Privacy Policy
Last updated: May 21, 2025
Scope
html2astro is a client-side application. All file processing happens in your browser. We do not store or transmit your HTML files or any content derived from them to our servers.
Data We Collect
| Category | Details | Legal basis* |
|---|---|---|
| Conversion files | The HTML / ZIP files you upload are processed on our serverless backend and deleted automatically within 24 h. No human review. | Contract (Art 6 (1)(b) GDPR) |
| Payment data | When you donate via Buy Me a Coffee we receive a transaction ID and the amount; card data is handled solely by the payment processor. | Legitimate interest & Contract |
| Usage analytics | We use Google Analytics 4 to collect anonymised metrics (device, browser, pages viewed, conversion timestamps). IP addresses are truncated (IP-anonymisation). | Consent (Art 6 (1)(a)) |
| Essential cookies | CSRF token, session preference (e.g. dark mode) – required for the app to work. | Legitimate interest |
| Analytics cookies | _ga and related GA4 cookies – set only after consent via the cookie banner. | Consent |
*If you are outside the EU, the same practices apply even where GDPR is not mandatory.
How We Use the Data
- Perform conversions and return the Astro project you requested.
- Process voluntary donations via Buy Me a Coffee.
- Improve the Site through aggregated usage statistics (GA4).
- Detect abuse (rate-limiting, malware scanning).
We do not use your upload contents for marketing, training AI models, or any secondary purpose.
Data Retention
| Data | Retention |
|---|---|
| Uploaded ZIP / extracted files | Deleted automatically 24 hours after conversion (cron job). |
| Analytics events (GA4) | 14 months. |
| Donation records | 7 years (tax and accounting). |
Third-Party Recipients
| Service | Purpose | Location & safeguards |
|---|---|---|
| Cloudflare R2 | Temporary file storage during conversion | Data centres in the region closest to the user; S3-compatible encryption-at-rest. |
| Google Analytics 4 | Usage analytics | EU → US transfer under EU-U.S. DPF; IP anonymisation enabled. |
| Buy Me a Coffee | Payment processing | PCI-DSS compliant; we receive only transaction metadata. |
Your Rights (GDPR / UK GDPR)
You may:
- Access the personal data we hold about you
- Object to processing based on legitimate interest
Submit requests to @seventhseven. We respond within 30 days.
Cookie Management
- The first visit shows a banner with “Accept analytics cookies” / “Reject”.
- Essential cookies cannot be disabled but contain no personal identifiers.
- You can also delete cookies via your browser settings.
Changes to This Policy
We may update this Policy periodically. The “Last updated” date will change, and major revisions will be announced on the Site’s changelog.