This Privacy Policy governs the collection, storage, and processing practices of ConvertXLab ("we," "our," or "us") on the convertxlab.com website ("Site"). It establishes a binding framework for how user information is handled, grounded directly in the engineering design, backend routing, database controllers, and third-party integrations of our codebase. We encourage you to read this entire document to understand your privacy rights and our operational processes.
ConvertXLab is committed to protecting the privacy of our site visitors and registered customers. This policy applies to all products, services, converters, and plugins offered by ConvertXLab. It details what data we process, the legal grounds for such processing, our data retention limits, and your rights under regional data protection regulations.
1. Ephemeral File Processing and RAM-Only Pipelines
At ConvertXLab, we enforce a strict privacy-by-design architecture regarding your files. When you upload a file for conversion—regardless of format, including but not limited to images, PDFs, word documents, archives, audio, or video files—the raw file data is buffered entirely inside the random-access memory (RAM) of our servers. Our servers do not write these files to disk, temp folders, or persistent storage. Local media hosting partitions are strictly restricted to authenticated site administrators for managing permanent static assets (like blog images) and are never utilized to save user conversion uploads. Once the transcoding process finishes or fails, the buffer memory allocated to the request is immediately freed and garbage collected. Consequently, we do not store, scan, preview, share, or maintain any copy of your uploaded files, ensuring complete file confidentiality.
2. Types of Data We Process and Store
While your files are processed transiently, we must collect and process specific metadata and account identifiers to manage subscriptions, prevent platform abuse, and maintain session authorization:
Account Information: When you register an account, we collect and store your username, email address, and password. Passwords are secured using one-way cryptographic hashing via bcrypt. For users logging in through Google OAuth, we verify your Google identity token and establish a secure Next-Auth session token.
Connected Property Configurations: When customers connect third-party platforms (like WooCommerce or Shopify) to the conversion API, we register property URLs, API keys, and configuration overrides (e.g., target formats, compression levels), and generated API keys in MongoDB.
Log and Diagnostic Metadata: Our database registers an audit log for every integration transaction. We store the file extension, MIME type, byte size, processing timestamps, job identifier, and a SHA-256 hash of the input file. This hash is logged solely to prevent redundant processing conflicts and is decoupled from the file content.
Technical Infrastructure Identifiers: We extract client IP addresses from Cloudflare headers and log User Agent strings. This metadata is parsed to enforce rate-limiting structures and analyze aggregate performance issues.
3. Purpose and Legal Bases of Processing
We process information under clear legal justifications. For registered users, we process data to perform our contractual obligation to deliver customized API queues and connected property slots. We also have a legitimate interest in protecting our backend services against malicious DDoS campaigns, maintaining consistent server capacity through rate limits, and analyzing aggregated conversion success rates to fix bugs in our conversion engines.
4. Information Sharing and Sub-processors
We do not sell or rent user personal identification information. We share metadata and authentication records only with essential sub-processors under secure data processing contracts. These include Cloudflare for network routing, secure VPS hosting provider for server operations, and MongoDB Atlas for database hosting. Your actual conversion files never leave our ephemeral RAM stream and are never shared with these sub-processors.
5. User Privacy Rights and Choices
You have the right to view, download, update, or request the deletion of all personal data records associated with your account from MongoDB. You can manage your preferences through the customer settings tab or contact our data protection team directly at [email protected].