Privacy Policy

Effective date: 26 September 2026. Last updated: 26 September 2026.

This policy explains what information Stanmash Ltd ("we", "us") collects when you use csvtopdf.app (the "site"), including the CSV to PDF, PDF to CSV and Excel to PDF pages, and what we do with it.

The short version: the files you convert are processed on your own device and are never uploaded to us. We use two analytics services, Google Analytics and PostHog, to see how the site is used and to spot errors. They receive usage data about your visit, not the contents of your files.

1. Who we are

csvtopdf.app is operated by Stanmash Ltd, a private company limited by shares, registered in England and Wales under company number 17337841, with its registered office at Stoney Works, 8 Stoney Lane, London SE19 3BD, United Kingdom. Stanmash Ltd is the controller of the personal data described in this policy. For any privacy question or request, email [email protected].

2. Your files stay on your device

When you add a CSV or PDF file, it is read, parsed and converted by code running inside your browser tab. The file and the converted result are held in your browser's memory and are not sent to our servers or to anyone else. We never receive the contents of your files, so we cannot see, keep or recover them. Closing the tab discards them. The font embedded in generated PDFs is loaded from this site, not from a third-party font service.

Some information about a conversion does leave your device as part of the analytics described in section 3: the number of files, their sizes in bytes, the size of the output, how long the conversion took, whether it succeeded and, if it failed, a short technical error message. In addition, PostHog's automatic click tracking records the text and labels of the buttons you click. In the file list, the download and remove buttons are labelled with the file's name, so clicking them can send that file name to PostHog. If a file name is itself sensitive, rename the file before adding it.

3. What we collect and why

3.1 Analytics

  • Google Analytics 4. Records the pages you visit, the page that referred you, your browser and device type, and your approximate location, which Google derives from your IP address. It uses a random identifier stored in a cookie to recognise repeat visits. We use it to understand how people find the site and which pages are useful.
  • PostHog. Records page views, when you leave a page, the elements you click (see section 2), the conversion events described in section 2, and JavaScript errors that occur on the page, including a technical stack trace. It uses a random identifier stored in a cookie and in your browser's local storage, and may use your IP address to derive an approximate location. Session recording is switched off. We use it to see whether conversions work and to find and fix faults.

Neither service receives your name, an account, or the contents of your files. We do not use analytics data for advertising.

3.2 The contact form

If you send a message through the contact form on the home page, we receive the topic you picked, your message and, only if you fill it in, your email address so we can reply. The message is delivered to a private Telegram chat that we read. Your IP address is used briefly, in memory only, to limit how many messages can be sent in a short period. You can also email us directly instead of using the form.

3.3 Hosting and security

The site is hosted on Cloudflare. Like any web host, Cloudflare processes technical data about each request, such as your IP address, browser user-agent and the page requested, to deliver the site, keep it secure and protect it from abuse.

3.4 Stored only in your browser

The site remembers your colour theme and whether converted files should download automatically, using your browser's local storage (keys theme and autoDownload). These settings never leave your device.

3.5 What we do not collect

  • The contents of the files you convert.
  • Accounts, passwords or payment details. The site has no sign-up and no paid plan.
  • Session recordings or keystrokes.

We do not sell personal data and we do not share it with advertisers or data brokers.

4. Legal bases

Under the UK GDPR (and the EU GDPR where it applies) we rely on:

  • Legitimate interests (Article 6(1)(f)): to run, secure and improve the site, including the analytics in section 3.1, and to reply to messages you send us.
  • Legal obligation (Article 6(1)(c)): where the law requires us to keep or disclose information.

5. Service providers

We share data only with the providers we need to run the site:

6. International transfers

Some of these providers process data outside the United Kingdom, including in the United States. Where that happens, the transfer relies on a mechanism recognised under UK data protection law, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified companies), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

7. How long we keep data

  • Your files: never received, so never stored.
  • Google Analytics: event-level data is kept for the retention period set in our Google Analytics property, which cannot exceed 14 months. Aggregated reports that do not identify you may be kept longer.
  • PostHog: kept only as long as it is useful for understanding usage and fixing faults. Ask us and we will delete the data linked to your identifier.
  • Contact messages: kept in our private Telegram chat for as long as we need them to deal with your message. Ask us and we will delete yours.
  • Hosting logs: kept by Cloudflare for a short period under its own policies.

8. Cookies and similar technologies

  • _ga and _ga_<ID>: Google Analytics cookies that hold a random visitor identifier. Up to 2 years.
  • ph_<project key>_posthog: PostHog cookie and local-storage entry that hold a random visitor identifier. Up to 1 year.
  • theme and autoDownload: local-storage entries for your display and download preferences. Kept until you clear them; never sent to us.

You can block or delete cookies and local storage in your browser settings, use a content blocker, or install the Google Analytics opt-out browser add-on. The converter works the same either way.

9. Your rights

Under the UK GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict or object to our processing, including processing based on legitimate interests;
  • receive a portable copy of data you provided to us.

To exercise any of these rights, email [email protected]. We reply within one month. Because analytics data is tied to a random identifier rather than your name, we may need your help to find it.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to deal with your concern first, so please contact us before approaching the ICO.

10. Security

The site is served only over HTTPS. Because conversion happens in your browser, your files are never transmitted, which removes the largest risk entirely. No system is perfectly secure; if you find a vulnerability, please report it to [email protected].

11. Children

The site is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, contact us and we will delete it.

12. Changes to this policy

If we change how the site handles data, we will update this page and the "Last updated" date above.

13. Contact

Stanmash Ltd, Stoney Works, 8 Stoney Lane, London SE19 3BD, United Kingdom. Email: [email protected]. More about who runs this site is on the About page.