Privacy Policy
Last updated: 2026-08-16
Summary
- Browser tools do not send your file to our server. The file stays on your device.
- Server tools receive your file only to process it. We delete it when you download the result. We always delete it within 60 minutes.
- We do not read your files. We do not analyze them. We do not share them. We do not use them to train any model.
- We measure the site with a cookieless, anonymous counter. We do not store your IP address.
- Google Analytics and personalized ads run only if you give consent.
- You do not need an account to use the tools.
Who we are
The data controller for https://devralpublic.nousworks.co is:
- Company: Nous Works
- Address: [ADDRESS]
- Email: merhaba@nousworks.co
We are established in Turkey. Turkish data protection law (KVKK, Law No. 6698) applies to all users. The GDPR applies to users in the European Economic Area. The UK GDPR applies to users in the United Kingdom.
Your files
Filewand has two kinds of tools. Each tool page shows a badge with the tool type.
Browser tools
The conversion runs inside your browser. Your file does not leave your device. Our server does not see the file, the file name, or the content. The badge shows "Runs in your browser". The free limit is 200 MB per file.
Most tools are in this group. This includes PDF merge, PDF split, image conversion, image compression, and most video and audio tasks.
Server tools
Some tasks cannot run in a browser. These tools run on our server:
- Word to PDF and PDF to Word
- Excel to PDF
- PowerPoint to PDF
- Compress PDF
- Remove PDF password
- PDF text recognition (OCR)
For these tools your file goes to our server on an encrypted connection (TLS). The server processes the file and sends the result back. The badge shows "Runs on our server". The free limit is 50 MB per file.
Our commitments for server tools:
- We use your file only for the task you requested. Legal basis: performance of a contract (GDPR Art. 6(1)(b), KVKK Art. 5/2-c).
- We delete your files when you download the result.
- If you do not download the result, we delete all files automatically. This occurs no later than 60 minutes after the upload.
- We do not write file names or file contents to logs.
- We do not back up your files. We do not share them. We do not use them to train any model.
- Our servers are in Türkiye (Turkey).
If your file contains personal data about other people, you are responsible for that data. Upload only files that you have the right to process.
What we process and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Files uploaded to the server | The conversion you requested | Contract, Art. 6(1)(b), KVKK 5/2-c | 60 minutes maximum |
| Server access logs (IP address, time, requested address, browser string) | Security, debugging, abuse prevention, legal duties | Legitimate interest, Art. 6(1)(f), KVKK 5/2-f | up to 90 days |
| Anonymous usage counter (page, tool, language, result, size band, duration band) | See which tools people use, improve the site | Designed to hold no personal data. Legitimate interest as a fallback | Totals: indefinite. Raw records: 24 hours |
| Daily salted hash (made from IP address and browser string) | Apply the free server limit, stop abuse | Legitimate interest, Art. 6(1)(f) | 24 hours, then the hash has no meaning |
| Your cookie choice | Remember your decision | Strictly necessary | 12 months, on your device |
| Google Analytics data | Visitor statistics | Consent, Art. 6(1)(a) | Google setting: 2 months |
| Advertising data (Google AdSense and its partners) | Show ads, personalize ads if you consent | Personalized ads: consent. Limited ads: legitimate interest | Google policy |
| Contact form (email, subject, message) | Answer your question | Legitimate interest | 2 years |
| Early access and newsletter email | Tell you about new tools and Pro | Consent | Until you leave. Consent record: 3 years |
| Pro records (email, license key, plan, payment reference) | Set up the subscription, provide the service, invoice you | Contract, legal obligation for invoices | While the subscription is active. Invoices: 10 years under Turkish law |
We never receive your card details. When Pro goes on sale, our payment provider will process the payments.
How we collect data
We collect data when you visit the site (automatic server logs), use a tool, fill in a form, or send us an email. For cookies and browser storage, read the Cookie Policy.
Who receives your data
We do not sell your data. These providers process data for us:
| Recipient | Purpose | Location |
|---|---|---|
| Our hosting provider | Run the site, run the server tools | Türkiye (Turkey) |
| Google Ireland Ltd | Ads, and Analytics if you consent | EU and USA |
| Email delivery service | Newsletter and account emails | Country stated by the provider |
| Payment provider (when Pro goes on sale) | Subscription payment and invoices | Country stated by the provider |
International transfers: When data leaves the European Economic Area, we use the Standard Contractual Clauses of the European Commission or an adequacy decision. When data leaves Turkey, we use the safeguards in Article 9 of the KVKK. Google Analytics and personalized ads run only if you give consent.
We can also disclose data when the law makes it necessary. An example is a court order.
Measurement
We count page views and tool usage on our own server. This counter uses no cookies. It writes nothing to your device. It does not track you across sites. It does not store your IP address. The counter receives these fields: page, tool, language, result, size band, and duration band. It does not receive the file name or the file content.
To apply the free server limit and to stop abuse, we make a hash from your IP address and browser string. The salt for this hash changes each day. The hash has no meaning on the next day. We do not write the raw IP address to disk.
If your browser sends a "Do Not Track" or "Global Privacy Control" signal, we send no data to this counter.
Children
The site is not for children under 18. If you are under 18, you need permission from a parent or guardian to buy Pro or to join the newsletter.
Security
We use TLS encryption, access control, automatic deletion, current software, and data minimization. Server jobs run in separate folders. A scheduled task deletes those folders. If a data breach occurs, we tell the supervisory authority. We tell you when the law makes it necessary.
Your rights
Under the GDPR and the UK GDPR you can do this:
- Get access to your data.
- Correct your data.
- Delete your data.
- Restrict the processing.
- Get a copy of your data (portability).
- Object to the processing.
- Withdraw your consent at any time. This does not affect the processing that occurred before.
We answer within one month. You can complain to the data protection authority in your country.
Under the KVKK (Art. 11) you can learn if we process your data, ask for information, learn the purpose, learn the recipients, ask for correction, ask for deletion, ask us to tell the recipients, object to automated decisions, and claim compensation for unlawful processing. We answer within 30 days, free of charge. You can complain to the Turkish Personal Data Protection Board.
To make a request, send an email to merhaba@nousworks.co. You can also write to [ADDRESS]. We can ask for more information to confirm your identity.
Changes
We can update this policy. We announce important changes on the site. The current version is always on this page.
Contact: merhaba@nousworks.co