example Google Cloud and Firebase: hosting, sign-in, database, files, processing (see "Where your data is stored"); Google reCAPTCHA (via Firebase App Check): bot protection for server-side tools; Cloudflare: edge security; Stripe: payments; Resend: email; Fathom Analytics: cookie-free statistics; PostHog (EU): product analytics; Anthropic: the AI assistant, which receives the text of the document you ask it about; and our own Mostly Tiny services MostlyRender (turning HTML, Markdown, email and web pages into PDFs), MostlyID (sign-in) and MostlyPrivacy (this banner and these documents)), who may only use it on our instructions; professional advisers, payment providers, and law-enforcement or regulators where required; and parties to a corporate transaction such as a merger or acquisition. We do not sell your personal data for money.

13. Advertising

We do not run advertising platforms' tags on mostlypdf.com and we do not report sign-ups or purchases to advertising platforms. If you accept Marketing cookies and arrive from an advert whose link carries a click identifier (such as gclid or msclkid), we keep it in your browser for up to 90 days to see which adverts bring visitors; it is not sent to the advertising platform. We will update this policy before that changes.

14. International data transfers

Some of our service providers are located outside your country, including outside the EEA, the UK or Australia. Where we transfer personal data internationally we rely on a lawful transfer mechanism — such as an adequacy decision, the EU Standard Contractual Clauses (with the UK International Data Transfer Addendum where relevant), or another safeguard permitted by law — and take steps to keep your data protected. Details are available on request at privacy@mostlytiny.io.

15. Where your data is stored

MostlyPDF runs on Google Cloud and Firebase: database in the United States (nam5 multi-region); file processing, uploaded files and outputs in the UK (europe-west2, London).

Sign-in uses Firebase Authentication, which Google runs only in the United States, and a Mostly Tiny account you sign in with is held by Mostly Tiny ID, whose database is in the United States. Our website is served from Google's global network (Firebase Hosting).

Transfers to Google LLC in the United States rely on the UK Extension to the EU-US Data Privacy Framework (and, for data under the EU GDPR, on the EU-US Data Privacy Framework), to both of which Google LLC is certified. If you are in the EU, your personal data reaches our servers in the UK under the European Commission's adequacy decision for the UK (Implementing Decision (EU) 2021/1772, as amended by Implementing Decision (EU) 2025/2574).

16. How long we keep your data

We keep personal data only as long as necessary for the purposes described in this policy, after which we delete or anonymise it. The criteria we use to set retention periods include the nature and sensitivity of the data, the purpose of processing, and our legal, accounting and reporting obligations (files you upload and their outputs are deleted within 24 hours, and an output is available to you only through a private link that expires after an hour; text sent to the AI assistant is not kept by us after the answer is returned, and Anthropic deletes it within 30 days; account data while your account is active; billing records as tax law requires; request logs briefly for security).

17. How we protect your data

We use appropriate technical and organisational measures — including encryption in transit, access controls and regular review — to protect personal data against loss, misuse and unauthorised access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

18. Cookies and similar technologies

We use cookies and similar technologies on mostlypdf.com. For the cookies we use, their purpose and duration, and how to control them, see our Cookie Policy.

19. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, including profiling, unless permitted by law. Where we ever do, we will tell you, explain the logic involved, and offer the right to obtain human review.

20. Children’s privacy

mostlypdf.com is not directed to children. We do not knowingly collect personal data from children below the age of digital consent that applies to them (16 under the GDPR, subject to lower national ages down to 13), and we do not knowingly sell or share the personal information of consumers we know to be under 16. If you believe a child has given us data, contact us at privacy@mostlytiny.io and we will delete it.

21. Your rights under the GDPR

If the EU or UK GDPR applies to you, you have the right to: be informed; access your personal data; have inaccurate data rectified; have your data erased; restrict processing; data portability; and object to processing, including to direct marketing. Where processing is based on consent, you may withdraw it at any time without affecting processing carried out beforehand.

To exercise any of these rights, contact us at privacy@mostlytiny.io. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, telling you within the first month. You also have the right to lodge a complaint with your data protection supervisory authority.

22. UK supervisory authority

If you are in the UK, the UK GDPR and the Data Protection Act 2018 apply, and you may complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

23. How to complain to us

If you are unhappy with how we have handled your personal data, email privacy@mostlytiny.io with "Complaint" in the subject. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at any time.

24. If you are in the United States

We do not sell or share personal information for advertising, and we treat a Global Privacy Control signal from your browser as a refusal of any non-essential cookies. To ask what we hold about you, or to have it corrected or deleted, email privacy@mostlytiny.io.

25. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new effective date and, where changes are significant, take reasonable steps to notify you.

26. Contact us

For any privacy question, request or complaint about how we handle your personal data, contact Mostly Tiny Ltd at privacy@mostlytiny.io.

Studio M, Hackney Depot, 5 Sheep Lane, London E8 4QS, United Kingdom