Privacy Policy

01Who is responsible

Fyluxo is a brand operated by an individual sole trader, who is the controller of the personal data described here ("we", "us"). For any privacy question or request, write to support@fyluxo.com.

Where the law requires us to give you the operator's identity or postal address, we will provide them on request to that address.

02In short

• Most tools run in your browser: those files never reach us.
• Files sent to our servers for Compress PDF are deleted as soon as processing ends.
• AI documents (extracted text, questions, answers and results) are deleted automatically 24 hours after upload, or sooner if you delete them.
• For AI features we send the needed parts of your document to OpenAI, which may keep them for up to 30 days for abuse monitoring.
• We do not sell your data. Public pages (home, tool, category and workflow pages) load Google's ad code: visitors on the Free plan and visitors who are not signed in may see Google ads there, and Google may use cookies to serve them (see "Advertising"). Premium and Pro AI subscribers are not shown ads.
• Public pages also use Google Analytics to count visits. Google receives the page's path, never the rest of its address or anything you upload or type (see "Analytics").

03Files processed in your browser

These tools process files entirely on your device: Merge PDF, Split PDF, JPG to PDF, PDF to JPG, Compress Image, Resize Image, Compress Image to a target size, HEIC to JPG, JPG to PNG, PNG to JPG, WEBP to JPG, JPG to WEBP, Remove Whitespace and Clean Text. Their files are not sent to our servers and we never see them. Passing a result to the next tool also stays in your browser.

04Files processed on our servers

Compress PDF, and the compression step of Smart Workflows that include it, run on our servers:

• your file is sent over an encrypted (HTTPS) connection to a private temporary folder that only our application can access;
• when compression finishes, fails, is cancelled or your connection drops, the folder and your file are deleted; the result is streamed back to you and not kept;
• if a server stops unexpectedly, an automatic clean-up removes leftover temporary files at start-up and every 10 minutes, at the latest within 2 hours;
• we do not open, read, copy or share these files.

05AI Document Assistant

• Your uploaded file is processed in a private temporary folder to extract its text, then deleted. For text recognition (OCR) your browser sends the file again; it is deleted when the OCR job ends.
• What we store: the extracted text and file name, your questions and the assistant's answers, and operation results (summaries, translations, tables, recognized text). All of it is deleted automatically 24 hours after upload; you can delete it sooner with "Delete document".
• What we send to OpenAI: for operations that use an AI model, the parts of the document the operation needs: extracted text, your question, the recent conversation about that document (up to the last 6 questions and answers) or, for AI OCR, page images. Local OCR and local table extraction run on our servers and send nothing to OpenAI.
• How OpenAI handles it: we use OpenAI's API with response storage turned off. Under OpenAI's published API data policy, API data is not used to train its models; OpenAI keeps abuse-monitoring logs, which may contain prompts and responses, for up to 30 days (longer where the law requires or to protect its services or others from harm); images are scanned for child sexual abuse material, and flagged images are kept for review; prompt caching may keep encrypted temporary data for up to 24 hours. See OpenAI's API data policy.
• Deleting a document on Fyluxo deletes our copy only. We cannot delete data OpenAI keeps under its policy, and we do not have OpenAI's "Zero Data Retention" arrangement.
• Accounting: for each AI operation we keep its type, credits reserved and charged, token counts, measured cost and time. This record contains neither your document text nor your questions.

06Your account

• What we store: your email address, an optional name, your language, a securely hashed password (never the password itself), the date you confirmed your email, your plan, subscription status and credit balance.
• Sign-up: your account is created only when you open the confirmation link we email you. An unconfirmed sign-up (address, hashed password, name, language and a one-way hash of your network address) is deleted when its link expires, 24 hours later.
• Sessions: for each signed-in device we keep a hashed session token, the browser's user agent (shown to you as "browser on system"), a one-way hash of the IP address and the times it was created and last used, so you can review and sign out devices from your account page.

07Emails

We send only account emails: confirming your address, password resets, notices when your password or email address changes or your account is deleted, and notices about your payments (received, approved, rejected or refunded). If emails to an address bounce permanently or are reported as spam, we stop sending to it and keep a one-way fingerprint of the address (not the address itself) so we do not send again. We send no marketing emails.

08Payments

Payments through Paddle are not available yet.

When paid plans launch, and once our seller account with Paddle is approved and active, checkout and billing will be handled by Paddle.com as our Merchant of Record. Paddle will collect your payment details, billing address and tax information under its own privacy notice as an independent controller. We will receive from Paddle only what we need to run your subscription: your email address, plan, subscription status, billing dates, country and transaction identifiers. We will never receive your full card number.

Manual USDT payments. If you pay with USDT, we record for each order: your account, the plan, the network, the amount, the receiving address, the transaction ID you submit, the order's status and dates, and our verification decision with its reason (and, for a refund, what was refunded). Paddle is not involved. We never ask for or store your wallet's private keys or recovery phrase, and no card details are involved. To verify a payment we look the transaction up on public blockchain explorers such as Tronscan and BscScan; we do not send them your personal data.

Blockchain transactions are public. A USDT transfer is recorded permanently on a public blockchain: anyone can see the sending and receiving addresses, the amount and the time, and nobody, including us, can change or delete it. The link between a transaction and your Fyluxo account exists only in our records (and, if you paid from an exchange, in that exchange's records). Your wallet provider or exchange handles the transfer under its own terms and privacy notice.

09Free trial safeguards

To stop the one-time trial credits being claimed repeatedly, we keep a one-way cryptographic fingerprint of the email address that received them (after removing characters your provider ignores, such as dots in Gmail addresses) and a one-way hash of the network the request came from. A fingerprint cannot be turned back into your address, and it is kept after account deletion so the trial cannot be claimed again with the same address.

10Why we use your data

11Who processes your data

We share personal data only with the providers below, with professional advisers where needed, and with authorities where the law requires it. We do not sell personal data.

Your data may therefore be processed outside your country. We use providers that commit to protecting it under their data processing terms.

12How long we keep data

We do not store raw IP addresses in our database, only salted one-way hashes. Our own logs never contain file contents, file names, document text, email addresses or passwords.

13Analytics (Google Analytics)

To understand which tools and pages are useful, our public pages (the home page, the tool, category and workflow pages, pricing and these policies) use Google Analytics, a service of Google. Account, sign-in, emailed-link, checkout and payment, administration and AI Document Assistant pages do not send anything to it.

• What Google receives: the page's path (for example /en/tools/merge-pdf), never the rest of its address, the referring page or site (our own pages as a path, other sites as their domain only), your browser, device, screen size and language, your approximate location (country or city, estimated by Google from your IP address; Google Analytics does not log or store IP addresses), and interactions such as scrolling and clicks on links to other sites. It never receives your files, file names, documents, what you type, or your account details.
• Cookies: where allowed, Google Analytics sets the cookies listed below on our domain to tell visits and visitors apart.
• Consent: in the European Economic Area, the United Kingdom and Switzerland, Google Analytics stores no cookies unless you agree in the consent message from a consent management platform certified by Google, and you can change your choice at any time from that message. Until you agree, Google may receive measurements without cookies, which it uses only to estimate traffic in aggregate.
• Your choices: besides that consent message, you can block or delete cookies in your browser, or install the Google Analytics opt-out browser add-on.
• Google uses this information as described in How Google uses information from sites that use its services and Google's privacy policy.

14Advertising (Google AdSense)

To keep the core tools free, our public pages (the home page and the tool, category and workflow pages) load the advertising code of Google AdSense, and ads may be shown there to visitors on the Free plan and to visitors who are not signed in. Premium and Pro AI subscribers are not shown ads. Account, sign-in, checkout and payment, administration and AI Document Assistant pages never load ad code. Ads are labelled "Advertisement" and kept apart from the tools' buttons.

• Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
• When the ad code loads, Google receives information such as your IP address, browser and device details, the page you are viewing and identifiers stored in cookies or similar technologies, and uses it as described in How Google uses information from sites that use its services and Google's privacy policy. We do not receive this information, and nothing you upload or type in our tools or the AI Document Assistant is shared with Google.
• Personalized ads are chosen using what Google has learned about your interests from cookies or similar identifiers. Non-personalized ads are chosen from context, such as the page's content and your approximate location; they may still use cookies or similar technologies for frequency capping, aggregated reporting and preventing fraud and abuse.
• Your choices: you can turn off personalized ads from Google in Google's Ads Settings, and opt out of some third-party vendors' use of cookies for personalized advertising at www.aboutads.info (in Europe also www.youronlinechoices.eu). You can also block or delete cookies in your browser settings; the tools keep working.
• Consent: where the law requires your consent to advertising cookies (for example in the European Economic Area, the United Kingdom and Switzerland), ads are personalized only if you agree through a consent message from a consent management platform certified by Google, and you can change your choice at any time from that message. If you do not agree, Google may show non-personalized or limited ads.

15Cookies and local storage

Fyluxo itself uses only the storage the Service needs and your preferences. On public pages, Google Analytics may set the cookies listed below, and Google's ad code may set or read its own cookies and similar technologies, as described in "Analytics", "Advertising" and Google's list of cookies.

16Security

All traffic uses HTTPS. Passwords are stored only as salted scrypt hashes, emailed links and session tokens only as hashes, and IP addresses only as salted one-way hashes. Access to our hosting and database is limited to the operator and the people it authorizes.

17Your choices and rights

• Use the browser tools if you do not want a file to leave your device.
• Delete an AI document at any time.
• Turn off personalized ads, or change your consent choice, as described in "Advertising"; Premium and Pro AI subscribers are not shown ads.
• Opt out of Google Analytics as described in "Analytics".
• From your account page: change your email address and password, review and sign out devices, and delete your account. Deletion erases your email address, name, password, sessions, AI documents, usage counters and pending email links, forfeits remaining credits, and keeps only the records listed above without your name or email address.
• Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to complain to a data protection authority. To exercise a right, write to support@fyluxo.com; we answer within 30 days.

18Children

Fyluxo is intended for adults: you must be at least 18 to use it. We do not knowingly collect personal data of anyone younger; if you believe someone under 18 has given us personal data, write to support@fyluxo.com and we will delete it.

19Changes to this policy

We will update this page when our practices change and change the "Last updated" date. For significant changes we will also notify account holders by email.