Privacy Policy

1. About This Policy

Irreva (“we”, “us”, or “our”) operates the website at irreva.com and associated domains including any future custom domains (collectively, the “Service”). This Privacy Policy describes what personal information we collect, how we use it, who we share it with, how long we keep it, and the rights available to you.

This policy applies to all visitors and users of the Service regardless of location. Additional rights applicable to users in the European Economic Area (EEA), United Kingdom (UK), and California are detailed in their respective sections below.

Core principle — browser-based processing: All file processing on Irreva runs entirely in your web browser using client-side JavaScript, WebAssembly, and browser APIs. Files you process with our tools — images, PDFs, documents, code, and text — are never uploaded to Irreva's servers. They remain on your device at all times and are not accessible to us.

2. Data Controller

For the purposes of applicable data protection law (including GDPR and UK GDPR), the data controller is:

Where Google Analytics processes data on our behalf, Google Ireland Limited acts as a data processor under a Data Processing Agreement consistent with GDPR requirements.

3. Information We Collect

3.1 Analytics Data (Google Analytics 4)

When you grant analytics consent, we use Google Analytics 4 (GA4) to collect aggregated, anonymised usage data. GA4 collects:

• Pages visited and navigation paths within the Service
• Approximate geographic location derived from IP address (country and city level)
• Device type, operating system, browser type and version
• Screen resolution and language settings
• Session duration, bounce rate, and engagement events
• Referral source (the website or search engine that led you to Irreva)
• Custom events such as tool interactions (e.g., “image compressed”, “PDF merged”)

IP addresses are truncated by GA4 before storage. We have enabled IP anonymisation (anonymize_ip: true). GA4 data is associated with a randomly assigned browser identifier, not with any personally identifiable information. Data is collected only after you grant consent via our cookie banner. If you decline analytics consent, no GA4 tracking occurs.

Google's role: Google Ireland Limited processes analytics data as a data processor on our behalf. Google may transfer this data to servers in the United States under Standard Contractual Clauses. Google Privacy Policy.

3.2 Infrastructure Logs (Vercel Hosting)

Irreva is hosted on the Vercel platform (Vercel Inc., 340 Pine Street, Suite 900, San Francisco, CA 94104). As an inherent part of serving web traffic, Vercel's infrastructure may retain standard server access logs including:

• IP addresses of connecting devices
• Request timestamps and HTTP method
• Requested URLs and HTTP response codes
• Referrer and User-Agent header strings
• Edge network routing and CDN cache status

Vercel processes this data as an infrastructure provider under its own privacy policy and data processing agreements. Vercel Privacy Policy.

3.3 Cookies and Browser Storage

We use cookies, localStorage, and sessionStorage as described in our Cookie Policy. Storage is categorised as Essential, Analytics, Functional, or Advertising. You control non-essential categories via our cookie preference centre.

3.4 Contact Form Submissions

If you submit a message via our contact page, we collect your name, email address, and message content. This information is used solely to respond to your inquiry. We do not use contact submissions for marketing, share them with third parties, or retain them beyond the period reasonably necessary to resolve your inquiry.

3.5 Advertising Data (Google AdSense — Future)

Irreva does not currently serve advertisements. We intend to integrate Google AdSense in the future to support the platform's ongoing free availability. When advertising is enabled:

• Google AdSense will set advertising cookies (__gads, _gcl_au) only if you have granted advertising consent
• These cookies are used by Google to serve relevant advertisements and measure campaign performance
• AdSense may use your browsing history across websites to show interest-based advertisements
• We will update this Privacy Policy and re-request consent before activating advertising
• You may opt out of interest-based advertising at any time via Google's Ad Settings

3.6 Affiliate Tracking (Future)

Irreva may in the future participate in affiliate marketing programmes. When affiliate tracking is enabled, clicking an affiliate link from Irreva may set a tracking cookie or append a tracking parameter to the destination URL to attribute any resulting purchase to Irreva. This data is processed by the affiliate network, not by Irreva directly. Any affiliate relationship will be clearly disclosed at the point of the link as required by applicable advertising disclosure regulations (including FTC guidelines and UK ASA rules).

3.7 Files You Process With Our Tools

We do not collect, receive, or store any files you process with Irreva tools. Images, PDFs, documents, code, and text you work with are processed entirely within your browser's JavaScript runtime. No file data is transmitted to Irreva's servers, Vercel's infrastructure, or any third party. This applies to every tool including the Background Remover, PDF Compressor, Image Converter, OCR tool, JSON Formatter, and all others listed on the Service.

Exception — AI Grammar Checker: This tool sends the text you enter to the LanguageTool public API for grammar and style analysis. LanguageTool processes this text under their own privacy policy. Do not submit confidential, sensitive, or personally identifying text to this tool. LanguageTool Privacy Policy.

4. How We Use Your Information

We do not sell personal information to third parties. We do not use personal data to build individual advertising profiles outside of consented advertising networks. We do not make automated decisions that produce legal or similarly significant effects on individuals.

5. Third-Party Services and Data Processors

6. Data Retention

7. Your Rights — European Users (GDPR)

If you are located in the European Economic Area (EEA), the General Data Protection Regulation (GDPR) applies and grants you the following rights:

To exercise any right, contact us at privacy@irreva.app. We will respond within 30 days. For complex requests we may extend this by a further 60 days, notifying you within the initial 30-day period.

8. Your Rights — California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, purposes, and third parties with whom it is shared.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information as defined under CCPA/CPRA. No opt-out is currently required, but you may contact us to confirm.
• Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined under CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right.

Categories of personal information collected: Identifiers (truncated IP address via GA4), internet or electronic network activity (page views, browser type, event data via GA4), and geolocation data (approximate location from IP via GA4). No sensitive personal information is collected.

Do Not Sell or Share My Personal Information: We do not sell or share personal information. If you wish to submit a request or confirm this, contact us at privacy@irreva.app or use our contact form.

9. International Visitors and Data Transfers

The Service is operated from servers hosted globally on the Vercel network. If you access Irreva from outside the United States, your data (specifically: infrastructure logs processed by Vercel and analytics data processed by Google) may be transferred to and processed in the United States or other countries where our service providers maintain infrastructure.

These countries may have data protection laws that differ from those of your jurisdiction. Where required, we rely on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs): Used by Google and Vercel for transfers from the EEA/UK to the United States.
• Adequacy Decisions: Where the European Commission has issued an adequacy decision for the destination country.
• Consent: For transfers based on your explicit consent as provided via our cookie preference centre.

EEA/UK users: By accepting analytics or advertising cookies, you explicitly consent to the associated cross-border data transfers described in this section and in Section 5.

Other international users: Privacy laws in your country may differ significantly. We serve all users through Google Consent Mode v2, which defaults all tracking signals to “denied” until you actively consent.

10. Children's Privacy

The Service is not directed to children under the age of 13 (or 16 where applicable under local law, such as in certain EU member states). We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take immediate steps to delete it. If you are a parent or guardian and believe your child has provided personal information to us, please contact us at privacy@irreva.app.

11. Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. These include:

• HTTPS encryption for all data in transit (TLS 1.2+)
• Vercel's edge network security including DDoS protection
• Minimal data collection by design — we cannot lose files we never received
• Consent-gated analytics — tracking only activates after explicit user consent

No method of transmission over the internet is 100% secure. In the event of a personal data breach that is likely to result in a risk to individuals' rights, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33.

12. Advertising and Affiliate Disclosure

Advertising: Irreva is currently free and ad-free. We plan to introduce advertising via Google AdSense to support continued platform development. When this occurs, we will update this policy and present fresh consent notices. Advertisements will only appear after advertising consent is granted.

Affiliate marketing: Irreva may in the future earn commissions by linking to third-party products or services. All affiliate relationships will be clearly marked with a disclosure label (e.g., “Affiliate link” or “Ad”) at the point of the link, in compliance with FTC 16 C.F.R. Part 255 (US), UK CAP Code (UK), and relevant EU consumer protection regulations.

13. Do Not Track

Some browsers transmit a “Do Not Track” (DNT) signal. Currently there is no universally accepted standard for how websites should respond to DNT signals. We do not currently alter our data collection practices in response to DNT signals. Our Google Consent Mode v2 implementation ensures that no tracking occurs until you affirmatively grant consent, which provides equivalent or stronger protection than DNT signals in most jurisdictions.

14. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or new features. When we make material changes — particularly changes that affect how we process personal data or that require fresh consent (such as enabling advertising) — we will:

• Update the “Last updated” date at the top of this page
• Display a renewed consent banner where legally required
• Post a prominent notice on the Service for significant changes

We encourage you to review this policy periodically. Continued use of the Service after non-material changes are posted constitutes your acknowledgement of the updated policy.

15. Contact and Data Subject Requests

For privacy-related questions, data subject access requests, consent withdrawal, or any concerns about how we handle your data: