1. Controller
Vcare2 LLC, operating KarmaPDF, is responsible for the personal information described here. Contact privacy@karmapdf.com.
2. Data we process
- Local app data: PDFs, extracted text, summaries, settings, and saved templates are processed and stored locally by default.
- Licensing: license-key hash, purchase email, Stripe identifiers, plan, activation timestamps, app version, platform, device label, and a one-way device identifier.
- Purchasing: Stripe handles card and payment details. We receive transaction, customer, product, tax, refund, dispute, and subscription status information needed to fulfill and account for purchases.
- Support: messages, attachments you choose to send, and diagnostic details.
- Online signatures: only when deliberately enabled and used, document data, recipient contact details, consent and signing events, authentication results, timestamps, network and device metadata, document hashes, and evidence records.
- Website security: ordinary request data such as IP address, user agent, timestamps, and security logs collected by our hosting providers.
3. Purposes and legal bases
We process data to perform contracts and deliver licenses; secure and operate services; prevent fraud and abuse; comply with accounting, tax, sanctions, and legal obligations; respond to support; and, where required, based on consent or another lawful basis identified by the customer using a signature workflow.
4. Sharing
We share data only as needed with processors such as Stripe for payments, Sites/Cloudflare infrastructure for hosting and storage, email-delivery providers when a message is requested, professional advisers, and authorities where legally required. We do not sell personal information or share it for cross-context behavioral advertising.
5. Retention
Local documents and templates remain until you delete them. License and transaction records are retained while a license is active and as needed for accounting, disputes, fraud prevention, and legal obligations. Security logs are kept for a limited operational period. Signature content and evidence retention depend on the service configuration and legal requirements; the sender must communicate the applicable schedule before live use. Support records are deleted or anonymized when no longer needed.
6. Security
We use access controls, encrypted transport, signed activation tokens, one-way device identifiers, secret separation, webhook verification, and limited document transmission. No system is completely secure. Report suspected issues to security@karmapdf.com.
7. Your choices and rights
Depending on where you live, you may request access, correction, deletion, portability, restriction, objection, or withdrawal of consent. California residents may request to know, delete, or correct covered information and receive non-discriminatory treatment. Because we state that we do not sell or share information for cross-context behavioral advertising, there is no sale/share opt-out mechanism. Send requests to privacy@karmapdf.com. We may verify identity and authority before responding.
8. Children
KarmaPDF is a business and productivity product not directed to children under 13, and we do not knowingly collect their personal information.
9. International processing
Data may be processed in the United States and other locations used by our providers. Where required, appropriate transfer safeguards will be used.
10. Changes and contact
We will post updates with a new effective date and provide additional notice for material changes where required. Questions or rights requests: privacy@karmapdf.com. Vcare2 LLC, operating KarmaPDF.