Privacy Policy
PDF Viewer Pro — A Wix Application by XtendApp
Effective Date: March 16, 2026
1. Introduction
XtendApp (“Company,” “we,” “us,” or “our”) operates PDF Viewer Pro (“Application” or “Service”), a Wix application that enables website owners to embed PDF documents on their Wix-powered websites.
This Privacy Policy explains how we collect, use, store, share, and protect information when you use PDF Viewer Pro. It applies to:
- Site Owners — individuals or businesses who install and configure PDF Viewer Pro on their Wix websites
- End Users — visitors who view or interact with PDF documents embedded via PDF Viewer Pro on a Site Owner’s website
By installing or using the Application, you consent to the practices described in this Privacy Policy. If you do not agree, please uninstall the Application and discontinue use.
2. Information We Collect
2.1 Information from Site Owners
When you install and use PDF Viewer Pro, we collect the following information through the Wix platform:
| Category | Data Collected | Purpose |
|---|---|---|
| Account Information | Email address, email verification status | Authentication, account management, support communications |
| Site Information | Wix site URL, site display name, business name, site language, locale, timezone, payment currency, site categories | Service configuration, localization, analytics |
| Identifiers | Wix instance ID (used as unique user identifier), component IDs | Authentication, data association, service delivery |
| Subscription Data | Plan type, billing cycle (monthly/yearly), purchase date, expiration date, auto-renewal status, invoice ID | Subscription management, feature access control |
| Configuration Data | Widget settings (toolbar visibility, zoom defaults, display mode, navigation options, watermark settings) | Delivering and persisting your configured experience |
| Uploaded Content | PDF documents uploaded through the Application | Core service delivery (displaying PDFs to end users) |
2.2 Information from End Users
When visitors view or interact with PDFs embedded via PDF Viewer Pro, we collect:
| Category | Data Collected | Purpose |
|---|---|---|
| Network Data | IP address | Analytics, fraud prevention, geographic insights |
| Usage Events | PDF view events, PDF download events (each associated with a component ID and timestamp) | Providing view/download statistics to Site Owners |
| Interaction Data | Toolbar actions (search, zoom in/out, page navigation, full-screen toggle, print, download) | Product improvement and feature usage analysis |
2.3 Information Collected Automatically
Our third-party service providers may automatically collect:
- Browser type and version
- Device type and operating system
- Referring URLs
- JavaScript errors and performance metrics
- Session recordings (in the settings panel, production environment only)
3. How We Use Your Information
We use the information we collect for the following purposes:
3.1 Service Delivery
- Authenticate your identity and verify your Wix site ownership
- Store and serve your PDF documents to your site visitors
- Apply your configured widget settings
- Manage your subscription and control access to paid features
3.2 Analytics and Reporting
- Provide Site Owners with PDF view and download statistics
- Analyze feature usage to improve the Application
- Monitor application performance and reliability
3.3 Error Monitoring and Debugging
- Detect, diagnose, and resolve software errors and performance issues
- Replay user sessions in the settings panel to reproduce and fix bugs
3.4 Communications
- Send transactional emails related to your account (e.g., subscription confirmations)
- Send marketing emails about product updates and features (with opt-out option)
3.5 Security and Compliance
- Prevent fraud, abuse, and unauthorized access
- Comply with legal obligations and respond to lawful requests
4. Legal Bases for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:
| Legal Basis | Applies To |
|---|---|
| Contract Performance | Processing necessary to provide the Service (authentication, PDF storage and delivery, subscription management) |
| Legitimate Interest | Analytics and product improvement, error monitoring and debugging, fraud prevention |
| Consent | Marketing communications, session recordings via LogRocket |
| Legal Obligation | Compliance with applicable laws and regulations, responding to lawful requests |
5. Third-Party Service Providers
We share information with third-party service providers who assist us in operating the Application. These providers process data on our behalf and are contractually obligated to protect your information.
| Provider | Service | Data Shared | Privacy Policy |
|---|---|---|---|
| Google Firebase | Authentication, database (Firestore), file storage, cloud functions, hosting, analytics | User identifiers, PDF files, configuration data, usage events | Link |
| Google BigQuery | Analytics data warehousing | View/download events, component IDs, IP addresses, timestamps | Link |
| Mixpanel | Product analytics and event tracking | User interactions, feature usage events, subscription events, site metadata | Link |
| Sentry | Error monitoring and performance tracking | JavaScript errors, pseudonymized user IDs, component IDs, console error messages, performance traces | Link |
| LogRocket | Session replay and debugging (settings panel only, production environment) | Session recordings, user interactions, page navigation, pseudonymized user IDs, subscription status | Link |
| SendGrid (Twilio) | Transactional and marketing email delivery | Email address, subscription status | Link |
| Wix | Platform integration, authentication, billing | Instance data, subscription/billing status, site properties, OAuth tokens | Link |
6. Data Sharing and Disclosure
We do not sell your personal data.
We may share your information only in the following circumstances:
- Service Providers: With the third-party providers listed in Section 5, solely to operate and improve the Service
- Analytics for Site Owners: We provide Site Owners with aggregated view and download statistics for their PDF components (End User IP addresses are not exposed to Site Owners)
- Legal Requirements: When required by law, regulation, legal process, or governmental request
- Protection of Rights: To enforce our Terms of Use, protect our rights, privacy, safety, or property, or that of our users or the public
- Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, in which case your data may be transferred to the acquiring entity
7. Cookies and Tracking Technologies
7.1 Session Storage
The Application uses browser session storage (not persistent cookies) to track whether a PDF view has already been counted within the current browsing session. This data is automatically cleared when the browser tab or window is closed.
7.2 Third-Party Cookies and Tracking
Our third-party service providers (Firebase Analytics, Mixpanel, Sentry, LogRocket) may set their own cookies or use similar tracking technologies. These are governed by each provider’s respective cookie and privacy policies. We do not control the cookies set by third parties.
7.3 Managing Cookies
You can manage or disable cookies through your browser settings. Please note that disabling cookies may affect the functionality of the Application or the websites where it is embedded.
8. Data Security
We implement appropriate technical and organizational measures to protect your data:
- Encryption in Transit: All data transmitted between your browser, our servers, and third-party services is encrypted using HTTPS/TLS
- Encryption at Rest: Data stored in Google Cloud services (Firestore, Cloud Storage, BigQuery) is encrypted at rest using AES-256 encryption by default
- Authentication: Wix instance JWT verification for Site Owners; Firebase custom token authentication; anonymous authentication for End Users
- Access Control: Cloud Functions validate identity and authorization before returning data; Firestore security rules restrict data access
- Signed URLs: PDF documents are served via time-limited signed URLs rather than direct public access
While we take reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
9. Data Retention
| Data Type | Retention Period |
|---|---|
| PDF documents and component configuration | Deleted upon Application uninstallation |
| Account and subscription data | Retained while the Application is installed; deleted upon uninstallation |
| View/download analytics (BigQuery) | Retained for up to 36 months for reporting purposes |
| Error logs (Sentry) | Subject to Sentry’s retention policy (typically 90 days) |
| Session recordings (LogRocket) | Subject to LogRocket’s retention policy |
| Event analytics (Mixpanel) | Subject to Mixpanel’s retention policy |
| Marketing contact lists (SendGrid) | Until you unsubscribe or request removal |
10. Your Rights
10.1 Rights for All Users
Regardless of your location, you have the right to:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Deletion: Request deletion of your personal data
- Opt-Out of Marketing: Unsubscribe from marketing emails at any time
10.2 Additional Rights for EEA/UK Residents (GDPR)
If you are located in the EEA or UK, you additionally have the right to:
- Restriction: Request restriction of processing of your personal data
- Portability: Receive your personal data in a structured, commonly used, machine-readable format
- Object: Object to processing based on legitimate interest
- Withdraw Consent: Withdraw consent at any time where processing is based on consent
- Lodge a Complaint: File a complaint with your local data protection authority
10.3 Additional Rights for California Residents (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know: Request disclosure of the categories and specific pieces of personal information collected about you
- Delete: Request deletion of your personal information
- Non-Discrimination: Not receive discriminatory treatment for exercising your privacy rights
- Opt-Out of Sale: We do not sell personal information. No opt-out is necessary
To exercise any of these rights, please contact us at support@xtendapp.io. We will respond to verified requests within 30 days (or the timeframe required by applicable law).
11. International Data Transfers
Our servers and the servers of our third-party service providers are primarily located in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States.
For transfers from the EEA/UK, we rely on:
- Standard Contractual Clauses (SCCs) as adopted by the European Commission
- Data processing agreements with our third-party service providers that include appropriate safeguards
- The EU-U.S. Data Privacy Framework, where applicable
12. Children’s Privacy
The Application is not directed at children under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete that information promptly.
If you believe that a child has provided us with personal information, please contact us at support@xtendapp.io.
13. Site Owner Responsibilities
Important for Site Owners: As a Site Owner embedding PDF Viewer Pro on your website, you act as a data controller for your End Users. You are responsible for compliance with applicable privacy laws.
As a Site Owner, you must:
- Include disclosures in your own privacy policy about the use of third-party applications, including PDF Viewer Pro, that collect End User data (IP addresses, usage events)
- Obtain any consents required by applicable privacy laws (e.g., GDPR cookie consent, CCPA notice) before End Users interact with the embedded PDF viewer
- Ensure that PDF documents you upload and embed do not contain or expose sensitive personal data of third parties without proper legal basis
- Respond to data subject requests from your End Users and coordinate with us as needed
14. Do Not Track Signals
Some browsers include a “Do Not Track” (DNT) feature that signals to websites that you do not wish to be tracked. The Application does not currently respond to DNT signals, as there is no industry-standard approach to interpreting them. We continue to collect data as described in this Privacy Policy regardless of DNT settings.
15. What Happens When You Uninstall
When you uninstall PDF Viewer Pro from your Wix site:
- Your PDF documents are deleted from our cloud storage
- Your component configuration data is deleted from our database
- Your email may be added to a marketing list for re-engagement communications (you may unsubscribe at any time)
- Aggregated analytics data may be retained as described in Section 9
- Data held by third-party services is subject to their respective deletion policies
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Effective Date” at the top of this page.
We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the updated Privacy Policy.
17. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Email: support@xtendapp.io
- Application: PDF Viewer Pro
- Developer: XtendApp
For data deletion requests, please include your Wix site URL and instance ID (if available) to help us locate your data promptly.