Privacy Policy

ConvertFastHub (convertfasthub.com) is operated by ConvertFastHub, the controller of the personal data described in this policy. Our full identification details are on the Legal Notice page. For anything related to privacy, write to [email protected].

We collect only what the service needs to work, keep it only as long as stated below, and never sell it.

We use the files you upload only to perform the conversion you ask for (legal basis: performance of our contract with you). Before converting, every file up to 200 MB is checked automatically on our own servers by an antivirus scanner and a file-type check, to protect the service and other users (legal basis: our legitimate interest in security). No person looks at your files, and we do not use their contents for any other purpose.

The original file is deleted as soon as the conversion succeeds. The converted file, and any upload that was never converted, is deleted automatically after 1 hour if you are not signed in, 24 hours with a free account, or 7 days with Pro, whether or not you download it.

For each conversion we record the original file name, the formats, the file size, its status and timestamps, and either your account or, if you are not signed in, your IP address. We use this to deliver the result, show your history, enforce the plan limits and prevent abuse (legal bases: contract and legitimate interest). Thirty days after a conversion's files are deleted, its IP address is erased and its file name is reduced to the extension.

To apply the free daily limit we keep a per-day counter linked to your IP address or account. Counters are deleted after two days.

If you create an account we store your email address, a securely hashed password (never the password itself), your plan, and the dates you registered and last signed in. If you sign in with Google, Microsoft or Apple, we receive only your email address and an identifier from that provider — not your name, photo or password.

We keep this data while your account exists. You can delete your account at any time from your account page; that erases your account, your conversion history and its files immediately.

We log sign-ins, password changes, session revocations and administrative actions together with the IP address and browser identifier (user agent) involved, to detect and investigate unauthorised access (legal basis: legitimate interest in security). These records are deleted after 12 months. Failed sign-in attempts are counted for 15 minutes to slow down password-guessing attacks; the email address is stored only as an irreversible hash for that purpose.

If you ask to reset your password, we send a link to the address you entered, but only when an account with a password exists for it; the page gives the same answer either way. The link works once and expires after a short time; we store only an irreversible hash of it, and delete the record a day after it expires. The email is delivered by Resend, our email provider, which receives the address and the message (legal basis: performing the contract and our legitimate interest in account security).

Pro subscriptions are paid through PayPal, which acts as an independent controller of the payment data you give it. We never see or store your card or bank details. From PayPal we receive and keep the subscription identifier, the plan, its status and billing dates, which we need to provide Pro and handle cancellations (legal basis: contract).

To understand which pages are used, we record page views on our own servers: the page address, its language, the domain of the site that linked to it (not the full address), the type of device and a pseudonymous visitor code. The code is computed from your IP address and browser identifier with a secret that changes every day, so the same visitor cannot be recognised from one day to the next and the IP address itself is not stored. No cookies are used for this. Individual records are deleted after 90 days; only aggregated totals are kept (legal basis: legitimate interest in running and improving the site).

These statistics are not collected if you reject cookies in our banner, or if your browser sends a Global Privacy Control or Do Not Track signal.

Our content delivery provider, Cloudflare, may additionally provide us with cookieless, aggregated traffic statistics.

If you accept cookies in our banner, we also use Google Analytics 4 to measure how the site is used: the pages you view and interactions such as scrolling, clicking outbound links or downloading files, the referring site, your approximate location (country and city), your device and browser type, and a random identifier stored in the _ga cookies. Google Analytics does not log or store your IP address, and we have switched off Google signals and the use of this data for ad personalisation. Google acts as our processor and the data is kept for at most 14 months (legal basis: your consent, which you can withdraw at any time in Cookie settings).

Google Analytics is not loaded if you reject cookies or if your browser sends a Global Privacy Control or Do Not Track signal. More information at policies.google.com/technologies/partner-sites.

The free service shows ads from Google AdSense, but only if you accept advertising cookies in our banner, and never to Pro subscribers. If you accept, Google and its partners may use cookies and similar technologies to show and measure ads and, where enabled, personalise them based on your visits to this and other sites (legal basis: your consent, which you can withdraw at any time in Cookie settings). Google acts as an independent controller; see how Google uses data from partner sites at policies.google.com/technologies/partner-sites and manage ad personalisation at adssettings.google.com.

We use these providers, each bound by a data processing agreement or acting as an independent controller where noted:

Some of these providers process data outside the European Economic Area or your country. When that happens, the transfer is covered by an adequacy decision (such as the EU–U.S. Data Privacy Framework for certified companies) or by the European Commission's Standard Contractual Clauses.

You can ask to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and you can withdraw any consent at any time without affecting processing carried out before. Write to [email protected]; we answer within one month. You can also delete your account yourself from your account page.

If you live in California or another US state with a privacy law: we do not sell personal information. Allowing advertising cookies may count as "sharing" for targeted advertising; you can opt out by rejecting them in Cookie settings, and we treat a Global Privacy Control signal as that opt-out.

The operator is established in Ecuador, where these rights are also protected by the Organic Law on Personal Data Protection (LOPDP) and supervised by the Superintendencia de Protección de Datos Personales. You have the right to lodge a complaint with that authority or with the data protection authority of the country where you live or work, although we would appreciate the chance to address your concern first.

All traffic is encrypted with HTTPS, stored files are encrypted at rest, passwords are hashed with bcrypt, and access to our systems is restricted and logged.

The service is not directed at children. You must be at least 16 years old to create an account. If you believe a child has given us personal data, contact [email protected] and we will delete it.

If we change this policy, we will update the date at the top and, for significant changes, notify signed-in users on the site before they take effect.