Legal

Privacy policy

This policy covers the Android app UCA PDF Editor (package de.ucagg.pdf), the website pdf.ucagg.de, the company panel and the partner panel.

Who is responsible (controller). the operator named in the imprint, a private individual who develops the UCA apps. Contact: noreply@ucagg.de. For company accounts the company is the controller for its employees' data and we process it on its behalf (see "Company accounts").

Your documents stay on your device

The app opens, edits, signs, stamps, scans and creates PDFs on your device. Documents, scans, page contents and file names are never uploaded to us, with one exception you start yourself: a share link (below). Your saved signatures and stamps are stored on the device, encrypted with a key in the Android Keystore. Permissions: Camera (only when you scan), Internet (check-in, company data, share links). The app uses the Android file picker, so it only sees the files you choose.

What the app sends to us

• Check-in when you open the app (or it comes back online): a random install id made by the app (not your hardware id, phone number or advertising id), app version, Android version, device class, language and install source. We store only a keyed one-way hash (HMAC) of the id, the first and last opening and a count. Purpose: counting installs, showing update notes and team messages. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). No IP address is stored with it. There is no background timer.
• Messages and reports to the developer (only when you send one): your text, an optional reply address and, if you tick it, diagnostics (app and Android version, device model). Legal basis: your request (Art. 6(1)(b)).
• Account (only if you sign in, e.g. for a company account): email address, optional name, sign-in codes (stored only as hashes, valid 15 minutes).
• Share links (only when you create one): the file is encrypted on your device (AES-256-GCM) before upload. The key is only in the link after the "#", which browsers never send to a server, so we cannot read the file or its name. We store the encrypted bytes, their size and the expiry (1-30 days), then delete them automatically. Whoever has the full link can open the file - share it carefully.

No advertising, no analytics or crash-reporting SDKs, no tracking, no selling or sharing of data.

Company accounts

When a company uses UCA PDF Editor, its company admin enters the company data (name, address, register and tax data, bank details, logo, stamp) and its employees (email, name, job title, department, phone, signing authority). Employees draw their signature in the app; it is stored on our server encrypted and only delivered to that employee's own signed-in app and shown to the company's admins. We process this data on behalf of the company under a data processing agreement (AVV, Art. 28 GDPR) that the company accepts in its panel. The company decides what is stored and when it is deleted. Employees: please contact your company for questions about your data; we help the company answer them. Document numbers (e.g. invoice numbers) are logged per company with the time and the employee, so the sequence stays gap-free.

Partners (distributors) who sell company accounts see the company data, seats and licence dates of their customers, never signatures or employees' documents.

The website

pdf.ucagg.de counts page views per page and day without storing anything about the visitor (no IP, no cookie, no user agent). Signed-in panels use a session cookie and a security cookie against forged forms. There are no tracking cookies. The web server keeps short-lived technical logs (IP, request) for security.

Where data is processed: USA

Our server is rented from IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) and runs in an IONOS data centre in Kansas City, USA. Data is therefore processed outside the European Union. The transfer is based on IONOS's data processing agreement with the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); documents in share links are end-to-end encrypted and unreadable for us and for IONOS. Emails are sent through IONOS mail servers. If you sign in, your email, name and plan are also shown in the UCA account hub at ucagg.de (same operator).

How long we keep data

• Install data with its inbox and reports: until you delete it (Settings > Delete my data) or 13 months after the app was last opened.
• Account: until you delete it (in the app or at pdf.ucagg.de/delete-data).
• Company data and employees: until the company deletes them or its contract ends (then within 30 days).
• Share links: until they expire (1-30 days) or you delete them; the size and date stay 30 more days for abuse handling.

Your rights

You can ask for access, correction, deletion, restriction, data portability and object to processing (Art. 15-21 GDPR), and complain to a data protection supervisory authority. Write to noreply@ucagg.de.

Last updated: 22. Oktober 2026 / 22 October 2026