Privacy Policy

This Privacy Policy explains what information MaffeiTools collects, how we use it, who we share it with, and what rights you have. It applies to www.maffeitools.com and to every tool, page, feature, and application programming interface that links to this policy (together, the Service).

By accessing or using the Service you agree to this Privacy Policy and to our Terms of Service. If you do not agree with any part of it, you must not access or use the Service. Your continued use of the Service after any change to this policy constitutes acceptance of the change.

This is version 2026-08-19 of this policy. When you create an account we record which version you accepted and when, and you can see that record at any time on your account page.

MaffeiTools is a product of MaffeiTech LLC, a company registered in Dubai, United Arab Emirates (“MaffeiTech”, “we”, “us”, “our”). MaffeiTech is the data controller responsible for personal data processed through the Service.

For any privacy question, request, or complaint, contact support@maffeitech.com. We aim to respond to rights requests within 30 days, and will tell you if we need longer.

Almost every tool on MaffeiTools runs entirely inside your own web browser. When you compress an image, merge a PDF, convert a file, generate a password, or use most other tools, the file and its contents are processed on your own device. They are not uploaded to us, we never receive them, we never store them, and we cannot see them.

This is a deliberate architectural decision, not a promise about our intentions. It means that for the large majority of what people do on MaffeiTools, there is simply no personal data on our side to lose, misuse, or disclose.

A small number of tools necessarily contact the internet from our servers in order to work at all — for example DNS lookups, domain and email record checks, security header checks, and similar network diagnostics. For those tools, the address or domain you enter is transmitted to our server so the lookup can be performed. Those inputs are used only to perform the lookup you asked for and are not used to build a profile of you.

Information you give us

• Account information. If you create an account: your name, email address, a securely hashed password (we never store your password in readable form), and the country you select.
• Sign-in through Google. If you sign in with Google, we receive your name, email address, profile picture, and Google account identifier. We do not receive your Google password.
• Consent records. When you accept our Terms of Service and Privacy Policy we record which documents you accepted, which version, the date and time, how you accepted, and the IP address, browser user agent, and country of the request, together with a pseudonymous identifier derived from those values. We keep this as evidence that consent was given.
• Correspondence. Anything you send us by email.
• Subscription information. If you take a paid plan: the plan you chose, its status and renewal date, your billing history, and the country and tax identifiers needed to invoice you correctly. Card numbers are handled by our payment provider and do not reach our servers.

Information collected automatically

• Usage data. Which tool was used, when, the country the request came from, and the website that referred you (host only, never the full referring address). This is linked to a random anonymous identifier stored in a first-party cookie, and to your account if you have one. We collect this only when optional analytics is enabled.
• Technical data. IP address, browser type and version, operating system, device type, language preference, and time zone.
• Security and audit data. Records of sign-ins, sign-outs, failed sign-in attempts, password and email changes, and account deletion, together with the IP address, user agent, and country of each event.
• Session data. When signed in, a session record containing a session token, IP address, user agent, and expiry.
• Analytics data. Aggregate page views, referrers, countries, device categories, and performance measurements, collected only when optional analytics is enabled.
• Advertising data. Where advertising is shown, our advertising partners may collect identifiers and interaction data as described in the Advertising section below.

What we deliberately do not collect

• The contents, names, or metadata of files you process in browser-based tools, except the encrypted Markdown share-link record described below.
• Text you type or paste into browser-based tools.
• Full referring URLs, which can contain the search terms you typed.
• Payment card numbers. If and when paid plans are offered, payments will be handled by a third-party payment provider and card details will not reach our servers.
• Special categories of data such as health, biometric, religious, political, or genetic data. Please do not send them to us.

• To provide, operate, and maintain the Service.
• To create and manage your account and authenticate you.
• To send service messages you cannot opt out of while you hold an account, such as email verification, password resets, security alerts, and material changes to these documents.
• To understand which tools are used and how, so we can decide what to improve, build, or retire.
• To display advertising, including personalised advertising, and to measure its performance. For this purpose we use your IP address, your browser user agent, and the country we derive from your IP address in order to select advertising that is relevant to you, to limit how often you see the same advertisement, to detect invalid or fraudulent ad traffic, and to measure whether an advertisement was seen or clicked. Where you are in the European Economic Area, the United Kingdom, or Switzerland, we do this for personalised advertising only with your consent.
• To understand who uses the Service and from where. We use the country derived from your IP address to see which markets the Service is used in, so that we can decide which tools to build, which languages and formats to support, and where to focus. We use country at country level only and do not attempt to determine your precise location.
• To operate paid plans, where you subscribe: to take payment through our payment provider, to give you access to the features your plan includes, to send billing notices and receipts, and to keep the records we are required to keep for tax and accounting.
• To detect, investigate, and prevent abuse, fraud, automated scraping, denial-of-service attempts, and other security incidents, and to enforce rate limits.
• To keep evidence that you accepted our legal documents.
• To comply with legal obligations and to establish, exercise, or defend legal claims.
• To produce aggregated or de-identified statistics. Once information is aggregated or de-identified so that it can no longer reasonably identify you, we may use, publish, license, or share it for any purpose, including commercial purposes, without further restriction.

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service and operate your account.
• Consent — for non-essential cookies, personalised advertising, optional analytics, and any optional marketing. You may withdraw consent at any time; withdrawal does not affect processing already carried out.
• Legitimate interests — to secure the Service, prevent abuse, understand aggregate usage, and defend legal claims. We balance these interests against your rights and keep the data involved to a minimum.
• Legal obligation — where we are required by law to retain or disclose information.

Where the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies, we rely on your consent and on the corresponding permitted bases under that law.

MaffeiTools is offered in tiers. Right now every tool is available without an account, and some features are or will be available only on a paid subscription. We may require an account for some or all tools in future. Tiers that are free to you are supported by advertising. We may display advertising anywhere on the Service, and we may change the amount, placement, and format of advertising at any time. We may also change which tools sit in which tier.

You expressly consent to us and our advertising partners collecting and using information about your use of the Service, and about your device and browser, for the purpose of selecting, delivering, personalising, capping, and measuring advertising. This may include IP address, approximate location derived from it, device and browser characteristics, advertising identifiers, cookies and similar storage, pages viewed, tools used, and interactions with advertisements.

Our advertising partners may combine this information with information they hold from other websites and services in order to build interest profiles and show you advertising they consider relevant, on MaffeiTools and elsewhere. Those partners act as independent controllers of the data they collect, and their own privacy policies govern that processing.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to MaffeiTools and to other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet. You can read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites.

Where you are in the European Economic Area, the United Kingdom, or Switzerland, personalised advertising and non-essential cookies are used only where you have given consent through our consent banner, and you may withdraw or change that consent at any time. Where you decline, our advertising loader is not added to the page.

You can also control advertising personalisation through your Google Ads settings at adssettings.google.com and through industry opt-out tools such as youradchoices.com and youronlinechoices.eu.

We do not knowingly provide our advertising partners with your name, email address, or password, and we do not permit advertising that targets sensitive categories in a manner prohibited by applicable law or by the advertising platform’s own policies.

We use cookies, local storage, and similar technologies. In summary:

• Strictly necessary — sign-in sessions, security, abuse prevention, load balancing, and remembering your cookie choices. These are required for the Service to work and are used without consent where the law permits.
• Preferences — remembering your theme, recently used tools, and similar settings, stored in your browser.
• Analytics — measuring aggregate traffic and performance, and the anonymous identifier used to measure tool usage, only when analytics is enabled.
• Advertising — selecting, delivering, capping, and measuring advertising, including personalised advertising where you have consented.

Full detail, including how to refuse or delete cookies, is set out in our Cookie Policy, which forms part of this Privacy Policy. Blocking some cookies may stop parts of the Service from working.

We share personal information only as described here:

• Service providers (processors) who host and operate the Service on our behalf, under contract and only on our instructions. These currently include our hosting and content delivery provider, our database provider, our transactional email provider, and our analytics provider. We may add, change, or replace providers at any time.
• Advertising partners, as described in the Advertising section.
• Payment providers, if and when paid plans are offered.
• Professional advisers such as lawyers, auditors, and insurers, where necessary.
• Authorities and other parties where we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of MaffeiTech, our users, or the public, or to investigate or prevent fraud, abuse, or a security incident.
• In a corporate transaction. If MaffeiTech is involved in a merger, acquisition, reorganisation, financing, insolvency, sale of assets, or any similar transaction, information we hold may be transferred to the counterparty or successor as part of that transaction. You agree to that transfer.
• Aggregated or de-identified information, without restriction, as described above.

We do not sell your name, email address, or password, and we do not sell the contents of anything you process in a browser-based tool.

However, under some laws — including the California Consumer Privacy Act as amended by the California Privacy Rights Act — the disclosure of identifiers, device information, and browsing activity to advertising partners for personalised advertising can be treated as a “sale” or as “sharing” for cross-context behavioural advertising, even when no money changes hands. On that basis we disclose that we do share such information with advertising partners for those purposes.

If you are a California resident, you have the right to opt out of that sale or sharing. You can exercise it by adjusting your choices in our cookie banner, by enabling a Global Privacy Control signal in your browser, which we honour as a valid opt-out request, or by emailing support@maffeitech.com with the subject line “Do Not Sell or Share My Personal Information”.

We do not knowingly sell or share the personal information of anyone under 16 years of age.

MaffeiTech is established in the United Arab Emirates. Our infrastructure providers operate globally, and our primary database is currently hosted in the European Union. Your information may therefore be transferred to, stored in, and processed in countries other than your own, including countries whose data protection laws differ from those of your country.

Where required, we rely on appropriate safeguards for such transfers, including the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision. You may request further information about these safeguards by contacting us.

By using the Service you acknowledge and consent to such international transfers.

• Account data — for as long as your account exists, and for a reasonable period afterwards to resolve disputes and enforce our agreements.
• Individual tool-usage records — approximately 30 days, after which they are aggregated into statistics that no longer identify an individual and the underlying records are deleted.
• Aggregated statistics — indefinitely.
• Security and audit records — approximately 12 months.
• Consent records — for as long as your account exists and for as long afterwards as we may need to demonstrate that consent was given, which may extend beyond deletion of your account.
• Correspondence — for as long as needed to handle the matter and keep a record of it.
• Encrypted Markdown shares — ciphertext, encryption parameters, expiry time, and a hashed revocation token are held in our temporary data store for up to 20 minutes, unless you revoke the link sooner. The decryption key stays in the URL fragment and is not sent to our server.

We may retain information for longer where required by law, or where it is necessary to establish, exercise, or defend legal claims.

We take security seriously and apply measures appropriate to the limited amount of personal data we hold. These include encryption in transit, hashing of passwords using industry-standard algorithms, restricted administrative access, a strict content security policy, rate limiting and bot protection, and keeping the data we collect to a minimum in the first place.

No method of transmission or storage is completely secure, and we cannot and do not guarantee that the Service or any information will be free from unauthorised access, loss, or alteration. You use the Service at your own risk, and you are responsible for keeping your password confidential and for all activity under your account.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required by law, affected users, within the periods the applicable law requires. Nothing in this policy or in our Terms of Service limits any right you have under mandatory data protection law in respect of such a breach.

Subject to that, and to the maximum extent permitted by applicable law, our liability arising out of any security incident is limited as set out in our Terms of Service.

Depending on where you live, you may have some or all of the following rights. We apply them to everyone where we reasonably can.

• Access — to know what personal data we hold about you and obtain a copy.
• Rectification — to correct inaccurate or incomplete data.
• Erasure — to have your data deleted, subject to data we must keep by law or to defend legal claims.
• Restriction — to limit how we process your data in certain circumstances.
• Portability — to receive your data in a structured, commonly used, machine-readable format.
• Objection — to object to processing based on legitimate interests, and to object to direct marketing at any time.
• Withdrawal of consent — at any time, without affecting processing already carried out.
• Opt out of sale or sharing — as described above.
• Non-discrimination — we will not degrade the Service because you exercised a privacy right.
• Complaint — to lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first.

To exercise any right, email support@maffeitech.com. We may need to verify your identity before acting, and we may decline requests that are manifestly unfounded, excessive, or repetitive, as permitted by law.

The Service is not directed to children. You may not create an account if you are under 16, or under the minimum age at which you can consent to the processing of your personal data in your country, whichever is higher.

We do not knowingly collect personal data from children. If we learn that we have, we will delete it. If you believe a child has provided us with personal data, contact support@maffeitech.com.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. We do use automated systems to detect abuse, apply rate limits, and select advertising; these do not produce legal effects concerning you.

The Service links to and embeds content from third parties, and some tools fetch information from third-party sources at your request. We do not control those third parties, we are not responsible for their content, practices, or privacy policies, and this Privacy Policy does not apply to them. Review their policies before providing them with information.

We may update this Privacy Policy at any time. When we make a material change we will update the version identifier and the effective date, and where you hold an account we will ask you to accept the new version.

Your continued use of the Service after a change takes effect constitutes your acceptance of the updated policy. If you do not accept it, you must stop using the Service.

MaffeiTech LLC
Dubai, United Arab Emirates
support@maffeitech.com

For privacy requests, please put the nature of your request in the subject line so we can route it quickly.