Privacy Policy

Effective date: September 28, 2026

Who we are

SVG Converter (svgconverter.online, the "Service") is operated by RETTER DIGITAL OÜ (registry code 17003675), Estonia ("we", "us"). We are the controller of the personal data described in this policy. Questions about privacy: kristjan.retter@gmail.com.

This policy explains what data we process when you use the website (the free PNG/JPG to SVG converter and the SVG to PNG tool) and the paid API, why, and for how long. It works together with our Terms of Use.

Your images and files

When you convert an image to SVG, or an SVG to PNG, the file is sent to our servers, converted in memory, and the result is sent back to you. We do not store your images, SVGs or results once the conversion has finished, we do not look at them, and we do not use them to train any model. Colour edits you make after converting happen in your browser.

What we collect and why

Using the website without an account

• IP address. The free converters have a daily fair-use limit per visitor. To enforce it we keep a counter keyed by your IP address, which expires after 24 hours. Legal basis: our legitimate interest in keeping the free service available and preventing abuse (GDPR Art. 6(1)(f)).
• Request logs. Our hosting provider records technical request data (such as IP address, time, URL and browser type) in short-lived logs used for security and troubleshooting. Legal basis: legitimate interest (Art. 6(1)(f)).
• Analytics. We use Plausible Analytics to count page views and feature use (for example, how many conversions are started). Plausible does not use cookies and does not collect personal data or track you across websites; we only see aggregated statistics. Legal basis: legitimate interest in improving the Service (Art. 6(1)(f)).

API accounts

• Account data. To create API keys you sign in with your email address (and, if you provide it, your name). Our sign-in provider, WorkOS, manages your account, your organization and your API keys. Legal basis: performing our contract with you (Art. 6(1)(b)). Kept while your account exists.
• API usage. We count your conversions per calendar month to apply your plan's quota and show your usage. These counters are deleted automatically after about 40 days. Legal basis: contract (Art. 6(1)(b)).
• Payments. Plans are paid through Stripe. Your card details go directly to Stripe; we never see or store them. We keep your Stripe customer reference and your current plan, and Stripe keeps the invoices and payment records. Legal basis: contract (Art. 6(1)(b)) and our legal obligation to keep accounting records (Art. 6(1)(c)); accounting records are kept for the period required by Estonian law (currently 7 years).

Emails

If you email us, we use your message and email address to answer you and keep the correspondence as long as needed for that and for our records. We send only service emails (sign-in, receipts and billing notices, sent by WorkOS and Stripe); we do not send newsletters or marketing emails.

Cookies

The converters and the rest of the public website set no cookies. When you sign in to your account, our sign-in provider sets a session cookie that keeps you signed in; it is strictly necessary for the account pages. Stripe's checkout and billing pages set their own cookies on Stripe's domain, for security and fraud prevention. We use no advertising or tracking cookies.

Service providers

We use trusted service providers (processors) to run the Service: for hosting, database, sign-in, payments, website statistics and email. They process data only on our instructions and only as needed to provide their service to us. We do not sell your personal data or share it with anyone for advertising.

International transfers

Some of our providers are based in, or process data in, the United States or other countries outside the European Economic Area. Where that happens, the transfer is protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Security

The Service is served over HTTPS only, API keys are checked on every request, and access to our systems is limited. No method of transmission or storage is completely secure, but we work to protect your data and to keep as little of it as possible.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data deleted (for example, by closing your account), unless we must keep it by law;
• restrict or object to processing based on our legitimate interests;
• receive the data you gave us in a machine-readable format (data portability).

To use any of these rights, email kristjan.retter@gmail.com. We answer within one month. You can also complain to a data protection authority; in Estonia that is the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or the authority in your own country.

Children

The Service is not directed at children, and API accounts are for adults and businesses only. We do not knowingly collect personal data from children; if you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy. We will change the effective date above, and if a change materially affects how we use your data, we will tell API customers by email before it takes effect.

Contact

RETTER DIGITAL OÜ (registry code 17003675), Estonia · kristjan.retter@gmail.com