You are in the middle of a deal. The S&P needs a page merged with the settlement statement. You open ilovepdf, drag and drop, done in thirty seconds. You have done it a hundred times. Quick question: where did that document just go?

Most real estate agents use free online PDF tools every week. Merge this. Compress that. Sign here. Split the deposit receipt off the agreement. These tools are fast, free and sitting right there when you need them. Nobody reads the terms before using them. Why would you?

Here is why you probably should.

A Sale and Purchase agreement contains your vendor's name, their address, the price they accepted, the conditions on the deal and quite often their financial circumstances. It is one of the most sensitive documents in the entire transaction. And the moment you drag it into a free online tool, it lands on a server you do not own, run by a company you have never heard of, in a country that may not be New Zealand.

So we went and read the fine print

Let us start with ilovepdf, because it is probably the most widely used. Their privacy policy states that all uploaded files are automatically and permanently deleted within two hours of processing. They state clearly that they do not access, use or analyse any content that users upload. The company is based in Spain, certified to ISO/IEC 27001 and GDPR compliant.

Smallpdf, a Swiss competitor, says the same: files deleted within one hour, no AI training on your documents, no analysis for any other purpose. PDF24, a German tool, also deletes within an hour and processes everything on EU servers.

The honest verdict: the major, well-known PDF tools have actually thought about this. They have certifications, clear policies and genuine legal accountability under European data protection law. If you are using ilovepdf or smallpdf for everyday tasks, their stated policies are reasonably solid.

Here is the thing though. Did you know any of that before reading this? Probably not. And more importantly: do the other tools you use have the same standards?

The landscape is not all ilovepdf

There are dozens of free PDF tools out there. Many appear at the top of Google search results, have slick interfaces and charge nothing. A meaningful number of them have vague or absent privacy policies. Some are run by companies you cannot trace to a physical address or a named legal entity. Some have terms that grant them a broad licence to use uploaded content for service improvement, which in 2026 often means feeding it into a model.

The AI-powered PDF tools are a particular grey area. Tools that summarise, extract, translate or answer questions about a PDF have to do something with your content beyond basic file manipulation. Whether that content is retained, anonymised or used for model training depends entirely on the specific tool and the specific terms, and those terms change.

Worth asking yourself: the last time you used a free AI PDF tool to extract information from an agreement or summarise a document, did you check whether that content could be used to improve the model? Most agents have not thought to ask.

The question is not just about trust. It is about informed consent. Your clients have not consented to their personal financial information being processed on overseas servers, even temporarily. The NZ Privacy Act 2020 requires agencies handling personal information to take reasonable steps to protect it. Whether your average online PDF tool meets that bar is a reasonable question for a compliance-minded office to ask.

A quick explanation of GitHub

Before the alternative, a bit of context. GitHub is the world's largest platform for sharing code. Think of it as a library where software developers store and share the tools they build. When a developer builds something useful and releases the code publicly, anyone can read it, use it, improve it and share it. This is called open source software.

Because the code is public, you can verify exactly what it does. There is no black box. There is no mystery server. And because anyone can contribute, good open source tools attract thousands of contributors who fix bugs, add features and check each other's work.

GitHub hosts millions of projects. Some of them are built by individuals in their spare time. Some of them are used by major corporations and governments. The best ones rise to the top based on how useful and trustworthy they are, measured in part by a simple metric: stars. A star on GitHub is essentially a bookmark, a signal that this project is worth paying attention to.

Stirling PDF: 78,000 stars, runs on your machine

The number one PDF application on GitHub right now is called Stirling PDF. It has over 78,000 stars. To put that in context, most software projects never reach 1,000. This tool has been starred by developers and non-developers across the world who found it, tried it and considered it worth bookmarking.

What does it do? Everything ilovepdf does, plus more. Merge, split, compress, convert, rotate, sign, redact, OCR, watermark, edit and over fifty other operations. The interface runs in your browser. But the critical difference is this: the tool itself runs on your own machine. Nothing leaves your computer. Your Sale and Purchase agreement does not touch a server in Spain or Switzerland or anywhere else. It goes from your hard drive to your hard drive, with a browser interface in between.

It is free. It is open source. The code is public. You can read exactly what it does with your files. The answer is: process them locally and give them back to you.

Getting set up: Stirling PDF is most easily installed via Docker, a tool that packages software so it runs the same way on any computer. If you or your IT support can follow a basic setup guide, it is a one-time ten-minute install. After that, it just works. Visit stirling.com for installation options including a desktop app.

There is also a desktop client now, which makes the setup even simpler. No command line. No configuration. Download, install, open.

What this means practically for agents

For low-stakes tasks with public documents, the major online tools are fine and convenient. Nobody is suggesting you need to overhaul how you compress a marketing photo.

For Sale and Purchase agreements, settlement statements, conditional reports, tender documents, or anything containing client names, prices or financial circumstances, it is worth pausing. Even if the tool you use has excellent privacy practices, you are making a decision on behalf of your client that they probably do not know you are making.

The better approach is a local tool. Your documents stay on your machine. Your clients' personal information does not transit overseas servers. You have an answer if anyone ever asks.

Makes you think, right?

The tools you have been using are probably fine. Probably. The major ones have genuine accountability and real privacy commitments. But the habit of dragging sensitive legal documents into whatever PDF tool appears at the top of Google without a second thought is worth examining.

Because somewhere out there, there is a free PDF tool with no named owner, no clear privacy policy, a vague reference to service improvement in the terms, and an AI sitting in the background reading agreements. Is some model casting a critical eye over how you filled in the deposit amount, wondering if it could negotiate better? Almost certainly not. But also: you do not actually know.

Now you do. Use the local tool.

For what it's worth, ilovepdf's privacy policy and these findings are current as of May 2026. Privacy policies change. If you are processing client documents regularly, it is worth a periodic check of the tools you use.

If you want to talk about how your business handles digital tools, client data or building systems that keep your clients' information where it belongs, I am always happy to have that conversation.

Get in touch See all the digital work