Legal

Privacy Policy

Last updated: October 21, 2026

This policy explains what ImageToText.online collects when you use the site, why we collect it, and which other services receive it. If anything here is unclear, email us at support@imagetotext.online.

In short

  • To read the text in a file, we send the file to our text-recognition (OCR) service. Word and PowerPoint files go to SpinPDF first, to be turned into PDFs.
  • We use Google Analytics to see how the site is used. In the UK, the EU/EEA and Switzerland it sets cookies only after you choose Accept.
  • Stripe handles payments. We never see or store your card number.
  • We don't show ads, we don't record your screen, and we don't sell your personal information.

What we collect

  • The files you convert, and the text found in them. See "The files you convert" below.
  • Account details, if you create an account: your first and last name, your email address and your password. We store the password only in a scrambled form (a hash) that can't be turned back into the password.
  • Plan and payment records, if you buy a plan: which plan you have, when it renews, your token balance and a record of your payments. Your card details stay with Stripe.
  • Technical data. Like any website, our servers receive your IP address, your browser and device type, and the pages you ask for. We use your IP address to give out the free daily allowance fairly, to limit how many requests one visitor can send, and to block abuse.
  • Usage data, through Google Analytics and our own visit counter. See "Analytics" below.

The files you convert

When you convert a file, your browser sends it to our server. Our server checks it (its type and size, and that the request isn't from a bot), then sends it to our text-recognition (OCR) service. That service reads the text and sends it back, and we show it to you.

Word and PowerPoint files (DOC, DOCX, ODT, RTF, PPT, PPTX and ODP) are first sent to SpinPDF, an online file-conversion service, which turns them into a PDF. The PDF then goes to our text-recognition service.

When you copy the text, or download it as a TXT, Markdown, CSV, Word, Excel or ZIP file, that file is made in your browser, not on our servers.

Google Analytics and our own visit counter never receive your file, its name or its text.

Please don't upload a document you aren't allowed to share with an outside service.

Analytics

We measure how the site is used so we can find problems and decide what to improve. We don't use this for advertising.

Google Analytics

We use Google Analytics 4, which our site loads through Google Tag Manager. It records the pages you view, how you arrived (for example from a search engine or a link), your approximate location, your device and browser, and how you use the pages, such as scrolling, clicking links to other sites and downloading files.

It also records the steps of a conversion: adding a file, a file being refused, starting a conversion, getting the result, a failed conversion, running out of tokens, and copying or downloading the result. It records viewing prices, starting a checkout, completing a purchase, signing up and signing in too. For these steps it receives only categories, such as the file type, a size range, a page-count range, the tool you used and the plan you picked. It never receives your file, its name, the text found in it or your email address.

We have switched off Google signals and user-provided data collection. This means Google Analytics doesn't combine your visits with your Google account, and it doesn't collect email addresses, phone numbers or names from our pages. Email addresses and sign-in codes are also removed from page addresses before they are stored. Advertising features are off. Google Analytics deletes its detailed data about each visit after 14 months.

Your choice about Google Analytics

If you are in the UK, the EU/EEA or Switzerland, a banner asks you first. Until you choose Accept, Google Analytics sets no cookies. It may still send Google a basic signal without cookies, for example that a page was viewed, which can't be used to link one visit to the next (Google Consent Mode). If you choose Reject, it stays that way, and we delete any Google Analytics cookies already in your browser.

Everywhere else, Google Analytics runs when you visit, with its cookies.

Wherever you are, you can change your choice at any time with "Cookie settings" at the bottom of every page.

Our own visit counter

We also count visits with our own visit counter, which sends to our own server and sets no cookies. It sends the page, the site that sent you, any campaign tags in the link, your screen size and time zone, and the name of each conversion step without any details. From your connection, our server works out your country, device type and browser. To count unique visitors, it turns your IP address and browser into a code that changes every day. Your IP address itself is not stored. Because it stores nothing on your device and nobody else receives the data, it runs for every visitor.

No session recording

We don't use session-recording tools. Nothing on this site records your screen, your clicks and typing, or the files you upload.

Cookies and storage in your browser

  • Needed for the site to work: keeping you signed in, remembering your cookie choice and, for the current visit only, your country, so we know whether to show the cookie banner. These are kept in your browser's storage, not in cookies.
  • Preferences: your light or dark theme.
  • Analytics: the Google Analytics cookies, whose names start with _ga, set only as described above.

We don't use advertising cookies. You can clear or block cookies and site data in your browser. If you clear site data, you'll be signed out.

Payments

Plans are paid through Stripe. You type your card details on Stripe's own checkout page, not on our site, and you manage your subscription on Stripe's billing page. Stripe receives your payment details, your email address, the plan you chose and the ID of your account with us (a random code, not your name). From Stripe we receive whether a payment worked, which plan it was for, when it renews, and any refund or cancellation. We never see or store your full card number. Stripe's privacy policy covers what Stripe does with your payment data.

Purchases and Google Analytics

If Google Analytics is allowed for you when you start a checkout (see "Your choice about Google Analytics"), we send your Google Analytics IDs with the order. These are random numbers stored in the Google Analytics cookies, not your name or email address. Stripe keeps them with your purchase or subscription, so that our server can report the purchase, later renewals and any refund to Google Analytics, with details such as the amount, the currency, the plan and an order number, and connect them to the visit that led to them. If Google Analytics is not allowed, no IDs are sent and the purchase is never reported to it.

If you choose Reject while signed in, or sign in after choosing it, we note that on your account. From then on, our server reports none of your purchases, renewals or refunds to Google Analytics, including ones you started earlier. Choosing Accept while signed in turns it back on.

Payment, usage and dispute records

To take payments, prevent fraud and answer payment disputes, we keep:

  • your account details (name and email address) and when you created your account;
  • when you signed in, with the IP address and browser information used;
  • your purchases and subscription history: plan, amounts, dates and receipts;
  • when tokens were added to your account and when you used them;
  • the billing emails we sent you.

Payments are processed by Stripe, as described above; we never see or store your full card number. Stripe records details of each payment, such as the IP address and device used, to process it and prevent fraud. When you start a checkout, we also send Stripe the IP address and browser information you used, with the order. Emails are sent through SendGrid.

We keep these records while your account is open and for up to 24 months after your last payment, then delete them unless the law requires us to keep them longer (for example, tax records). We rely on our legitimate interest in preventing fraud and in establishing, exercising or defending legal claims (GDPR Art. 6(1)(f)).

To ask about these records or anything else in this policy, contact support@imagetotext.online. Our Refund Policy explains how we handle refund requests and payment disputes.

Cloudflare

Our site runs behind Cloudflare, which delivers the pages and protects the site from attacks. Every request to the site passes through Cloudflare, so Cloudflare handles your IP address and the details of each request. When you add your first file, Cloudflare Turnstile checks that you are a person and not a bot, using information from your browser and device. Our pages also ask Cloudflare for your country, to decide whether to show the cookie banner.

Emails

We send account emails, such as email verification and password resets, and billing emails, such as receipts, through SendGrid, an email delivery service. SendGrid receives your email address and the message.

Services that receive your data

  • Our text-recognition (OCR) service: the files you convert, to read the text.
  • SpinPDF: Word and PowerPoint files, to turn them into PDFs.
  • Google (Google Analytics, loaded through Google Tag Manager): usage data, as described above.
  • Stripe: payment details, your email address and your plan, to take payments.
  • Cloudflare: every request to the site, to deliver and protect it, and the bot check.
  • SendGrid: your email address, to send account and billing emails.

We do not sell your personal information.

How long we keep data

We keep personal information only as long as we need it for the purposes in this policy, or longer where the law requires it. Account details are kept until you ask us to delete your account. Payment, usage and dispute records are kept as described in "Payment, usage and dispute records" above. Google Analytics deletes its detailed data after 14 months.

Your rights

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account and the information linked to it. Email support@imagetotext.online from the address on your account. You can change your Google Analytics choice at any time with "Cookie settings".

Data security

We take the security of your personal information seriously and use appropriate measures to protect it against unauthorized access, loss or alteration. However, no way of sending or storing data over the internet is completely secure, so we cannot guarantee absolute security.

Children's privacy

Our services are not intended for children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you believe we have collected personal information from a child under 13, please contact us, and we will remove it from our records.

Changes to this policy

We may update this policy when our practices or legal duties change. When we do, we publish the new version on this page and change the date at the top.

Contact us

For any question or request about this policy or your personal information, email support@imagetotext.online.