Last updated: November 5, 2026
This policy explains what information VelloDoc processes when you use its tools or contact us, why it's processed, how long it's kept and the choices you have. VelloDoc has no user accounts and is built to keep as little information as possible. It also covers the analytics that show how the site is used.
Who's responsible
VelloDoc is run by its operator, who’s responsible for the processing described on this page. You can reach the operator through the contact form.
Files you upload
VelloDoc is a server-side service. When you run a tool, your files are uploaded over an encrypted HTTPS connection to VelloDoc's server. Each job gets its own temporary folder with a random name, the tool runs on that copy, and the result is sent back to your browser in the same response. VelloDoc doesn't publish results at a download link and doesn't keep a library of your files.
Uploaded files and results are used only to perform the tool action you requested. Their contents aren't read by people, used for advertising or profiling, sold, shared with anyone for their own purposes, or used to train software.
How long files are kept
- When a job succeeds, its temporary folder, including your upload and the result, is deleted when the download finishes or the connection closes.
- When a job fails, its folder is deleted immediately.
- If a job is interrupted, for example by a server restart, an automatic cleanup that runs every 1 minute deletes any job folder older than 30 minutes.
Passwords you enter for protected PDFs are handled the same way: they're sent with the job, used only to open or protect that file, and deleted with the job folder.
Share links
Share PDF Link is the one tool that keeps a file after your download. The PDF is encrypted with a random key before it's saved, and the key goes into the link instead of being stored on the server. The file is deleted when the link expires, after seven days at most, or as soon as you turn the link off. A link password isn't stored either; only a one-way scrambled version is kept to check it. Each time the link is opened, the file is downloaded or a wrong password is typed, VelloDoc records the time, the browser and operating system, and the network address with its last part removed. Only the manage page shows this history, and it's deleted one day after the link ends.
AI PDF Workspace
The AI PDF Workspace reads the text of your PDFs on VelloDoc's server, sends the text back to your browser and deletes the uploaded files straight away. Searching that text happens only in your browser. If you ask the AI a question and tick the box to agree, the text of the documents and your question are sent to Anthropic, PBC, the company that makes the Claude AI model, to write the answer. VelloDoc doesn't save the text, the question or the answer. Anthropic handles this data under its commercial terms, which say data sent through its API isn't used to train its models by default, and it may keep the data for a limited time for safety checks. Don't use the AI for documents you aren't allowed to share with an outside service.
Technical information
Whenever your browser connects, VelloDoc receives your IP address and basic request details, like the page or tool requested, the time and your browser type. VelloDoc uses IP addresses to apply rate limits that protect the service from abuse. These counters are held in the server's memory and discarded after about an hour. VelloDoc's own server doesn't keep request logs, but its hosting provider, Render, keeps technical logs to operate and secure its platform.
Messages you send
When you use the contact form, VelloDoc stores your name (if you give one), email address, topic, message, the time and your IP address. That's so your message can be answered and the form can be protected from abuse. Messages may also be delivered to an inbox through an email service. They're kept only as long as needed to handle your request and are deleted on request.
Analytics
VelloDoc uses Google Analytics, a service from Google, to count visits and see which pages and tools people use and how they found the site, so the tools can be improved. When a page loads, Google Analytics receives the page address, the page you came from, your browser and device type, your approximate location and the time. Google uses your IP address to estimate the location; according to Google, Google Analytics doesn't store IP addresses. It sets two cookies on vellodoc.com, _ga and one starting with _ga_, which let it recognize a returning browser for up to two years. It never receives your files or their contents. Google explains how it uses this information on its page How Google uses information from sites or apps that use its services.
VelloDoc also uses Microsoft Clarity, a service from Microsoft, to see how people use the pages: where they click, how far they scroll and where a page gets in the way, shown as heatmaps and recordings of visits. Clarity receives your clicks, taps, scrolling and mouse movements, the pages you visit, your browser, device and screen size, and your approximate location. The tools, the contact form and anything that shows a file name are hidden from Clarity before anything is sent, so it never receives your files, their names or contents, or what you type into them. It sets two cookies on vellodoc.com, _clck, which recognizes a returning browser for up to a year, and _clsk, which links the pages of one visit for up to a day. Microsoft also sets its own cookies on its domains clarity.ms and bing.com, such as MUID and CLID, which last up to about 13 months. Microsoft explains how it uses this information in the Microsoft Privacy Statement.
What VelloDoc doesn't use
VelloDoc has no accounts, tracking pixels or social media plugins. Apart from the analytics cookies described above, its pages set no cookies. The few things the tools keep in your browser, such as a theme you choose or settings you save, stay on your device and are never sent to VelloDoc. The cookie policy lists the cookies and that browser storage.
Legal bases
Where data protection laws like the GDPR apply, here's why each kind of data is used. Uploaded files are processed to provide the service you ask for. Technical information is processed because running a safe, reliable service is a legitimate interest. Contact messages are processed so you can get a reply. Share link history is kept because letting the person who shared a file see and control access to it is a legitimate interest. Text is sent to the AI only because you ask for an answer and agree to it. Analytics is used because understanding how the site is used is a legitimate interest.
Service providers and international processing
Render hosts VelloDoc and processes uploaded files and technical information on its behalf. When contact messages are delivered by email, the email provider processes those messages. These providers may operate servers outside your country, including in the United States, so your information may be processed in another country. When you ask the AI PDF Workspace a question, Anthropic processes the document text and your question as described above, which may happen in the United States. Google provides analytics, as described above, and may process information in the United States.
Security
Connections use HTTPS, uploads are isolated in temporary job folders and several safeguards limit abuse. The file security page describes them in detail.
Your rights
Depending on where you live, you may have the right to access, correct or delete personal information, to object to or restrict its processing, and to complain to a data protection authority. Because VelloDoc keeps no accounts and deletes files after each job, the personal information it can find is usually limited to contact messages. To make a request, use the contact form and choose the Privacy topic.
You can limit analytics at any time: block or delete cookies for this site in your browser, or install the Google Analytics opt-out browser add-on. The tools work the same either way. For information Google holds, you can also contact Google directly.
Children
VelloDoc is a general-audience utility and isn't directed at children. It doesn't knowingly collect personal information from children.
Changes to this policy
If the way VelloDoc handles information changes, this policy is updated before the change takes effect, and the date at the top of this page changes with it.