workbench (workbenchpdf.com) is a service of [COMPANY NAME], located at [ADDRESS, POSTCODE AND CITY], registered with the Netherlands Chamber of Commerce under number [KVK NUMBER]. We are responsible for the processing of personal data as described in this policy.
Questions about privacy can be sent to [EMAIL ADDRESS, e.g. privacy@workbenchpdf.com].
When you open a PDF or image in workbench, it is processed by your own browser, on your own device. The file is not sent to us or anyone else and we cannot see it. Close the tab and the file is gone from workbench.
The program code and fonts of workbench come from our own website, including text recognition (OCR). Only when you use PDF to Word, Excel or PowerPoint, or convert a Word, Excel or PowerPoint file to PDF, does your browser fetch the component for it from the public code library cdn.jsdelivr.net. As with any website, your IP address is passed on. Your files do not go there.
Five tools use artificial intelligence: Chat with PDF, the AI summarizer, Translate PDF, the AI quiz generator and the AI detector. For these, your browser takes the text from the document (or the text you paste) and sends it, with your question or task, to our server. The server passes it on to Claude, the AI from Anthropic, and sends the answer back. The file itself (layout, images) is not sent.
| Data | Purpose | Legal basis |
|---|---|---|
| An untraceable code of your IP address (a hash with a secret key that changes daily) and the number of actions and visits that day | Keeping track of the free limit of 2 actions a day, preventing abuse and counting how many visitors the site has per day | Legitimate interest: offering a fair free version |
| Email address and password (stored encrypted), or your Google account (name and email address) if you log in with Google | Creating your account, logging in and linking your subscription to you | Performance of the contract |
| Subscription data: type of subscription, status, end date of the period, customer number and subscription number at Stripe | Determining whether you have Pro and managing your subscription | Performance of the contract |
| Payment and invoice data, such as name, address, payment method and invoices (at Stripe) | Processing payments and keeping our records | Performance of the contract and legal obligation (tax record keeping) |
| Data for advertising: cookies and device IDs from Google | Showing ads to free users | Consent, which you give or refuse via the cookie notice |
| Error reports from your browser when a tool fails: the technical message, the tool, the page and your browser version (no files, no texts, no IP address) | Finding and fixing errors | Legitimate interest: a working service |
| Technical data in server logs: IP address, browser, time and requested page | Keeping the website secure and working | Legitimate interest: security |
| Email addresses of colleagues that a team owner adds to their team | Giving team members Pro and sending them an invitation | Performance of the contract with the team owner, and legitimate interest of the team member |
| Emails about your account and subscription (welcome, trial, payment, cancellation) | Keeping you informed about your account and payments | Performance of the contract |
| Your emails to us | Answering your question | Legitimate interest, or performance of the contract |
We do not make decisions about you that are made solely by a computer, and we do not create profiles of you.
We use these companies. We have agreements with each of them about protecting your data.
| Party | What they do | Role |
|---|---|---|
| Supabase Inc. | Database and login (accounts, subscriptions, the daily counter). Servers in [REGION, e.g. Frankfurt, Germany] | Processor |
| Vercel Inc. | Website hosting and server logs | Processor |
| Resend (Plus Five Five, Inc.) | Sending emails about your account and subscription, such as the welcome email, a reminder before the end of your trial and a team invitation | Processor |
| Anthropic PBC | Creating answers for the AI tools (only the text of the PDF you choose for that) | Processor |
| Stripe Payments Europe Ltd. | Payments, subscriptions and invoices | Independent controller for payment data |
| Google Ireland Ltd. | Logging in with Google (if you choose to) and ads via AdSense | Independent or joint controller, see how Google uses data |
Beyond this, we only pass on data when the law requires us to.
Some of our suppliers are based in the United States. When data goes to the US, this happens on the basis of the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.
Connections to workbench are encrypted (https). Passwords are not stored in readable form. Only our servers can access the database, and we only store IP addresses as an untraceable code. Because your files are not sent to us, they cannot leak from us either.
You have the right to access your data, have it corrected or deleted, restrict its processing, object, and take your data to another service. If you have given consent, for example for advertising cookies, you can always withdraw it.
Send your request to [EMAIL ADDRESS] from the email address of your account. We respond within one month. You can cancel your subscription or change your payment details yourself, via Manage subscription in your account.
If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority in your own country. We would like to hear from you first, so we can solve it together.
We update this policy when our service changes. The date at the top shows which version applies. For important changes we will let you know by email or with a notice on the website.