Privacy Policy

Last updated: 13 October 2026

This policy explains what information FlexyFiles collects when you use flexyfiles.com (the “site”), what we do with the files you upload, how advertising and analytics work on the site, and the choices and rights you have. We have tried to write it plainly. If anything is unclear, contact us.

1. Who we are

The site is operated by FlexyFiles (“we”, “us”), which is the controller of the personal data described in this policy. You can reach us through our contact page.

2. Your files

The site lets you upload documents (PDF, JPG and PNG) into a private workspace and process them — for example to merge, split, compress, convert or protect them.

• Private workspace. Each workspace is identified by a long random code that is created for you and is part of your workspace link. Anyone who has that link can open the workspace, so share it only with people you trust. The code stays in the part of the address after “#”, which browsers do not send to servers, and we never send it to our analytics or advertising partners.
• Processing. Files are processed automatically on our servers, only to carry out the operations you ask for. We do not look at, read, sell or share the content of your files, and we do not use them for advertising or to train any model.
• Automatic deletion. A workspace and every file in it are deleted automatically 48 hours after it was last used. You can delete single files, or all files at once with “Delete all files”, at any time. Temporary files created during processing are deleted when the operation finishes.
• Passwords. A password you enter to protect or unlock a PDF is used only for that operation. It is not stored, logged or remembered.
• Your responsibility. Please upload only files you are entitled to process. Avoid uploading documents containing special categories of personal data (such as health data) unless you have a lawful reason to do so.

3. Information we collect

You can use the site without an account, and we do not ask for your name, address or payment details. We collect:

• Technical and log data — IP address, date and time, the pages and features requested, browser and device type, and the referring page. Our servers record this to deliver the site, prevent abuse (for example rate limiting) and fix errors.
• Files and file details — the files you upload and their names, sizes and page counts, as described in section 2.
• Usage statistics — with your consent where required, Google Analytics measures how the site is used: pages viewed, the tools used (for example “merge” or “compress”), the number of files processed, approximate location (country/region) and device information. We do not send file names, file contents or your workspace code to Google Analytics.
• Advertising data — our advertising partners collect information through cookies and similar technologies, as explained in section 5.
• Messages you send us — if you use the contact form, the name, e-mail address, optional phone number and message you enter.
• Information stored in your browser — your workspace code and your current processing list are kept in your browser's local storage so you can return to them. They stay on your device. Your consent choices are stored by our consent management platform (see the Cookie Policy).

4. How we use information, and our legal bases

5. Advertising

The site is free because it shows advertising, served by Google AdSense and other advertising partners.

• Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google's My Ad Center / Ads Settings. You can also opt out of a third-party vendor's use of cookies for personalised advertising by visiting www.aboutads.info/choices or, in Europe, www.youronlinechoices.eu.
• Learn how Google uses information from sites that use its services: policies.google.com/technologies/partner-sites, and Google's privacy policy at policies.google.com/privacy.
• In the European Economic Area, the United Kingdom and Switzerland, ads are personalised only if you consent. If you do not, you may still see non-personalised (contextual) ads, which can still use cookies for frequency capping, aggregated reporting and fraud prevention where permitted.
• Our advertising partners are listed in the consent tool, under “partners” or “vendors”, where you can accept or refuse each of them.

6. Analytics

We use Google Analytics 4 to understand which tools are used and to improve the site. Where consent is required, Google Analytics stores cookies only after you accept; until then it may send cookieless, aggregated signals as part of Google Consent Mode. Google Signals and ad personalisation from analytics data are switched off. You can also install Google's opt-out browser add-on.

7. Your choices and consent

When you first visit, a consent banner from our consent management platform, FlexyConsent (a Google-certified CMP registered with the IAB Transparency & Consent Framework), asks for your choices. You can accept, reject, or choose purpose by purpose and vendor by vendor. You can change or withdraw your choices at any time with the privacy choices link at the bottom of every page. Withdrawing consent does not affect processing that happened before.

You can also block or delete cookies in your browser settings. If you block all cookies, some parts of the site may not work.

8. Your rights

EU, UK and Swiss residents. You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing (including processing based on legitimate interests and direct marketing), to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority.

US residents (including California, Colorado, Connecticut, Virginia, Utah and other states with privacy laws). You may have the right to know what personal information we collect, to access and delete it, to correct it, and to opt out of the “sale” or “sharing” of personal information and of targeted advertising. We do not sell personal information for money; however, allowing advertising partners to use cookies for personalised advertising may be considered a “sale” or “sharing” under some laws. To opt out, use the privacy choices link (“Do Not Sell or Share My Personal Information”). We honour the Global Privacy Control (GPC) signal sent by your browser as an opt-out. We will not discriminate against you for exercising your rights.

To exercise any right, contact us. Because we do not use accounts, we may ask for details (such as your workspace link) to locate data relating to you. Most data is deleted automatically within days, so we may simply have nothing left to provide.

9. How long we keep information

• Uploaded files and processing results: until you delete them, and in any case 48 hours after the workspace was last used.
• Image downloads (ZIP files) prepared for you: up to 2 hours.
• Server logs: for a limited period needed for security and troubleshooting, no longer than 6 months.
• Analytics data: according to the data retention setting of our Google Analytics property (2 or 14 months).
• Contact messages: as long as needed to answer you and handle any follow-up.
• Cookies: see the Cookie Policy for each cookie's lifetime.

10. Who we share information with

We do not sell your files or give them to anyone. We share personal data only with:

• Hosting and infrastructure providers who run the servers and network the site depends on, under contracts that require them to protect the data;
• Google (AdSense, Analytics) and other advertising partners listed in the consent tool, which act as independent controllers for their own purposes as described in their privacy policies;
• Authorities, where we are legally required to, or to protect the rights, safety and property of our users, the public or us.

11. International transfers

Our partners, including Google, may process data outside your country, including in the United States. Where data from the EU, UK or Switzerland is transferred to countries without an adequacy decision, the transfer is protected by appropriate safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

12. Children

The site is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided personal data to us, contact us and we will delete it.

13. Security

All connections to the site are encrypted (HTTPS). Workspaces are reachable only with their random link, uploads and operations are rate-limited, files are processed in isolated temporary storage, and everything is deleted automatically. No method of transmission or storage is completely secure, so please keep your workspace link private and do not use the site for documents whose disclosure would cause serious harm.

14. Changes to this policy

We may update this policy when the site or the law changes. The date at the top shows the latest version. Significant changes will be highlighted on the site.

15. Contact

For any question about this policy or your personal data, use our contact page.