OmniConvert

Privacy Policy

Last updated: 5 November 2026

Coast Solutions OÜ("we") operates OmniConvert and is the controller of the personal data described here. This policy lists everything we collect, why, and for how long.

Your files

Uploaded files and pasted text are processed in server memory to produce the converted file, which is sent back to your browser. Files are never written to disk, stored in a database, or shared. When the conversion finishes, nothing of the file is kept. The one exception is a failed conversion: the error message we record can quote a short part of the input, as described under "Usage statistics" below.

What we store

  • Credit purchases. When you buy credits we store a random token, your credit balance, the Stripe session ID, the email address you gave Stripe, and the purchase and last-use times. The token is also included in the description of your Stripe payment, so it appears on your receipt email and lets you recover your credits.
  • Daily free allowance. To count free conversions per day, we store a SHA-256 hash of your IP address (not the address itself) with the date and the number of conversions used that day.
  • Abuse protection. To enforce the fair-use limit of 30 free conversions per hour, your IP address is kept in server memory for one hour. It is not written to the database.
  • Usage statistics.For each conversion we record which conversion was used, whether it was free or paid, and when. When a free limit is reached, we record which one and the file size. When a conversion fails, we also record the file extension, the file size, a short label for the kind of file (worked out from its first bytes, such as "gzip" or "starts with a digit"), and the error message, cut to 500 characters. The error message can quote a short part of the input, such as the text around a JSON error, the field names found in the file, or the coordinate system definition of a shapefile. These records contain no IP address or file name, and are not linked to you.
  • Hosting logs. Our hosting provider keeps standard request logs (IP address, time, requested URL, response code) for operations and abuse prevention.

Analytics and cookies

We use Google Analytics for Firebase to understand how the site is used: pages visited, approximate location, device and browser, referrer, and events such as starting a conversion (with the conversion type and file size) or completing a purchase (with its amount). Credit tokens are removed from page addresses before they are sent. Google Analytics sets first-party cookies such as _ga, so it only loads after you click "Accept" in the cookie banner. If you decline, no analytics cookies are set and no analytics data is sent. You can change your choice at any time under "Cookie settings" in the footer.

In your browser's local storage we keep your credit token (so you stay signed in to your credits without an account), your cookie choice, your light or dark theme choice, and when we last asked you to share OmniConvert.

Who processes data for us

  • Railway (Railway Corporation, USA): hosting of the website and conversion servers, in its EU West region (Amsterdam, Netherlands).
  • Google (Google Ireland Limited / Google LLC): the database (Firebase Firestore) and Google Analytics.
  • Stripe (Stripe Payments Europe Ltd.): payments. Card details go directly to Stripe and never reach our servers.

Some of these providers process data outside the European Economic Area. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Legal basis

We process purchase data to provide the credits you bought (performance of a contract, Art. 6(1)(b) GDPR) and keep payment records as accounting law requires (Art. 6(1)(c)). The daily allowance, abuse protection and usage statistics are based on our legitimate interest in offering a free service without abuse and improving it (Art. 6(1)(f)). Google Analytics is based on your consent (Art. 6(1)(a)), which you can withdraw at any time.

How long we keep it

  • Credit records: as long as the token exists, or until you ask us to delete it.
  • Daily allowance records: they only ever hold the latest day's count and are overwritten when you next convert.
  • Payment records: as long as Estonian accounting law requires (generally 7 years).
  • Usage statistics, including failed-conversion records, are not linked to any person and are kept for statistics and to fix errors.

Your rights

You can ask for access to, correction or deletion of your personal data, restrict or object to its processing, and ask for a copy of it. Email info@coastsolutions.ee; for credit records, include your token. You can also complain to a data protection authority, in Estonia the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Contact

Coast Solutions OÜ
Pärnu mnt. 139b-14
11317 Tallinn, Harju
Estonia
info@coastsolutions.ee