iLovePDF vs Smallpdf: Privacy, Free Limits, and Zero-Upload Alternatives

Platform origins and architectural foundations

iLovePDF's about page, opened 18 September 2026, states: "Born and based in Barcelona in 2010." The same page describes desktop and mobile apps in addition to the website. The security page (ilovepdf.com/help/security) says iLovePDF "proudly holds ISO/IEC 27001:2017 certification, recently renewed in November-March 2023" and, under data retention: "all files processed within our platform are automatically and permanently deleted within two hours of being processed."

Smallpdf's Privacy Notice identifies Smallpdf AG, Steinstrasse 21, 8003 Zurich, Switzerland. The pricing page (same day) prints "Smallpdf is ISO/IEC 27001 certified, GDPR, CCPA, and nFADP compliant." No Smallpdf page we opened states a monthly active-user count, so that figure is omitted.

Both platforms still run a cloud pipeline: the browser uploads the file, a remote worker transforms it, and you download the result. iLovePDF's security page talks about "robust cloud infrastructure partnerships" without naming AWS or Google Cloud, so this article does not assign those vendors. Smallpdf names Hetzner in the EU for User Files and AWS Bedrock only for internal analytics.

Understanding that shared upload step matters more than brand tone. It is the reason both services publish retention clocks at all.

Free tier allowances published on the pricing tables

Casual users hit free-tier tables before they hit privacy policies. On 18 September 2026 those tables said:

• Smallpdf Free: the comparison grid lists a "Daily download limit" on compress, convert, merge, split, and many other tools. It does not print how many downloads that is. Pro, Team, and Business show file size limit "Unlimited." A pricing FAQ states that cancelling the free trial downgrades the account when the 7-day period expires.
• iLovePDF Basic (Free): the plan copy says "Limited document processing." The Filesize per task block lists numeric caps per tool, including Word to PDF 15 MB, PDF to JPG 25 MB, Merge PDF 100 MB, Compress PDF 200 MB, and Image to PDF 40 MB. Batch processing is "Limited," with Merge PDF listing 25 files on Basic versus 500 on Premium.
• Account friction: Smallpdf's Free column still requires using the site under those daily-download cells. iLovePDF Basic lists "Start for free" without a published daily-task integer.

Both vendors publish paid plans on their pricing pages; prices vary by region and change often, so this article does not compare them. Check ilovepdf.com/pricing and smallpdf.com/pricing for current figures.

Where cloud platforms deliver genuine enterprise value

While privacy advocates often focus on upload risks, it is important to objectively acknowledge the distinct technical advantages that established cloud platforms bring to enterprise workflows:

1. Heavy neural optical character recognition: Extracting machine-readable text from low-resolution multilingual scans demands intensive compute power. Cloud servers leverage distributed GPU clusters running sophisticated OCR models that consumer laptops cannot match locally.
2. Seamless third-party cloud storage integration: Both iLovePDF and Smallpdf connect directly to Google Drive, Dropbox, and Microsoft OneDrive, enabling enterprise workers to import and export files without saving intermediate copies to local hard drives.
3. Multi-party electronic signature infrastructure: Managing authenticated digital signature sequences with cryptographic timestamps, verifiable audit trails, and automated email reminders requires centralized orchestration servers.
4. High-fidelity document layout reconstruction: Converting complex PDF layouts with dynamic floating columns and nested vector graphics into editable Word documents frequently relies on proprietary server-side rendering pipelines.

For non-confidential marketing assets, educational whitepapers, or public brochures, these cloud features provide undeniable workflow speed.

Data retention windows and security practices compared

When you handle documents containing confidential business data, personal identification numbers, or medical histories, the vendors' own retention sentences are the only numbers this article will use.

Smallpdf: logged-in User Files are deleted within one hour unless saved to file storage; saved files you delete are generally removed within 14 days. Visitors without an account get "a reasonable period of time after the last time they were opened," not a published hour count. Hetzner EU is the User File processor named in the notice.

iLovePDF: the security page's two-hour deletion sentence is quoted above. Manual delete from the download screen is also offered. Signed documents are retained for a maximum of 5 years "in compliance with legal requirements." ISO/IEC 27001:2017 is cited on that page with a certificate PDF link.

Feature and architectural comparison table

The zero-upload browser alternative

For organizations and privacy-conscious professionals who cannot accept cloud upload exposure, modern browser engines provide a different path. WebAssembly and JavaScript compilation let PDF work run inside the tab's memory sandbox.

In this architecture, your file never crosses the network. When you utilize client-side utilities like Compress PDF to downsample image streams, Merge PDF to assemble multiple contractual exhibits, or PDF to Word to extract text into structured documents, your personal computer or mobile processor performs every operation locally.

Because no central server receives the file, there is no vendor retention clock to argue about. Closing the tab releases the heap the way any web app does; it does not prove the RAM was overwritten, and it does not unsay a download you already saved.

Recommended workflow framework

Rather than treating these utilities as mutually exclusive, experienced professionals adopt a tiered workflow based on document confidentiality:

• Tier 1 - Confidential or regulated documents: For payroll summaries, tax declarations, passport photocopies, proprietary code, or confidential NDAs, prefer a zero-upload browser utility. Data that never leaves the device cannot sit in a vendor retention queue. The device itself, and the employer's policy for that device, remain in scope.
• Tier 2 - Complex legacy scans requiring heavy OCR: When dealing with poor-quality photocopies in non-Latin scripts, use iLovePDF or Smallpdf's cloud-powered OCR servers, ensuring the files contain no sensitive personally identifiable information.
• Tier 3 - Quick casual edits on public PDFs: For publicly available brochures, event schedules, or school study materials, iLovePDF Basic's published per-tool table is enough for many one-off jobs.

Frequently asked questions