Personal data protection
Regulation (EU) 2016/679 (GDPR) and the Luxembourg law of 1 August 2018. Last updated: 14 September 2026.
1. The principle
PDF Mirror works on your computer. The documents you open, edit, sign or OCR are never sent to AMS Studio or to anyone else. The software contains no analytics, no advertising identifier, no account to create. We process personal data for three things only: selling you a licence, delivering it, and offering you updates.
2. Data controller
AMS STUDIO S.à.r.l., 87, Route d'Esch, L-4450 Belvaux, Luxembourg — contact@ams-studio.lu. The company is not required to appoint a data protection officer; the manager acts as the point of contact.
3. What we process, why, and on what basis
| Processing | Data | Legal basis (art. 6 GDPR) | Retention |
|---|---|---|---|
| Purchase of a licence (Stripe) | Name, e-mail address, billing address, country, VAT number where applicable, last four digits and type of the card (the full number is known only to Stripe) | Performance of the contract (b); accounting and tax obligations (c) | 10 years from the close of the financial year (art. 16 of the Luxembourg Commercial Code) |
| Issuing and delivering the licence key | E-mail address, signed licence key, issue date, order reference | Performance of the contract (b) | Term of the licence, then 10 years with the accounts |
| Business licence: seat enrolment | Name and e-mail address of each enrolled employee, provided by the licence administrator, issue and revocation dates | Performance of the contract (b) and the employer's legitimate interest in administering its seats (f) | Term of the Business licence, then 12 months |
| Update check | Software and Windows version, IP address (processed by Cloudflare for the duration of the request, not retained by us) | Legitimate interest: security and maintenance (f) | Technical logs, 30 days at most |
| Service e-mails | E-mail address, content of the e-mail (licence key, enrolment token) | Performance of the contract (b) | Sending logs, 30 days |
| Support requests | What you write to us, and your contact details | Legitimate interest: replying (f) | 3 years after the last exchange |
| Promotional offers inside the software | No personal data: the software reads a public offers file and sends nothing | — | — |
4. What we do not do
We do not sell or rent any data. We do no profiling. We send no marketing without your consent: news about new versions lives in the software, not in your inbox. We do not knowingly collect any data from minors.
5. The Mistral OCR connector, if you enable it
By default, text recognition runs on your PC. If you enable the Mistral OCR connector, the pages you submit are sent directly from your computer to Mistral AI (Paris, France), on its European endpoint, with your own API key, encrypted on your PC by Windows (DPAPI). AMS Studio is neither the recipient nor an intermediary of these transfers; the processing is governed by Mistral AI's terms, which you accept when obtaining your key. The software reminds you of this when you enable the connector.
6. Processors and transfers outside the European Union
Stripe Payments Europe (Ireland) for payment; Cloudflare (European servers, a US company) for the licence service, downloads and hosting. These providers are bound by the GDPR by contract (art. 28). Where data may transit to the United States, the transfer relies on the adequacy decision for the EU–US Data Privacy Framework for providers certified under it, and on the European Commission's standard contractual clauses for the others.
7. Your rights
You may request access to your data, its rectification or erasure, restriction of processing, portability, and object to processing based on legitimate interest — by e-mail to contact@ams-studio.lu. We reply within a month. You may also lodge a complaint with the National Commission for Data Protection (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu, or with the authority of your country of residence.
8. Security
Licence keys are signed (ECDSA P-256) and verified offline; the private key is never on a PC. Document passwords stay in memory, never on disk. Exchanges with our services are encrypted (TLS). The software and its installer are signed in the name of AMS STUDIO S.à.r.l. and timestamped.
9. Changes
This policy may evolve with the software. The date at the top is authoritative; a substantial change is announced in the release notes.