Privacy Policy

Browser-based tools process files on your own device; those files are never uploaded. AI tools send text to Anthropic (Claude) for processing, never your original file. Accounts, usage records and subscription information let us run the service. No analytics are active. You can request a copy of your personal data or ask us to delete it using the contact details below.

YallaConvert, based in Lebanon, is the data controller responsible for the personal data we process to operate YallaConvert. For privacy questions or requests, email support@yallaconvert.com.

Every tool labeled “Processed privately in your browser” runs locally using technology built into your browser. Files are processed in memory on your device and discarded when you close or reload the page. They are never sent to us, and we never see them. We do not log file names or file contents.

Some converters (video/audio, OCR) download an open-source conversion engine or language data on first use. Those downloads never include your files.

The AI tools (summarizer, rewriter, translator, study kit and the others labeled “Requires secure server processing”) work differently: text is extracted from your document in your browser, and only that text is sent to our processing function and on to Anthropic (Claude). The original file is not uploaded.

Not by us. It's sent over an encrypted connection for processing. Our AI provider, Anthropic (Claude), may not train its models on it and deletes it within 30 days, unless it must keep it longer to enforce its usage policy or to comply with the law. We keep only safe usage metadata (operation type, input size, credits used, model name, token counts, and estimated cost) for quota and cost accounting. Token counts are numbers only; we never keep the prompt or output text.

If you create an account we store your email address and authentication data with our infrastructure provider, Supabase. If you subscribe, our payment provider Paddle (the merchant of record) processes your payment; we never see or store your full card details — we keep only subscription metadata (plan, status, renewal period, Paddle identifiers) to grant access.

Supabase also records the IP address and browser type (user agent) of each sign-in session, and the IP address of sign-in events, to keep accounts secure.

Saved presets (your tool settings) and usage records (credits used per period) are stored against your account and visible only to you.

The free plan includes a monthly allowance of AI credits, one per person. To keep it available, we use the following. Each is stored only as a keyed, one-way hash: we cannot read your email address or IP address back from it.

• Your email address, normalized: some providers deliver several spellings of an address to one inbox (in Gmail, dots and a “+tag” are ignored). Accounts whose addresses reach the same inbox share one free allowance. Other addresses are only lowercased; we never match addresses that merely look alike.
• After an account is deleted: if it used free AI credits, we keep only the hash of its normalized email address for 35 days, so a new account on the same inbox does not receive new free credits during that time.
• Temporary email services: we check the domain of your email address against a public list of disposable email services. Accounts on those addresses do not receive free AI credits.
• Your network: when a free account first uses an AI tool, we record a hash of its network (the IP address shortened to the first three parts of an IPv4 address, or the first half of an IPv6 address) to count how many new free accounts appear on one network. This count is never used to refuse credits.

These measures never block your account or your sign-in, and never affect a paid plan. The most they can do is that a free account does not receive free AI credits. If you think that has happened by mistake, contact us and a person will review it. They are not used for advertising, analytics or tracking you on other sites.

• Account and sign-in: to create and authenticate your account and provide access to the service; performance of our contract with you.
• AI tools: to process the text you submit and account for usage and quotas; performance of our contract with you.
• Payments: to manage subscriptions and paid access; performance of our contract with you. Processing needed to meet applicable tax and accounting duties is based on legal obligation.
• Free-plan abuse prevention: to stop one person from collecting free AI credits through many accounts, and to understand such abuse; our legitimate interest in preventing fraud and keeping the free plan available. You can object by contacting us.
• Bot protection: to protect sign-up, log-in and password reset forms; our legitimate interest in preventing automated abuse and keeping the service secure.
• Service emails: to send messages needed to administer your account; performance of our contract with you. Account-security notices are based on our legitimate interest in protecting accounts.

Where processing relies on your consent, you may withdraw it at any time by contacting us. Withdrawal does not affect the lawfulness of processing before you withdrew consent.

No analytics are active. Strictly-necessary storage (your consent choice, session, and locally-saved “recently used tools”) stays on your device. See the Cookie Policy.

We use these providers for the following purposes:

• Supabase: Accounts, database and server functions. Data: Email addresses, authentication data (including the IP address and browser type of sign-in sessions), account records, saved presets, usage records, subscription metadata and free-plan abuse-prevention hashes; text submitted to AI server functions. Location: eu-west-1 (Ireland, EU). Supabase privacy information
• Paddle: Payments and billing as merchant of record. Data: Payment and billing information and subscription identifiers. Location: see provider. Paddle privacy information
• Anthropic (Claude): Processing text submitted to the AI tools. Data: Text submitted for AI processing; original files are not sent. Location: see provider. Anthropic (Claude) privacy information
• Netlify: Hosting and serving the website. Data: Website requests; further request-data handling: see provider. Location: see provider. Netlify privacy information
• Cloudflare Turnstile: Protecting sign-up, log-in and password reset forms against bots when CAPTCHA is enabled. Data: Challenge responses; other data collected by Cloudflare: see provider. Location: see provider. Cloudflare Turnstile privacy information
• Resend: Sending transactional email. Data: Recipient email addresses and email content. Location: see provider. Resend privacy information

This list is also available on our Subprocessors page.

Providers may process data outside your country. Transfers outside the EU or UK require an applicable adequacy decision or appropriate safeguards, such as Standard Contractual Clauses.

• Browser-tool files: never received by us, so we have nothing to retain.
• Account data: kept while your account exists; deleting your account removes its associated profile and account records, except the email hash described under “Preventing free-plan abuse”.
• Usage records: kept for quota accounting; account-linked usage records are removed when your account is deleted.
• Billing records held by Paddle: Paddle handles payment and billing records as merchant of record.
• Free-plan abuse prevention: the hash of your normalized email address is kept while your account exists, and for 35 days after an account that used free AI credits is deleted. The network hash is deleted 30 days after it is recorded.
• AI text at the provider: Our AI provider, Anthropic (Claude), may not train its models on it and deletes it within 30 days, unless it must keep it longer to enforce its usage policy or to comply with the law.

In your account settings, use “Delete account” to request self-service deletion. This removes your account and its associated data, except the email hash described under “Preventing free-plan abuse”. A billable subscription must be canceled first; deleting an account does not cancel Paddle billing. If you cannot use self-service deletion, email support@yallaconvert.com from your account address.

Depending on the law that applies to you, you may request access to your personal data, rectification of inaccurate data, erasure, a copy for export or portability, restriction of processing, or object to processing based on legitimate interests. You may withdraw consent where processing relies on it and complain to a supervisory authority, including the authority where you live or work or where an alleged infringement occurred.

In account settings, under “Your data”, use “Download my data” to export your account and associated records as a JSON file. For deletion, use “Delete account”. To exercise any of these rights or get help, email support@yallaconvert.com. We will reply within one month of receiving your request. Nothing here limits mandatory rights under your local law.

Under the CCPA/CPRA, eligible California residents may ask to know what personal information we collect and how we use and disclose it, request deletion, and correct inaccurate personal information. We do not sell or share personal information as those terms are defined by the CCPA/CPRA. We use hashed identifiers (of a normalized email address and a network) only for security and integrity, to prevent free-plan abuse. We will not discriminate against you for exercising your privacy rights. Submit requests to support@yallaconvert.com using the contact link below, or use the account export and deletion options described above.

The service is not for anyone under 16, and accounts and the AI tools are for people aged 18 or older. We do not knowingly collect personal data from children under 16, or create accounts for anyone under 18. If you believe a child under 16 has provided personal data, contact us at support@yallaconvert.com so we can address it.

We use encryption in transit and row-level security on the database to restrict access to account data. If a personal data breach occurs, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where required, and notify affected users without undue delay where required.

YallaConvert, Lebanon · support@yallaconvert.com