PRIVACY

Privacy Policy

Effective and last updated:

Your document files

The free tools process images and PDFs locally in your browser without uploading them. Two things are uploaded, and only when you choose them: pages you send to AI recognition, and files you keep in My files, a LensUp Pro feature. Both are described below. If you use a browser share or print action, the browser and operating system handle that action under their own controls.

Accounts, membership and payments

Free tools do not require an account. LensUp Pro and My files require a verified sign-in through an email link, or Google when offered. We store account information, session records, membership status, orders and task status. Session records include your IP address and browser/device user-agent and expire after 30 days. If you choose Google sign-in, we store your Google profile name, email and image and the authentication tokens needed for that connection.

LensUp Pro payments use Stripe Managed Payments or Waffo, depending on the provider you choose. Link is the merchant of record for Stripe Managed Payments purchases, and Waffo is the merchant of record for Waffo purchases. They handle checkout, applicable tax, transaction receipts and payment-related support. LensUp does not receive your card number. We send your account email address and account and checkout references to the selected provider to create and manage your membership. We receive the customer, order, payment and subscription identifiers, the plan, amounts, payment and refund status, billing country and renewal date. Cloudflare connection country is used to recommend a provider; you can choose either available option. Email sign-in links and the emails described below are delivered through Resend.

AI recognition

Before a page is sent to AI recognition, we show a cloud-processing notice. Image Pro sends the selected page through LensUp to Mathpix. When available, PDF Pro sends selected rendered pages through the configured model service; the tool identifies that service before use. Original PDFs are not uploaded by this flow. Temporary page images and Markdown results are stored privately on Cloudflare R2, available to the owning account for up to 24 hours, and then scheduled for deletion. Provider processing is subject to the provider's own retention policies; our 24-hour limit describes LensUp's temporary storage.

My files

My files keeps the files you choose to save, up to 500 MB each and 10 GB in total. We store each file as you uploaded it, together with its name, size and the time you saved it. Files are stored on Cloudflare R2 and encrypted at rest by Cloudflare. They are not end-to-end encrypted: LensUp can technically access them. We do not open your files unless the law requires it. We do not look inside files to decide what may be stored, and we never show them in our pages: downloads are always delivered as files.

Share links

A share link contains only a random identifier. Anyone who has the link can download the file until the link ends, you turn it off, or it is reported; copies already downloaded cannot be taken back. For each link we keep the file name at the time you shared it, its creation and end dates, how many times it was downloaded and when it was last downloaded. The page a recipient opens loads no analytics and no advertising and sends no referrer. Recipient downloads are served from files.lensup.ai through a download token that lasts at most 10 minutes.

Anyone who receives a link can report it. A report records the link, a reason chosen from a short list, the time, and an identifier computed from the reporter's IP address with a secret key. That identifier is used only to count how many different people reported links from the same account; it cannot be turned back into an IP address without our key. We email the link's owner that the link was reported, without telling them who reported it. Reports are deleted after 180 days.

Emails we send

We send emails only for your account: sign-in links; a notice when one of your share links is reported; a reminder 7 days before files in My files are deleted after a membership has ended; and a notice when they have been deleted. We do not send marketing email. These account emails are delivered through Resend in supported site languages. Transaction receipts and payment-related emails are sent by your selected payment provider, from Link for Stripe Managed Payments purchases.

Privacy mode

Members can turn on privacy mode on the account page; it is on by default. While it is on and you are signed in, LensUp pages in that browser load no advertising, no Google Analytics, no Plausible and no consent banner. To know this before a page loads its scripts, the site keeps a small lensup_privacy cookie in that browser; it is set and cleared each time your account is checked and lasts at most 35 days.

Website analytics and cookies

LensUp uses Google Analytics to understand aggregate visits and improve the site. Google may receive technical visit information such as IP address, browser, device, referring page and interaction events. Site analytics start when you open a page and continue unless you reject them, so measurement is on by default. You can reject analytics at any time through Cookie settings. Rejecting clears the analytics cookies from this device and stops both cookie-based analytics and the product interaction events, including LensUp’s own step counts described next; a cookieless measurement signal for the page view is still sent. Advertising cookies are covered separately below. Members with privacy mode on send none of this (see Privacy mode).

Plausible

We also use Plausible to measure aggregate page visits. It follows the same analytics choice: it starts only when site analytics are permitted and stops sending requests when you reject analytics. It is disabled in member privacy mode, on payment-return documents and on shared-file recipient pages. We do not enable its form, download or outbound-link tracking, or send it your files, file names, document contents or account details.

LensUp’s own step counts

To see where people give up, LensUp also counts a few steps of a visit itself: that you opened the site that day, chose a file in a tool, pressed the tool’s main button (Convert, Export and the like), were asked to sign in, saw a Pro offer, and got a result. Each step is sent to lensup.ai as a short label — the step, the tool’s name, and for your first page of the day the kind of page and the site that linked to it (or the campaign name in the link) — together with a random ID kept in a first-party cookie named lensup_vid for one year. It never includes your file, its content or its name. If you are signed in, the step is also linked to your account.

We keep at most one record per step per day, store it in our Cloudflare D1 database, do not share it with Google or anyone else, and delete it after 13 months. These counts follow your analytics choice exactly as the product interaction events do: they run only when those would, and rejecting analytics stops them and deletes the lensup_vid cookie. Members with privacy mode on send none of these step counts either.

Separately, our server keeps a few counts of how the service is used — a file saved to My files, a share link created, opened or downloaded, a checkout started — with the date and the account, never a file's name, size or contents; they are deleted after 13 months.

Advertising

LensUp shows advertising supplied by Google AdSense. Ad revenue is what keeps these tools free and free of sign-up.

Third-party vendors, including Google, use cookies, web beacons, device identifiers and similar technologies to select, deliver, measure and report on those ads. Google’s use of advertising cookies enables Google and its partners to serve ads to you based on your visit to LensUp and to other sites on the internet. These vendors — not LensUp — decide what those technologies collect, and their processing is governed by their own policies.

A current list of the vendors Google may work with, and a description of what Google collects through them, is published in How Google uses information from sites or apps that use our services.

Your choices

What advertising never receives

Free-tool documents stay in your browser. Files in My files, share links and documents submitted to AI recognition are not sent to advertising or analytics vendors. LensUp does not send an email address, phone number, name or any other directly identifying information in an ad request, and does not build or use audience lists based on health, religion, sexual orientation or other sensitive categories.

Visitors in the EEA, the UK and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, advertising and analytics cookies are set only after you give consent through the consent banner, and you can withdraw or change that consent at any time through Cookie settings. Until you choose, LensUp serves only non-personalized ads and sets no advertising cookies.

Children

LensUp is a general-audience tool and is not directed to children under 13, or the equivalent minimum age where you live. We do not knowingly collect personal information from children, and we do not use interest-based advertising on content directed to children.

Local browser storage

LensUp may store settings, consent choices and recoverable work state in your browser. This information stays on that device unless your browser synchronizes it. You can remove it with your browser's site-data controls.

Messages you send

If you contact us, we receive the address and content you provide so we can respond and investigate. Please do not send identity documents or other sensitive files.

The Feedback form in the footer works the same way, by email. A submission contains the message you typed, the category you picked, and — stated in the form itself — the address of the page you were on, the interface language, and your browser version. An email address is optional and is used only to reply to you. The submission is delivered to our inbox through Resend, a transactional email provider acting as our processor; it is not stored in any database of ours, and using the form sets no cookies. If you prefer, write to us directly instead.

Infrastructure

The site is hosted on Cloudflare Pages and served through Cloudflare’s network. As the hosting and network provider, Cloudflare processes connection data such as your IP address and request headers in order to deliver pages and to protect the site from abuse. That processing is technically necessary to serve a website at all and happens for every visitor, including one who refuses optional cookies. Cloudflare acts as our processor. We do not use Cloudflare's visitor analytics: no Cloudflare analytics script runs on our pages. Files you open in the free tools never reach Cloudflare, because they never leave your browser; files you keep in My files and pages you send to AI recognition are stored on Cloudflare R2 as described above.

How long data is kept

Account, membership, payment and credit records are kept for account operation, support and reconciliation. Sign-in links expire after 15 minutes and are consumed once; sessions expire after 30 days without renewal or are revoked on sign-out. Contact us to request account deletion or discuss a refund. We will explain any payment records that must remain before completing the request.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict processing, to withdraw a consent you gave, to receive your data in a portable form, and to opt out of the sale or sharing of personal information or of targeted advertising. To exercise any of these, email write@lensup.ai and say which right you are exercising. We do not charge for this and we will not treat you differently for asking.

Two practical notes. First, because documents on the free path are never uploaded, an access or deletion request cannot return a free-tool scan — there is nothing to return. An account can be deleted on request, and that deletes the files in My files and their share links too. Second, the fastest route for advertising and analytics is usually direct: Cookie settings in the site footer changes your choice immediately, and the vendor opt-out links above reach further than we can on your behalf.

If you are in the EEA or the UK and think we have handled your data improperly, you may also complain to your national data protection authority.

At a glance

Changes to this policy

When this policy changes materially we update the date at the top of the page. Where a change requires your consent under applicable law, we will ask for it before the change takes effect rather than relying on the updated date alone.

Contact

For a privacy question or request, email write@lensup.ai.