Privacy Policy

Version: 4 October 2026

1. Provider and contact

Bavaria2TM UG (haftungsbeschränkt), Rickering 2a, 94577 Winzer, Germany (“Flying”, “we”, “us”), is the controller for the processing described in this notice unless a different role is stated. Our services include Flying Research, Flying Upload, FLAI, our websites and the affiliate programme.

For privacy matters, contact our management at info@flyingupload.com, by post at the address above, or by telephone on +49 176 56088926.

This notice concerns personal data, including information that identifies you indirectly through an account, device or other identifier. It does not turn acceptance of our Terms of Use into consent to advertising, tracking or unrelated processing.

2. Purposes and legal bases

We process personal data to operate the services you request, administer contracts and accounts, protect our systems, communicate with you and meet legal obligations. Under the General Data Protection Regulation (GDPR), the principal bases are:

• Article 6(1)(b), for steps you request before a contract and processing necessary to perform a contract with you as an individual, including a sole trader;
• Article 6(1)(f), for necessary processing based on legitimate interests, including administering relationships with business representatives, protecting services, preventing misuse and establishing or defending legal claims, subject to the required balancing of interests;
• Article 6(1)(c), for legal obligations, including applicable accounting, tax and compliance requirements; and
• Article 6(1)(a), for processing for which you give consent, including consent-dependent analytics and advertising.

Information required for an account or transaction is identified when collected. Without information necessary to authenticate you, establish an entitlement or complete a transaction, the relevant feature may not be available. Optional marketing and tracking are not conditions of purchasing a paid licence.

3. Accounts, authentication and Google Login

We process registration and contact details, account identifiers, authentication information, licence and subscription status, token allocations and deductions, and relevant account activity. We use this information to identify the account, authenticate access, provide purchased functions, record token use and investigate errors or misuse.

When you choose Google Login, Google authenticates you and supplies the account information authorised in the sign-in process, such as an account identifier, email address and basic profile information. We use those fields to create or recognise your Flying account. Google also receives information about the sign-in request and processes information for its own authentication and security purposes. The permissions shown by Google identify the information you authorise it to share. You can manage the connection in your Google account; removing it does not automatically cancel a paid Flying subscription.

Processing necessary for an individual’s account is based on Article 6(1)(b). For personnel acting for a business, Article 6(1)(f) applies to our and the business’s interests in administering authorised access. Google’s own processing is explained in its Privacy Policy.

4. Hosting, cloud designs and local software

We use Amazon Web Services (AWS) for hosting, cloud storage, infrastructure and service email. Flying’s cloud designs and its own hosted processing infrastructure are hosted in Germany. This location statement does not mean that every external provider described below processes all data exclusively in Germany.

Cloud design functions process the files, images, saved outputs, listing text and associated information you submit or save. We process them to store, display, organise, transform and export them as requested. Exports include original design files with associated XML files and listing data in Excel format. The relevant data depend on the features you use and information you supply.

Where we act solely on a business customer’s instructions in processing personal data contained in its content, that customer determines the purposes and is responsible for its lawful instructions. The parties must put the processing agreement required by Article 28 GDPR in place for that processing. Contact us to arrange it before submitting third-party personal data that require such an agreement. Our independent account, billing and security purposes remain governed by this notice.

Flying Upload’s local workflow keeps marketplace credentials and locally processed files on your device; we do not receive them merely because you run that workflow. Server authentication checks your account and licence. Using cloud storage, online AI, translation or support transmits the information needed for the selected online function. When the local uploader sends information to a marketplace on your instructions, that marketplace receives and processes it under its own information and rules.

The bases in section 2 apply according to the contractual relationship and purpose. Our hosting providers process customer content on our instructions under the applicable processing agreements.

5. AI processing and translation

AI functions use the OpenAI API and models operated by Flying. The inputs needed for an action, which may include prompts, text and reference images, are transmitted to the relevant processing service to generate the requested result. Account and technical identifiers may also be used to route the request, record usage and maintain security. Processing necessary to provide your requested action is based on Article 6(1)(b), or Article 6(1)(f) for business representatives, as applicable. Where Flying is your processor, your lawful instructions and the processing agreement govern customer-content processing.

Flying does not use your content, prompts or generated outputs to train AI models. We use OpenAI’s standard API arrangements, under which API customer content is not used to train OpenAI’s models unless the customer explicitly opts in. Flying does not opt your customer content into such training.

OpenAI may retain API information for abuse monitoring and operation under its applicable arrangements. Its standard abuse-monitoring retention is generally up to 30 days, with exceptions for legal obligations or protection of its services and third parties. Storage associated with particular API functions is separate and may last until deleted. Deleting a Flying account does not itself establish instantaneous deletion of every record independently retained by OpenAI. Standard API use does not establish German-only processing or zero data retention. See OpenAI’s API data information and Data Processing Addendum.

Some translation functions use your own DeepL account and API key. The text needed for the requested translation is sent to DeepL under that account’s arrangements. DeepL’s processing is described in its Privacy Policy. Do not submit personal data unnecessary for the action, and ensure you have authority to submit information concerning other people.

6. Purchases and payment information

Paddle is the authorised reseller and merchant of record. The Paddle entity shown in the checkout and transaction confirmation is the seller and processes purchase, payment, tax, fraud-prevention and legal-compliance information for its own responsibilities.

Flying processes the customer, transaction and entitlement information it receives from Paddle, including relevant purchaser/contact identifiers, purchased items, amounts, currency, subscription status, payment status, renewals, cancellations and refunds. We use it to provide the purchased service, reconcile transactions and assist with support. Outsourcing payment collection does not mean that Flying receives no transaction-related personal data.

Contract administration, justified business interests and applicable legal obligations provide the bases described in section 2. Paddle’s Privacy Notice explains its separate processing and retention. Refunds or deletion of a Flying account do not erase records that Paddle must retain independently.

7. Support and communications

When you contact us, we process your contact details, message, attachments and relevant account or transaction information to respond and investigate the matter. Necessary contractual enquiries are processed under Article 6(1)(b); other business correspondence and support administration rely on Article 6(1)(f), subject to applicable legal obligations and justified claims retention.

You may contact us by email or through WhatsApp Business. If you choose WhatsApp, your telephone/account identifiers, messages and related communication information are processed through that service. WhatsApp also processes information for its own operation and security. Its EEA Privacy Policy explains those purposes. You can use email instead. Please do not send passwords, complete payment-card details or unnecessary sensitive information in support messages.

We send necessary account, authentication, transaction, security and service communications independently of optional advertising preferences. Selecting a communication channel does not amount to consent to unrelated marketing.

8. Newsletters and advertising communications

We use Mailchimp to manage and send newsletters and marketing messages. It processes the recipient’s contact details, mailing preferences, consent or objection information, delivery status and relevant campaign information on our behalf and, for its own permitted service purposes, as described in the Intuit Global Privacy Statement.

We send email advertising on the basis of consent under Article 6(1)(a) GDPR or the statutory existing-customer exception where all of its requirements are met. That exception is limited to advertising for our own similar products or services and requires the applicable opportunity to object at collection and in each message. The related GDPR basis is Article 6(1)(f), reflecting our interest in informing existing customers about similar offerings.

You may withdraw consent or object to direct marketing at any time using the unsubscribe link or by contacting us. There is no charge beyond ordinary transmission costs. Withdrawal does not affect earlier lawful processing. We may keep minimal suppression information to respect your choice and justified evidence of the consent or objection.

Individually attributable email-open or click tracking is used only with the required specific consent. Where enabled with consent, it records whether and when a message was opened or a link followed, together with the relevant message/recipient identifier and technical information. You can withdraw that consent by contacting us or unsubscribing. Ordinary delivery and error information are handled separately to operate the mailing service.

9. Website technologies and security

The Cookie Notice and settings explain device storage and access, the relevant categories and how to change your choices. We use consent-dependent technologies only after the corresponding consent. Article 6(1)(a) GDPR applies to the related consent-based personal-data processing. A legitimate interest does not replace consent required for device access by section 25 TDDDG.

Google Analytics: With analytics consent, we process website interactions, pages visited, referrals, session and device/browser information and associated identifiers to measure and improve the website. Google receives the information necessary to provide the service. Reports may be aggregated, but the underlying identifiers are not automatically anonymous.

Meta Pixel: With marketing consent, browser identifiers, page and event information and relevant technical data are sent to Meta to measure advertising effectiveness and attribute interactions. Meta can associate received information with information it holds, including a Meta account. To the extent the joint-controller arrangement applies to collection and transmission of event data, responsibilities are allocated under Meta’s Controller Addendum. Meta handles its subsequent processing under its own applicable policy. You can exercise applicable rights with either responsible controller.

YouTube: An embedded player connects to Google/YouTube when activated in accordance with the relevant consent choice. Google can receive the visited page, device and network information and video interactions, and may associate them with an existing Google account. An ordinary external video link instead takes you to YouTube when selected.

reCAPTCHA: We use Google reCAPTCHA to help distinguish legitimate requests from automated abuse. It can process network and browser information, interaction signals and a risk assessment. Flying is the controller for this reCAPTCHA customer data. Google processes it on our behalf under the applicable Google Cloud agreement, Cloud Data Processing Addendum and service-specific terms, for providing and maintaining the service and its security, fraud and abuse protection. The basis for necessary security processing is Article 6(1)(f). Consent is obtained where required for the particular device access or processing; a security label does not make unrelated tracking necessary.

Google’s separate processing for Google Login and YouTube is addressed in its Privacy Policy.

Operational records include information needed to deliver requests, authenticate accounts, diagnose errors and investigate abuse, such as IP addresses, request times, device/browser information, authentication results and error events. Necessary delivery relies on Article 6(1)(b), where applicable; system protection and abuse prevention rely on Article 6(1)(f). We restrict use to the stated purposes and the retention criteria below.

10. Affiliates

We use Tapfiliate to administer referrals and commissions. Affiliate data include registration/contact details, referral identifiers, programme activity, payout and tax information, attributed transactions and correspondence. Customer referral information can include a referral or customer reference, qualifying transaction, product, amount, date and status.

The programme uses first-referrer attribution and a 30-day initial referral window. One-off token purchases do not earn commission. Browser-based attribution requiring consent is activated only with that consent. Once a subscription has been validly attributed, recording its subsequent eligible renewals for commission accounting is a separate contractual/accounting activity; it does not justify unrelated browser tracking.

Affiliate reporting is limited to information needed to calculate and substantiate commission. Access to identifiable customer information is limited to what is necessary and lawfully justified for that purpose. Affiliates receive no general permission to access customer designs, AI prompts, payment instruments or contact lists, or to market directly to referred customers.

Programme contracts, justified administration and anti-fraud interests, and statutory recordkeeping provide the applicable bases in section 2. PayPal processes affiliate payouts under the applicable PayPal account arrangements. See Tapfiliate’s Privacy Policy and PayPal’s Privacy Statement.

11. Marketplace research information

Research features use marketplace listings, public product information and the marketplace interfaces used by the service. Depending on the source and feature, the information can include listing text and images, product identifiers, prices, public commercial statistics, shop or brand identifiers and publicly displayed seller or creator references. A commercial identifier can be personal data where it identifies an individual.

We process relevant publicly available commercial information to provide product and market research to authorised users. Where personal data are involved, Article 6(1)(f) is the basis, subject to the required balancing of our and customers’ research interests against the person’s rights. Public availability does not remove data-protection obligations or give users unrestricted rights to copy protected content.

Research information can be displayed to customers using the relevant research feature and processed by our hosting providers. Its source is the relevant marketplace, public listing or connected interface. We review accuracy, continued relevance and lawful retention, and address justified correction, objection and erasure requests through the contact in section 1. Any individually required information about indirectly obtained personal data is provided in accordance with Article 14 GDPR.

12. Recipients and processing outside Europe

The principal providers and recipient groups are:

Authorised personnel may access data where needed for their assigned work. Professional advisers, lawfully engaged debt-recovery providers, courts and public authorities may receive information where required by law or necessary and lawfully justified for advice or claims. Debt-recovery disclosures are limited to the identification, contract, transaction and communication information needed to establish or pursue the particular claim. Any business reorganisation or transfer involving personal data remains subject to applicable legal bases and information duties.

Some listed providers operate internationally, including in the United States. Processing in Germany by Flying does not exclude access or onward processing abroad by a particular provider. Relevant locations and subprocessors are identified in the provider’s applicable processing disclosures. Transfers to a country without an applicable adequacy decision are made using appropriate safeguards, including applicable EU standard contractual clauses, any necessary supplementary measures and, for Swiss data, the required adaptations. Where the recipient and processing fall within a valid adequacy arrangement, including an applicable Data Privacy Framework certification, that arrangement may provide the transfer basis. We do not rely on acceptance of this notice as blanket transfer consent.

You may contact us for information about the safeguards applicable to a particular transfer and a copy of the relevant safeguards, subject to lawful redactions. Provider information is available through the links in this notice and AWS data privacy information.

13. Retention, account deletion and records

We retain personal data for the relevant purpose and delete or anonymise them when that purpose and any lawful retention need end. We apply the following criteria:

• Active accounts and content: Account information and content you choose to retain are processed while needed to operate the account and requested features. You can separately cancel a subscription or request complete account deletion. Completing full account deletion removes the account and its associated content from Flying’s active service. Export material you need first. Account deletion does not itself cancel a payment contract with an independent seller; cancellation and billing are coordinated under our Cancellation, Withdrawal and Refund Policy.
• Storage reductions: After paid storage entitlement ends, content above the 2 GB free allowance is retained for one calendar month. Afterwards, newest-added whole designs may be deleted until storage is within 2 GB, subject to legally required preservation, switching and retrieval. This is distinct from complete account deletion.
• AI information: Saved inputs or outputs follow the account/content rules. Temporary processing information is retained only as needed to complete, secure or investigate the action. OpenAI’s separate standard retention is described in section 5; other independent providers retain information under their applicable responsibilities.
• Technical and security records: Routine records are retained while needed to identify and resolve operational or security events and then deleted or anonymised. Specific evidence may be isolated for a substantiated investigation or claim and retained only while that need continues. This does not permit indefinite retention of unrelated activity or complete design libraries.
• Support and correspondence: We retain information while handling the matter and afterwards only to meet applicable business-correspondence obligations or address substantiated claims. Attachments and troubleshooting copies that are unnecessary for those purposes are deleted.
• Contracts, transactions and affiliate records: Required accounting vouchers are generally retained for eight years, business correspondence for six years, and books and annual accounts for ten years, calculated under the applicable statutory rules, generally from the relevant year-end. Longer retention applies where a specific law, audit, proceeding or other statutory rule requires it. These periods apply to the relevant records, not to every item of customer content.
• Legal claims and consent evidence: We retain the minimum information needed to establish, exercise or defend claims or demonstrate a consent or objection. Retention takes account of the applicable limitation period, including its starting point and any suspension or extension. The ordinary German limitation period is generally three years; this does not impose a universal three-year retention period on all data.
• Marketing: Marketing contact data are retained while the relevant permission or lawful purpose continues. After withdrawal or objection, we stop the affected marketing and may retain minimal suppression and compliance evidence.

Information retained for a specific legal obligation or claim is restricted to that purpose. Backups or operational recovery copies are not used to continue ordinary processing of a deleted account; deletion requirements must also be respected when restoring systems and under the applicable recovery cycle. A statutory cloud-switching erasure commitment is governed by the applicable period in the Terms of Use and cannot be extended by an undisclosed additional backup period.

Deleting an account does not override applicable recordkeeping law or erase records independently held by Paddle, a marketplace, your communications provider or another independent controller. Those recipients remain responsible for their own lawful retention.

14. Your rights

Where the applicable legal conditions are met, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with future effect. Contact info@flyingupload.com to exercise your rights. We may request proportionate information necessary to verify your identity or a representative’s authority. Statutory exceptions, response periods and rules concerning unfounded or excessive requests apply.

Where processing is based on Article 6(1)(e) or (f) GDPR, you may object on grounds relating to your particular situation, including to related profiling. We will stop unless the statutory grounds for continuing apply. You may object to processing for direct marketing, including related profiling, at any time; that processing will then stop.

Technical access checks compare account, licence, payment or security information with the conditions for the requested access and may deny a request or require further authentication. Contact us if you believe a restriction is incorrect. Decisions falling within Article 22 GDPR are subject to its legal conditions and safeguards, including human intervention and an opportunity to contest the decision where required. A contractual restriction cannot waive those protections.

You may complain to a competent supervisory authority, particularly in the country of your habitual residence, place of work or alleged infringement. The authority for private-sector organisations in Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht.

Where Swiss law applies, its applicable access, correction, objection and other protections remain available, including the right to contact the Federal Data Protection and Information Commissioner. Where an applicable US state privacy law provides additional rights, you may exercise those rights through the contact above, including an applicable right to appeal a denied request. Consent-based advertising disclosures may constitute a sale, sharing or targeted advertising under some laws even without a payment for the data. Use the cookie settings to refuse that processing; legally applicable opt-out preference signals and restrictions on discrimination for exercising rights are respected. These statements apply within each law’s statutory scope and do not extend a statutory regime to a person or processing outside it.

Our services are intended for adults aged 18 or over. Do not create an account for a child. If you believe a child has provided information contrary to this requirement, contact us so we can investigate and take the legally required action.

15. Changes to this notice

We update this notice when our processing or applicable requirements change. The version date identifies the text. Where a new purpose requires further information or consent, we provide that information and obtain the necessary consent before the relevant processing. Continued use does not itself constitute consent to a new consent-dependent purpose.