Last updated: October 21, 2026
Evan Davison, entrepreneur individuel (trading as DVS Web), SIRET 100 077 247 00029, 1 Esplanade Christian Hauvette, 35135 Chantepie, France. Contact for any question about your data: contact@squishconvert.com.
Common image conversions (JPG, PNG, WebP, GIF, BMP, SVG or HEIC to JPG, PNG, WebP or BMP; HEIC to JPG, PNG or WebP only) and image compression run in your browser: the file is not sent to us. Everything else is listed below.
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Account | Email, hashed password; name and profile picture if you sign in with Google or Apple | Performance of the contract (art. 6(1)(b)) | Until you delete the account, or 3 years without activity (email warning 30 days before) |
| Conversion history | File name, formats, sizes and date of each conversion, including in-browser ones | Performance of the contract (showing your history) | 12 months, deletable at any time in Settings |
| Usage counters and quotas | Number of conversions per month; for visitors without an account, a counter in the sc_anon_usage cookie | Performance of the contract; legitimate interest (limiting free use) | While the account exists; until the end of the day for the cookie |
| Files to convert (server conversions) | Your file, and the password for PDF protection | Performance of the contract | Deleted by CloudConvert after conversion, within 24 hours at most. Not stored by us |
| AI tools (background removal, OCR) | Your image or PDF | Performance of the contract | Not stored by us. OpenAI may keep API data up to 30 days to detect abuse |
| AI chat (signed-in users) | Your last 10 messages, without your name or email | Legitimate interest (helping users) | Not stored by us. OpenAI may keep API data up to 30 days to detect abuse |
| Subscription and payment | Email, plan, Stripe customer and subscription IDs, consent ticked before payment (date, text, terms version), withdrawals | Performance of the contract; legal obligation (consumer law, accounting) | Plan and Stripe IDs while the account exists. The consent ticked before payment and any withdrawal are kept 5 years, even after the account is deleted, as proof of the contract. When you delete your account, all its subscriptions are cancelled and your Stripe customer record is deleted; Stripe keeps the invoices for 10 years (accounting law). Card details are handled by Stripe only |
| Record of account deletions | Opaque account identifier, date, and who triggered the deletion (you or the inactivity purge). No email or name | Legal obligation and legitimate interest (proving the deletion was done) | Kept as proof of the deletion; once the account is gone, the identifier no longer points to anyone |
| Transactional emails | Email address, content of the message (purchase confirmation, withdrawal, renewal reminder, account deletion) | Performance of the contract; legal obligation | Sent through Resend; not used for marketing |
| Last activity | Date of your last visit while signed in (sc_active_day cookie, user_activity table) | Legitimate interest (deleting inactive accounts) | While the account exists |
| Audience measurement | Pages viewed, device, approximate location, Google Analytics identifiers | Consent (cookie banner), which you can withdraw at any time | Cookies 13 months; your choice is asked again after 6 months |
| Audience measurement without cookies | Pages viewed, referrer, country, device type and browser (Vercel Web Analytics); the visitor identifier is a hash renewed every day and never stored | Legitimate interest (knowing which pages are visited) | Aggregated statistics only |
Email and password are required to create an account; without them we cannot provide it. Name and picture only come from Google or Apple if you choose to sign in with them.
We do not sell your data and show no ads. Our providers act on our instructions:
| Provider | Role | Location | Transfer safeguard |
|---|---|---|---|
| Vercel Inc. | Hosting of the site and its server functions, audience measurement without cookies | United States | EU-US Data Privacy Framework |
| Supabase Inc. | Database and authentication | United States company, data in the region of our project | Standard contractual clauses (Supabase DPA) |
| Stripe Payments Europe Ltd | Payment and subscriptions | Ireland (EU) | No transfer outside the EU required |
| Lunaweb GmbH (CloudConvert) | Server file conversions, PDF protection | Germany (EU) | None needed |
| OpenAI | Background removal, OCR, AI chat | United States | Standard contractual clauses (OpenAI DPA) |
| Resend | Transactional emails | United States | Standard contractual clauses (Resend DPA) |
| Google Ireland Ltd / Google LLC | Google Analytics (if you accept), Google sign-in (if you use it) | Ireland, United States | EU-US Data Privacy Framework |
| Apple Inc. | Sign in with Apple (if you use it) | United States | EU-US Data Privacy Framework |
| Name | Purpose | Duration |
|---|---|---|
| sb-*-auth-token | Keeps you signed in (essential) | Until you sign out, refreshed while you use the site |
| sc_anon_usage | Counts free conversions without an account (essential) | Until the end of the day |
| sc_active_day | Records your last activity at most once a day (essential) | 1 day |
| cookie-consent (browser storage) | Remembers your cookie choice and its date (essential) | 6 months |
| _ga, _ga_* | Google Analytics, only if you accept | 13 months |
Essential cookies do not require consent. Google Analytics only loads after you click “Accept”. You can change your choice at any time with the “Cookie settings” link at the bottom of each page; refusing removes the Google Analytics cookies. Vercel Web Analytics uses neither cookies nor browser storage, so it is not affected by this choice.
You can access, correct, delete or export your data, object to processing based on legitimate interest, restrict processing, and withdraw your consent at any time. You can also give instructions on what happens to your data after your death.
In Settings you can delete your conversion history and your account yourself; deleting the account also cancels your subscriptions and deletes your Stripe customer record. For any other request, write to contact@squishconvert.com; we answer within one month.
You can file a complaint with the CNIL (French data protection authority): www.cnil.fr.
You must be at least 15 years old to create an account.
Connections are encrypted (HTTPS). Access to the database is restricted by row-level security rules, and only the publisher has administrator access. Payment card data never reaches our servers.