Privacy policy

Last updated: October 13, 2026

This policy covers the PageFax website (pagefax.net) and the PageFax apps for iPhone and Android. In short: there are no accounts, no advertising and no tracking. We handle your document only to send it, and delete it from our storage when the fax finishes.

1. Who is responsible

DevCraft IT Solutions SRL, a company registered in Romania, Trade Register no. J40/753/2024, tax identification code 49418864.
Contact: contact form

That company is the “controller” of the personal data described here. Because it is established in the European Union, the EU’s General Data Protection Regulation (GDPR) applies to everyone who uses PageFax, wherever they live. For any privacy question or request, use the contact form.

2. What we handle, and why

When you send a fax

• Your document, including the cover page if you add one (with the name, phone number, subject and note you typed). It is uploaded over an encrypted connection, passed to our fax carrier to be transmitted, and deleted from our storage as soon as the fax finishes, whether or not it was delivered. An upload that is never sent is deleted within about an hour. We don’t read your documents or use them for anything other than sending them.
• The fax record: the destination number, the number of pages, the times, the result (including the identifier the receiving machine reports) and what was charged. We need it to send the fax, show you the result and receipt, handle refunds and complaints, keep our accounts and prevent misuse.

Legal basis: performing our contract with you (sending the fax you asked for); our legal obligations (keeping accounting records); and our legitimate interest in preventing fraud and unlawful faxes.

Documents sent by fax often contain sensitive information, such as health, financial or identity details, about you or about other people. We handle that content only because you ask us to transmit it, only for as long as that takes, and we take nothing from it. Please send only what the recipient needs.

When you pay on the website

Card details are entered on a payment page run by Stripe and handled by Stripe; we never see your full card number. We receive a payment reference, the amount and whether the payment succeeded. Legal basis: contract and our accounting obligations.

When you use the apps

• An anonymous identifier for your app installation or device. The apps have no login, so this is how our servers know which credit balance and which faxes are yours, and how the one free credit is limited to once per device. It is not your name, email address or phone number, and we don’t use it for advertising.
• Purchase records from the App Store or Google Play: which credit pack was bought, when, and the store’s transaction identifier. We check each purchase with Apple or Google and use the records to keep your balance and to restore it on a new phone. Apple and Google handle the payment; we never see your card.
• Your credit history: credits added, used and returned.

Some things stay on your phone and are never sent to us except as part of a fax: your fax history and its documents, the sender name and phone number you save for cover pages, and the contact you pick when you choose a fax number from your contacts (the app sees only the contact you pick). The camera and photo library are used only to add pages. The apps contain no analytics or advertising software.

Legal basis: contract, our accounting obligations, and our legitimate interest in preventing misuse of the free credit.

When you sign up for the launch email

We store your email address with the page you signed up on, the time, the version of the consent wording you agreed to, and a one-way fingerprint of your internet address (used only to limit signups per hour). We use your address to send one email asking you to confirm it and one email when PageFax launches, and for nothing else. A notice of each signup also reaches our own mailbox. Legal basis: your consent, which you can withdraw at any time with the unsubscribe link in every email or by writing to us.

When you write to us

We keep your message and our reply so we can help you and follow up. Legal basis: our legitimate interest in answering you.

Technical logs

Like any website, our hosting provider records the internet address and browser type of each request for a short time, to keep the service secure and working. Legal basis: our legitimate interest in security.

3. Cookies and what stays in your browser

We don’t use advertising or analytics cookies, so there is no cookie banner. On the website, a list of the faxes you sent, with a random key for each, is saved in your browser’s storage so that you can reopen their status and receipt; clearing your browser data removes it. Stripe’s payment page sets its own cookies to process the payment and prevent fraud.

4. Who else receives data

We use these providers, each under a contract that limits what they may do with the data:

• Telnyx (United States): the carrier that transmits the fax over the telephone network.
• Supabase: our database and the temporary storage for documents.
• Vercel (United States): hosting for the website and our servers.
• Stripe: card payments on the website.
• Resend (United States): sending our emails.
• Apple and Google: purchases in the apps, which they handle under their own privacy policies.

The fax itself, of course, goes to the number you entered. We don’t sell personal data, share it for advertising, or give it to anyone else, unless the law requires us to (for example a court order) or it is needed to investigate unlawful use of the service.

5. Transfers outside the European Union

Faxes are delivered to the United States and Canada, and several of our providers are based in the United States, so your data is processed there. For those providers we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses. You can ask us for more information about these safeguards.

6. How long we keep it

• Documents: until the fax finishes; unsent uploads for about an hour.
• Fax records, purchase records and credit history: for as long as Romanian accounting and tax law requires us to keep the records behind our income (generally five years after the end of the financial year), and no longer than we need them for that, for handling complaints, or for preventing misuse.
• Launch email list: until you unsubscribe or ask us to delete your address, and otherwise until 90 days after the launch email is sent. If you unsubscribe, we keep your address marked as unsubscribed until then, so that we don’t email you again by mistake.
• Messages to support: up to two years after the conversation ends.
• Technical logs: a few days to a few weeks, depending on the provider.

7. Security

Data is encrypted in transit between you and our servers, and documents are kept only for the time it takes to send them. Access to our systems is limited to the people who run the service. The fax itself travels over the telephone network to the recipient’s machine, like any fax, and is not end-to-end encrypted; we can’t control who collects it there. No system is perfectly secure, so if we learn of a breach that puts you at risk we will tell you and the authority as the law requires.

8. Your rights

You can ask us to:

• tell you what data we hold about you and give you a copy;
• correct data that is wrong, or delete data we no longer need or have no right to keep;
• restrict how we use your data, or object to uses based on our legitimate interests;
• give you data you provided in a portable format;
• stop using data you consented to, such as your email address, at any time.

Use the contact form. Because there are no accounts, we need something that identifies your data: the reference from a fax receipt or the email address you signed up with. For the apps, write to us and we will explain how to find the identifier of your installation. We reply within one month. Some records must be kept for accounting even if you ask us to delete them; we will tell you if that applies.

You also have the right to complain to a data protection authority: in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro), or the authority in the EU country where you live.

We don’t make decisions about you by automated means that have legal or similarly significant effects, and we don’t build profiles.

9. Children

PageFax is not meant for children, and we don’t knowingly collect data from anyone under 16. If you believe a child has given us personal data, write to us and we will delete it.

10. Changes to this policy

We will update this page when what we do changes, for example if we add a provider or a feature. The date at the top shows the latest version.