Legal

Privacy policy

This English version is a courtesy translation. The German version is legally binding and prevails in case of any difference.

This policy covers the Windows app SAN PDF Plus and the website pdf.san-tga.eu.

Who is responsible (controller). the operator named in the imprint (san-tga.eu/imprint), a natural person (sole trader) who develops the SAN apps. Contact: info@san-tga.eu. For company accounts the company is the controller for its employees' data and we process it on its behalf (see "Company accounts").

Your documents stay on your device

The app opens, edits, signs, stamps, scans and creates PDFs on your device. Documents, scans, page contents and file names are never uploaded to us, with one exception you start yourself: a share link (below). Your saved signatures and stamps are stored on the device, encrypted with a key in the Android Keystore. Permissions: Camera (only when you scan), Internet (check-in, company data, share links). The app uses the Android file picker, so it only sees the files you choose.

What the app sends to us

Our own check-in sends only the data listed in the first point below. The advertising SDK in the free Android app talks to Google directly; it is covered separately under "Advertising in the free Android app".

• Check-in when you open the app (or it comes back online): a random install id made by the app (not your hardware id, phone number or advertising id), app version, Android version, device class, language and install source. We store only a keyed one-way hash (HMAC) of the id, the first and last opening and a count. Purpose: counting installs, showing update notes and team messages. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). No IP address is stored with it. There is no background timer.
• Messages and reports to the developer (only when you send one): your text, an optional reply address and, if you tick it, diagnostics (app and Android version, device model). Legal basis: your request (Art. 6(1)(b)).
• Account (only if you sign in, e.g. for a company account): email address, optional name, sign-in codes (stored only as hashes, valid 15 minutes).
• Share links (only when you create one): the file is encrypted on your device (AES-256-GCM) before upload. The key is only in the link after the "#", which browsers never send to a server, so we cannot read the file or its name. We store the encrypted bytes, their size and the expiry (1-30 days), then delete them automatically. Whoever has the full link can open the file - share it carefully. When employees create a link in company mode we also store who created it and - only if the app sends one - a label (e.g. the file name); the company admin sees both in the company panel.
• Company certificates and signature checks (employees of a company only): for the certificate we store the name, email, company and the public key (the private key stays on the device). After signing, the app sends the serial number and a check value (SHA-256) of the signed content - never the document. The check page /verify computes in the browser and also sends only the serial and the check value. Time-stamp requests contain only a check value. Legal basis: Art. 6 (1) (b) GDPR (contract with the company) or (f) (authenticity checks).

No analytics or crash-reporting SDKs and no selling of data. The Windows app shows no advertising.

Advertising in the free Android app

The free version of the Android app shows a small number of ads (a banner on the home screen, and at most one full-screen ad after a finished export or share). We never show ads while you view, edit, sign or scan. The ads come from Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). For this, Google processes your device's advertising ID, the IP address, approximate location derived from it, device and app information, and diagnostic data about the ads.

• Consent first: to show any ad - personalised or not - the Google Mobile Ads SDK stores and reads information on your device. Under § 25 (1) TDDDG this needs your consent. On first start the app therefore shows Google's consent dialog (User Messaging Platform, IAB TCF) before ads are requested.
• Your choices in the dialog: personalised ads (selected using your advertising ID and interests), non-personalised ads (only the context, plus frequency capping, fraud prevention and reporting), or no consent. Without consent to storage on your device Google may only serve limited ads that use no advertising ID and no on-device storage for advertising. You can change or withdraw your choice at any time in Settings > "Datenschutz-Einstellungen für Werbung", and reset or delete the advertising ID in Android's settings.
• Legal basis: your consent - § 25 (1) TDDDG for storing and reading information on the device, Art. 6 (1) (a) GDPR for the processing of the data. Withdrawing it does not affect processing before the withdrawal.
• Transfers: Google may process data in the USA, based on the EU-US Data Privacy Framework and the Standard Contractual Clauses. Google's privacy policy: policies.google.com/privacy.
• 24 h without ads: you can choose to watch a rewarded video ad; after it the app shows no ads for 24 hours. The same consent choice as above applies; the app only remembers the time on the device.
• No ads at all with SAN PDF Plus (Google Play): the app then stops loading ads.

SAN PDF Plus (Google Play subscription)

When you buy SAN PDF Plus in the Android app, Google Play handles the payment; we never see your payment details. We store the purchase token, the product, its state and expiry, linked to your signed-in account, so that Plus also works on your Windows PC. Legal basis: the contract (Art. 6 (1) (b)). Kept while the subscription runs plus the legal retention periods.

Payments: Dodo Payments (merchant of record)

Business seats and Windows licences are sold through Dodo Payments (Dodo Payments Inc., 8 The Green, Ste A, Dover, Delaware 19901, USA, with its group companies), which acts as merchant of record: Dodo is the seller of record, takes the payment, issues the invoice and handles VAT and refunds. You enter your payment details directly in Dodo's checkout; we never see card or bank details. Dodo is a recipient of your data and processes it as an independent controller for the payment, invoicing, tax and fraud checks under its own privacy policy (dodopayments.com). We pass Dodo the buyer's email address and name or company name, the product and, for plans, our internal company number; Dodo tells us the payment or subscription status, its customer id and the billing dates, which we store with the company or the licence. Legal basis: the contract (Art. 6 (1) (b) GDPR) and legal retention duties (Art. 6 (1) (c) GDPR, § 147 AO, § 257 HGB). Dodo processes data in the USA and other countries outside the EU. The transfer is based on Art. 49 (1) (b) GDPR (necessary to perform the purchase contract) or on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) that Dodo uses; see its privacy policy.

Company accounts

When a company uses SAN PDF Plus, its company admin enters the company data (name, address, register and tax data, bank details, logo, stamp) and its employees (email, name, job title, department, phone, signing authority). Employees draw their signature in the app; it is stored on our server encrypted and only delivered to that employee's own signed-in app and shown to the company's admins. We process this data on behalf of the company under a data processing agreement (AVV, Art. 28 GDPR) that the company accepts in its panel. The company decides what is stored and when it is deleted. Employees: please contact your company for questions about your data; we help the company answer them. Document numbers (e.g. invoice numbers) are logged per company with the time and the employee, so the sequence stays gap-free.

For business seats we store the email addresses (and optionally names) the business admin gives a seat to, so the program can unlock Pro. The admin can remove them at any time.

The website

pdf.san-tga.eu counts page views per page and day without storing anything about the visitor (no IP, no cookie, no user agent). There are no tracking cookies. Only these are strictly necessary (§ 25 (2) no. 2 TDDDG):

• sanpdf_csrf - a security cookie against forged forms, for all visitors, 30 days;
• sanpdf_s - the session cookie after signing in (account, business panel), 30 days or until you sign out;
• lang - only if you pick the language with the DE | EN switch or a link with ?lang=, 1 year;
• your choice of light / dark / system is kept by your browser (localStorage "san-theme") and never sent to us.

The web server keeps technical logs (IP address, time, request, status code) for security and troubleshooting (Art. 6 (1) (f) GDPR); they are rotated and deleted automatically.

Where data is processed: USA

Our server is rented from IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) and runs in an IONOS data centre in Kansas City, USA. Data is therefore processed outside the European Union. The transfer is based on IONOS's data processing agreement with the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); documents in share links are end-to-end encrypted and unreadable for us and for IONOS. Emails are sent through IONOS mail servers. Messages from the contact form and abuse reports for share links arrive by email and in our admin; we use them only to handle the matter and delete them when it is closed. If you sign in, your email, name and plan are also shown in the SAN account hub at san-tga.eu (same operator).

How long we keep data

• Install data with its inbox and reports: until you delete it (Settings > Delete my data) or 13 months after the app was last opened.
• Account: until you delete it (in the app or at pdf.san-tga.eu/delete-data).
• Company data and employees: until the company deletes them or its contract ends (then within 30 days).
• Share links: until they expire (1-30 days) or you delete them; expired files 24 more hours (with a storage add-on booked before, up to 30 days) for a reactivation; the size and date stay 30 more days for abuse handling.
• Company certificates, serial numbers and check values of signed documents: as long as documents should stay verifiable, at most 10 years after the certificate expired; revoked certificates stay verifiable as "revoked".

Right to object (Art. 21 GDPR)

Where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR) - above all the app check-in when it opens (counting installs, update notes, team messages) and the technical server logs - you have the right to object at any time on grounds relating to your particular situation. We then stop processing the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You end the check-in yourself right away by choosing "Delete my data" in the app and uninstalling it; for anything else a message to info@san-tga.eu is enough.

Your rights

You can ask for access, correction, deletion, restriction, data portability and object to processing (Art. 15-21 GDPR), and complain to a data protection supervisory authority. Write to info@san-tga.eu.

Last updated: 23 October 2026