ChatPDF

GDPR overview

ChatPDF is published by a German company, so the GDPR applies to it by law, not by choice, and the privacy notice engages with it directly: it names the GDPR and the UK GDPR as applicable, sets out the legal bases relied on - consent, legal obligation, vital interests - and lists the rights available in the EEA, the UK and Canada, from access and rectification to erasure, restriction, portability and objection. Requests go through a hosted form or a dedicated privacy@chatpdf.com address, and readers are pointed to the European supervisory authorities and the Swiss regulator. What is missing matters too: no data processing agreement, no subprocessor list, no standard contractual clauses, no data protection officer, and Do-Not-Track signals are explicitly ignored. No Article 27 representative is named, which is correct for an EU-established company. The notice itself carries an effective date of 5 January 2023.

Who owns the data?

The terms are unusually clear on ownership: ChatPDF GmbH asserts no ownership over what you upload, and you keep full title and any intellectual property rights attached to it. What the company keeps is its own side of the service - the software, design, content and marks. Two caveats temper the reassurance. Uploaded material may be treated as neither confidential nor proprietary, and the company reserves the right to edit, recategorise, screen or delete anything you submit, at any time and without notice. The privacy notice adds that your information may change hands in a merger, asset sale, financing or acquisition. Finally, the terms disclaim all liability for data loss or corruption, despite routine backups, so the only copy you can rely on is your own.

Reuse rights

For the web product, the licence is deliberately narrow: non-exclusive, non-transferable and revocable, granted for personal, non-commercial use or an internal business purpose. You may download or print portions of the content for that purpose, but any wider commercial exploitation needs written permission first, requested by email. Systematically harvesting content to build a database, compilation or directory is forbidden without written consent. The important exception runs the other way: the API carries an explicit commercial licence, letting you fold document question-answering into your own operations and paid offerings, provided you stay within the same terms. Nothing in the terms restricts what you do with the answers the tool generates for you. The research module adds one editorial rule of its own - cite the original paper, never the tool.

Data retention & training

Hosting summary

The clearest statement comes from the terms of service, which say plainly that the services are hosted in the United States and obtain the user's consent to transfer and process data there. That sits somewhat awkwardly with the rest of the arrangement: the publisher is established in Berlin, German law governs the terms, and disputes go to the European Court of Arbitration in Strasbourg. On the security side, the company describes SSL in transit and encryption at rest, and refers to a storage provider holding SOC 2 Type II certification - the provider is not named, and the certification is theirs rather than ChatPDF's. Payments are handled by Stripe, which stores all payment data. There is no published subprocessor list, no data processing agreement and no mention of standard contractual clauses. One technical caveat worth stating: the domain resolves to an anycast address belonging to its hosting platform's content delivery network, which geolocates to a United States city. That is an edge node, not a storage location, and should not be read as a data centre.