Privacy Policy

Data controller: Level Design Agency
Contact: privacy@pocdocs.co.uk

If you have questions or wish to exercise your data protection rights, contact us at the address above. We aim to respond within one month as required under UK GDPR.

Account data: When you sign in with Google, we receive your name, email address, and profile image from Google. We use your email as your account identifier and to associate subscription status, wallet balance, and usage quotas.

Documents you upload: PDF files and derived content (text, images, layout structure) that you submit for conversion or editing. This may include personal or confidential information contained in your documents. You control what you upload.

Payment data: We do not store full card numbers. Stripe processes payments and provides us with transaction identifiers, amounts, and subscription status.

Usage data: Conversion counts, export usage, AI message counts, plan tier, wallet balance, error logs, and basic analytics (e.g. pages visited, browser type, approximate location from IP) to operate and improve the service.

Cookies & local storage: Session cookies for authentication (NextAuth), and browser storage for editor state, pending uploads, and preferences. See Section 8.

We process personal data on the following legal bases:

• Contract: to provide conversions, editor access, exports, subscriptions, and wallet billing
• Legitimate interests: security, fraud prevention, service improvement, and support (balanced against your rights)
• Consent: where required for non-essential cookies or marketing (we do not sell your data)
• Legal obligation: tax, accounting, and regulatory requirements

Specifically, we use your data to:

• Authenticate you and enforce plan limits (free daily conversions, export gates, AI quotas)
• Convert PDFs and generate mobile layouts, including AI-assisted structuring
• Process payments and manage subscriptions via Stripe
• Respond to support requests and communicate service updates
• Monitor reliability, debug errors, and prevent abuse

To convert and assist with editing, document content (including text and images extracted from your PDF) may be sent to third-party AI providers (currently OpenAI) and processed on our servers. We send only what is necessary to perform the requested conversion or AI edit.

Uploaded PDFs may be stored temporarily on cloud infrastructure (e.g. Vercel Blob) during conversion and are deleted after processing where that workflow is enabled. Edited documents are primarily stored in your browser unless you use a feature that explicitly saves to our servers.

Do not upload special-category data (e.g. health records, children's data) unless you have a lawful basis and understand the processing risks. We are not designed as a certified document vault or legal archive.

We share data only as needed to run the service:

• Google: OAuth sign-in (see Google's privacy policy)
• Stripe: payment processing and subscription management
• OpenAI: AI layout and assistant features
• Vercel: hosting, serverless functions, and optional blob storage for uploads

We do not sell your personal data. We may disclose data if required by law, court order, or to protect rights, safety, and security.

Some providers may process data outside the UK/EEA. Where they do, we rely on appropriate safeguards (such as UK International Data Transfer Agreements or EU Standard Contractual Clauses) as applicable.

• Account & billing records: for the life of your account plus up to 7 years for tax and legal compliance
• Uploaded PDFs (server): typically deleted after conversion completes; may be retained briefly for retries or error recovery
• Editor documents (browser): until you clear browser storage or we change storage keys in an update
• Usage metadata (conversion counts, quotas): stored with your account while active
• Logs: typically up to 90 days unless needed for security investigations

If you are in the UK or EEA, you may have the right to:

• Access a copy of your personal data
• Rectify inaccurate data
• Erase data ("right to be forgotten") in certain circumstances
• Restrict or object to processing in certain circumstances
• Data portability for data processed by automated means under contract
• Withdraw consent where processing is consent-based
• Lodge a complaint with the ICO (ico.org.uk) or your local supervisory authority

To exercise these rights, email privacy@pocdocs.co.uk. We may need to verify your identity before fulfilling a request.

Strictly necessary: authentication session cookies (required to keep you signed in).

Functional: localStorage/sessionStorage for editor documents, pending PDF uploads before login, and UI preferences (e.g. locale).

You can block cookies in your browser, but the service will not function correctly without authentication cookies.

We use HTTPS, access controls, and reputable infrastructure providers. No method of transmission or storage is 100% secure. You are responsible for securing your Google account and any devices where editor data is stored locally.

PocDocs is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date. Material changes may also be notified by email or in-app notice where appropriate.

Privacy enquiries: privacy@pocdocs.co.uk
General support: hello@pocdocs.co.uk