What uploading a document exposes
When you merge PDFs on a website, both files go to that company's servers and the result comes back.
What gets sent
The document. Every page, and also what you can't see on the page: the author name your word processor saved in it, earlier revisions if it has them, the phone or scanner model in the image metadata, and any text that was “redacted” by drawing a black box over it instead of removing it.
The file name. Kündigung_Meier_2026.pdf, MRI-report-March.pdf or offer_acme_final.pdf say what the document is before anyone opens it, and the name is sent even if nobody ever reads the contents.
Your IP address. An upload is a connection, so the server sees where it came from: your home, your employer's network, or the client's office you're working in. With the time, that's a record of where and when the document was handled.
How long it stays there
The file has to sit on the server while it's being processed, so every service like this keeps it for a while. How long, in which country, and who can see it are up to the company. Good services say so clearly, but they can change their rules, and by then the copy is out of your hands.
When the document is someone else's
Contracts, medical letters, employee files and clients' tax papers hold other people's personal data, which you handle on their behalf. Sending them to an online tool makes that company a data processor.
European data-protection law (the GDPR) expects a written contract with any company that handles such data for you, Swiss law a contract of the same kind, and both leave you responsible for keeping it safe. A free website usually doesn't come with that contract, and later you may not be able to say where the file went.
This isn't legal advice, and your organisation's rules decide what's allowed. But it's why many people are told not to use these tools at work.
Doing it on your own computer
An app that builds the PDF on your own computer doesn't make that transfer. It reads the files from your disk and saves the result to a folder you choose, and it works without a network connection too.
When a website is fine
For a public document, like a timetable, a conference programme or anything you'd happily email to a stranger, a website is quicker and none of the above matters much. A website is also the answer if you need text recognition (OCR), want to edit the text inside a PDF, or need other people to sign it, which PDF Assembler doesn't do.
About PDF Assembler
PDF Assembler is a small app for macOS and Windows that merges, splits, compresses and password-protects PDFs on your own computer. It makes no network requests at all. Paid once, no subscription.
