Where the documents are
The documents are kept in a protected folder of your server, under names nobody can guess, and only for the number of days you set in the Settings tab.
What leaves your server
Nothing is sent to another server: the PDF files are read and written by the plugin itself, and the documents never leave your server. The only things that can leave are those you ask for: a support request, the optional support access, and the optional free license.
Personal data
A person can ask for a copy of what is kept about them, or for its erasure, with the privacy tools of WordPress (Tools > Export Personal Data and Erase Personal Data). A text for your privacy policy is suggested in Settings > Privacy > Policy Guide.