Privacy Policy

1. Who we are

PDF Workbench is operated by Ganexas Consultancy Services Pvt. Ltd. (“Ganexas”, “we”, “us”). We act as the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP), and as the Data Controller under the EU General Data Protection Regulation (GDPR).

Data Protection Officer: privacy@auditganit.com

2. Data we collect

2.1 Account data

When you sign in via Google or Microsoft, we receive your name, email address, and profile picture from the identity provider. We do not receive or store your password.

2.2 Document data

PDF Workbench is local-first. Core PDF operations (view, annotate, merge, split, compress) run entirely in your browser using WebAssembly. Documents processed locally are never uploaded to our servers.

Server-side operations (conversion, OCR) require temporary upload. These files are:

• Encrypted in transit (TLS 1.3) and at rest (AES-256)
• Processed in isolated, ephemeral containers
• Automatically deleted within 1 hour of processing completion
• Never used for training, analytics, or any secondary purpose

2.3 Usage data

We log the type of operation performed, timestamps, and document metadata (page count, file size — not content). This is required for the audit trail and is retained per your organisation's retention policy.

2.4 Audit log

Every action (sign-in, document access, processing operation, settings change) is recorded in an immutable, hash-chained audit log. Each entry is cryptographically linked to the previous entry, making tampering detectable. This log is append-only — database triggers prevent modification or deletion.

2.5 Edit attestations and reference markers

When you edit a document with our editor, the editing itself happens entirely in your browser — the document is never uploaded. We record only a SHA-256 digest of the file before and after editing, together with a structural summary of what changed (for example “a text box was added on page 3”). We never receive or store the text you typed, the images you inserted, or any part of the document's contents.

Edited documents also carry a reference marker: a randomly generated identifier placed in the document's metadata, and shown on the document as a verification reference. This marker is opaque — it is a random value that encodes nothing. It does not contain your name, e-mail address, or any other personal data, and it cannot be decoded. It is meaningful only as a lookup key against our records, and it exists so that a document can later be checked for authenticity using the Verify tool.

You can see every attestation recorded against your account on the History page, and export or erase them using your data rights below.

3. DPDP Act, 2023 — India

As a Data Fiduciary under the DPDP Act, we implement:

• Consent: We obtain explicit, informed, and specific consent before processing personal data. Consent is granular — you can grant or withdraw consent for specific processing activities independently.
• Purpose limitation: Personal data is processed only for the specific purpose for which consent was obtained. We do not repurpose data.
• Data minimisation: We collect only the minimum data necessary. Local-first processing means most document data never reaches our servers.
• Right to erasure: You can request complete deletion of your personal data. We pseudonymise legally-retained records (audit logs required by SOX) and delete everything else.
• Right to correction: You can request correction of inaccurate personal data at any time.
• Right to access: You can export all your personal data in a machine-readable format (JSON).
• Breach notification: In the event of a data breach, we notify the Data Protection Board and affected Data Principals within 72 hours.
• Grievance redressal: You can submit grievances via our Data Principal portal. We acknowledge within 48 hours and resolve within 30 days.

4. GDPR — European Union

For users in the European Economic Area, we additionally provide:

• Lawful basis: We process data under consent (Art. 6(1)(a)) for document processing, and legitimate interest (Art. 6(1)(f)) for security and audit logging.
• Processing records: We maintain records of processing activities per Article 30, available on request to supervisory authorities.
• Data portability: You can export your data in structured, machine-readable formats (JSON, CSV).
• Right to object: You can object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.
• Cross-border transfers: Your data is processed on India-resident infrastructure. Where EU data is processed, we rely on Standard Contractual Clauses (SCCs) as the transfer mechanism.
• Privacy by design: Data protection is integrated into every stage of our development process, not bolted on afterwards.

5. SOX compliance — Audit controls

For organisations subject to Sarbanes-Oxley Act requirements:

• Immutable audit trail: Every document access, modification, and processing operation is logged with actor, timestamp, action, and cryptographic hash chain. Database triggers enforce append-only semantics.
• Access controls: Role-based access with least-privilege enforcement. Segregation of duties between document processing and administrative functions.
• Document retention: Configurable retention policies with legal hold capability. Documents under legal hold cannot be deleted even by administrators.
• Chain of custody: Full version history with hash verification for every document. Any modification creates a new version; originals are preserved.
• Access reviews: Periodic access review reports available for compliance officers.

6. Data retention

• Account data: Retained while your account is active. Deleted within 30 days of account closure, except where legally required.
• Processed documents: Server-processed files are deleted within 1 hour. Locally-processed files never leave your device.
• Audit logs: Retained for 7 years per SOX requirements. Pseudonymised on account deletion — the action record remains but personal identifiers are replaced with hashes.
• Consent records: Retained for the duration of the consent plus 3 years, per regulatory guidance.

7. Security measures

• AES-256 encryption for data at rest
• TLS 1.3 for data in transit
• Isolated container processing — each conversion runs in its own ephemeral sandbox
• Rate limiting and brute-force protection on authentication
• Regular security audits and dependency vulnerability scanning
• India-resident infrastructure on SOC 2 certified data centres

8. Third-party processors

We use the following sub-processors:

• Google / Microsoft: OAuth identity providers (authentication only — they do not access your documents)
• Hostinger: Infrastructure hosting (India region)

We do not sell, share, or provide your data to any other third party.

9. Your rights

Regardless of your jurisdiction, you have the right to:

• Access your personal data and processing records
• Correct inaccurate personal data
• Delete your account and associated personal data
• Export your data in a machine-readable format
• Withdraw consent for specific processing activities
• Lodge a complaint with your local data protection authority

To exercise any of these rights, contact privacy@auditganit.com.

10. Changes to this policy

We will notify you of material changes via email and an in-app notification at least 30 days before the changes take effect. Continued use after the effective date constitutes acceptance.