Privacy.

Not legal advice. Reviewed against the service as built; have a lawyer skim it before you rely on it. Last updated: 4 September 2026.

Data controller: ADS - Consult LLP (UIC 175421683), Slivnitsa 105, 2, 22, Varna 9010, Bulgaria. Contact / data requests: info@sourceback.app.

We designed SourceBack to hold as little of your data as possible. In short: your uploaded files and their outputs are processed to produce your result and then auto-deleted within 12 hours, and we never reuse your content or use it to train anything.

1. What we process

Data	Why	Kept for
The file you upload + the output we generate	To convert it and let you preview/download	Auto-deleted within 12 hours; the uploaded source is deleted right after conversion
Payment info	To take payment	Handled by Stripe — we never see or store your card number. Stripe holds transaction records; see Stripe's privacy policy
Prepaid credit token	To hold prepaid download credits, where offered	Stored in your browser (localStorage) + a balance in our database until spent
Operational logs & analytics	Reliability, abuse prevention, aggregate metrics	Event counts and job metadata (page counts, sizes, success/purchase events) — never anything derived from your file content. Retained 90 days, then purged.
IP address	Rate limiting / abuse protection	Short-lived hit records, purged on a rolling window

We do not require an account, name, or email to use the service.

2. What we do NOT do

• We do not sell your data.
• We do not use your uploaded files or outputs to train models or build any

product; they exist only to produce your result and are then deleted.

• We do not retain your file content beyond the retention window above.

3. Legal bases (GDPR)

• Contract — to provide the conversion you requested and take payment.
• Legitimate interests — to keep the service secure and working (rate limiting,

abuse prevention, aggregate operational metrics), balanced against your rights.

4. Who we share with (processors)

• Stripe — payment processing.
• Fly.io — runs the servers/storage that briefly hold your job.

We use reputable providers and don't share your file content beyond what's needed to run the service. We do not currently use any third-party analytics or error-monitoring service.

International transfers. Our servers are located in London, United Kingdom. Transfers from the EEA to the UK are covered by the European Commission's adequacy decision for the UK. Stripe may process payment data outside the EEA under its own safeguards; see Stripe's privacy policy.

5. Cookies and local storage

We don't use advertising or tracking cookies, and we run no third-party analytics. We use your browser's local storage only to hold your prepaid credit token, where credits are offered, so you can spend them.

6. Your rights

Under the GDPR you can ask to access, correct, erase, restrict, or object to our processing of your personal data, and to data portability. Because we auto-delete file content quickly and hold minimal personal data, some requests may have little to act on. To exercise a right, email info@sourceback.app. You can also complain to your local supervisory authority, or to ours — the Bulgarian Commission for Personal Data Protection (CPDP), cpdp.bg.

7. Children

The service isn't directed at children under 16 and we don't knowingly process their data.

8. Changes

We may update this policy; the current version is always at this URL, with the "last updated" date above.

9. Contact

info@sourceback.app.