Cookie Notice
Version: 4 October 2026
1. Provider and scope
Bavaria2TM UG (haftungsbeschränkt), Rickering 2a, 94577 Winzer, Germany, operates Flying Research, Flying Upload and FLAI. Contact: info@flyingupload.com.
This notice explains cookies, browser storage, pixels and similar technologies used with our websites and online services. Such technologies may store information on your device or access information already stored there. Associated personal-data processing is explained in our Privacy Policy.
2. Your choices
You can accept or reject optional technologies and change your choice through the cookie preferences on the Cookies Usage page. Optional analytics, advertising, referral tracking and third-party media are activated only with the relevant consent. Refusing them does not prevent purchase or ordinary use of functions that do not depend on the optional service.
You may withdraw consent at any time through the same settings. Withdrawal stops future consent-based activity but does not make earlier lawful processing unlawful. The choice applies to the browser or device on which it is stored; use the relevant settings on other devices as well. Clearing browser storage may remove the saved choice and cause the consent controls to appear again.
Visiting the website, continuing to use it, accepting the Terms of Use or configuring a browser to accept cookies is not consent to optional technologies. We do not classify a technology as necessary merely because it benefits our business or produces aggregated reports.
3. Necessary storage and access
We use storage or access without optional consent only where an applicable legal exception permits it. Under section 25(2) TDDDG, this includes what is strictly necessary to provide a digital service you expressly request and what is used solely to transmit a communication over a public telecommunications network.
Necessary purposes include requested authentication, session integrity, essential security and remembering privacy choices. Personal-data processing necessary to provide a contracted feature is based on Article 6(1)(b) GDPR where applicable. Justified account/security administration relies on Article 6(1)(f), and legally required consent records on the applicable legal obligations or justified compliance interests.
Session-only information lasts for the browser session. Authentication information may remain until the relevant token expires, you sign out or access is revoked. Local application storage does not necessarily have a browser-set expiry; saved local credentials or preferences remain until removed by the application or through your device settings. Account deletion or licence revocation prevents further authorised server access but does not physically clear every device you have used.
Consent preferences are retained for no longer than six months before a new choice is requested, unless you change or clear them sooner. Evidence of the choice may be retained separately for the limited compliance purposes described in the Privacy Policy.
4. Optional services and duration
The following services are subject to the consent or requested-function conditions described below. The periods concern device identifiers, not the retention of every server-side record. Browser restrictions or your deletion of storage may shorten a period. A provider must not be activated for a consent-dependent purpose before the applicable choice.
| Service and provider | Purpose and information | Device-storage duration |
|---|---|---|
| Google Analytics — Google Ireland Limited and relevant Google group providers | Website usage measurement using pages/events, referrals, device/browser and session identifiers. Standard identifiers include _ga and _ga_ followed by a property-specific suffix. Requires analytics consent. | Up to two years for the standard persistent identifiers, subject to browser limits and withdrawal. Permitted visits can update the expiry. |
| Meta Pixel — Meta Platforms Ireland Limited and relevant Meta group providers | Advertising measurement and attribution using page/event and browser information. Meta may link the information to data it already holds. Standard first-party advertising identifiers include _fbp and, where used, an advertising-click identifier. Requires marketing consent. | Up to three months for the website’s advertising identifiers, subject to earlier withdrawal or deletion. |
| Tapfiliate — Tapfiliate B.V. | Attribution of a qualifying purchase to the first eligible affiliate referral. Identifiers link the browser referral to an eligible transaction. Requires consent where device storage/access is not strictly necessary for a separately requested service. | The initial referral window and related referral identifier are limited to 30 days. Later eligible renewal accounting does not extend that browser referral window. |
| YouTube — Google Ireland Limited and relevant Google group providers | Embedded video delivery, playback information and provider identifiers after the relevant consent or separately informed activation. Google may associate activity with a signed-in account. | Session identifiers such as YSC last for the session. Provider video preference/security identifiers may last six months (__Secure-YNID), eight months (PREF) or thirteen months (__Secure-YENID). The identifiers actually used depend on the player and Google choices. |
| Google Login — Google Ireland Limited and relevant Google group providers | Authentication when you choose Google Login. Google receives the sign-in request and uses its authentication/security mechanisms. Unrelated analytics or advertising are not authorised by choosing login. | The Flying session follows section 3. Google’s own account security cookies, such as SID and HSID, can last up to two years; their handling also depends on your Google account and browser choices. |
| reCAPTCHA — Google through the entity identified in the applicable Google Cloud agreement, acting as processor for Flying | Abuse protection for relevant requests using network/browser information, interaction signals and security identifiers such as _GRECAPTCHA. Flying is the controller for reCAPTCHA customer data, processed by Google under its Cloud Data Processing Addendum and service-specific terms. Only strictly necessary device access for a requested function is used without consent; any other consent-dependent use requires the corresponding choice. | For the security purpose and lifespan specified by the deployed provider mechanism; associated Google cookies can be session-based or persistent. Consent-dependent mechanisms remain blocked until consent, and the relevant provider’s cookie information describes their expiry. |
Google describes its cookie names, purposes and durations in How Google uses cookies, including newer names that can replace older YouTube identifiers. Google’s Analytics cookie information explains the standard Analytics identifiers. Meta provides cookie information, and Tapfiliate provides its Privacy Policy. Our use remains limited by the purposes and consent conditions in this notice; a provider’s general list does not mean we use every technology it lists.
5. Communications, checkout and external pages
Choosing an external WhatsApp, YouTube, social-media or marketplace link opens a service operated by that provider. Its notice governs activity on its own service. Embedding a component in a Flying page is different: consent-dependent connections from that component must wait for the relevant choice. WhatsApp Business communications are explained in our Privacy Policy.
Paddle operates its own checkout and buyer services, including authentication, payment and fraud-prevention technologies. Its Privacy Notice explains those functions. A purchase does not require consent to Flying’s optional advertising or affiliate tracking.
Mailchimp sends our newsletters. Individual email-open and click tracking is used only with the required specific consent, as explained in the Privacy Policy. Consent to receive a newsletter does not automatically authorise an undisclosed tracking purpose.
6. Browser settings and international processing
Your browser and device may allow you to view, restrict or delete cookies and other storage. Deleting necessary information may sign you out or reset your preferences. These controls supplement our consent settings; they do not substitute for obtaining consent when required.
Some services listed above can transmit personal data to providers or their service providers outside the European Economic Area, including the United States. The Privacy Policy identifies recipients, their functions and the applicable transfer safeguards. Applicable legally recognised opt-out preference signals are respected where required by law.
7. Updates and contact
We update this notice when our technology use changes. A new notice does not itself permit a new consent-dependent purpose. Contact info@flyingupload.com for questions or assistance with your choices.