1. Who we are
Fflipp (fflipp.com) is operated by JCAD Studio Limited, a company registered in New Zealand (NZBN 9429042135777), GridAKL / John Lysaght Building, 101 Pakenham Street West, Auckland 1010, New Zealand. We are responsible (the "controller") for the personal information described in this policy.
This policy explains what we collect, why, who we share it with, how long we keep it and your rights. Questions or requests: privacy@fflipp.com.
If you're a Business user who collects readers' details with a lead-capture form, you decide what to collect and why, so you are responsible for those details and we process them for you (see section 5).
2. Information we collect
When you create an account
- Your profile name, email address and password (stored as a secure hash, never in plain text). If you sign up with Google, LINE or Adobe, we receive your name, email address and an account ID from that service.
- Your age band. You enter your date of birth once to confirm you meet our minimum age. We use it to check your age and then discard it. We keep only whether you are 16–17 or 18 and over, and, for 16–17-year-olds, the month you turn 18.
- Your sign-up country, worked out from your IP address on our own server. We keep the country only, not the IP address.
- Where you came from, if you arrived through a link we track: the referring website's domain and any campaign tags in the link (for example "utm_source" or "ref=made-with"). We don't keep the full referring address.
- Your answers to two optional questions after sign-up: what you are making and who it is for. You can skip them.
- Your marketing choice (yes or no, and when and where you made it).
- A record of which versions of our Terms of Use, Acceptable Use Policy and Privacy Policy you accepted, and when.
When you buy something
- The date, amount, currency, what you bought, and Stripe's payment references.
- Your billing country and your card's issuing country. We need these to work out New Zealand GST and keep tax records.
- A record of the statements you ticked at checkout (for example, your request that the service starts straight away), with the wording version and time.
- We never see or store your full card number. Stripe handles payment details.
Content you upload
- Flipbooks, PDFs, images, video, audio, text, links and other material you add, plus the settings you choose (for example public, listed, password-protected or private).
When you use Fflipp
- Which features you use and actions you take in your account, used to run the service and produce totals.
- Standard technical information: IP address, browser and device type. IP addresses in our own records are deleted after 7 days.
When someone reads a flipbook
To give creators statistics, we record views, likes and lead-form submissions on each flipbook:
- the reader's country, worked out from their IP address on our own server using a self-hosted database (IP Geolocation by DB-IP); no IP address is sent to any outside company;
- the reader's IP address and a scrambled (hashed) code made from it, kept for 7 days only so we can match an "unlike" and count how many different readers opened a flipbook (for example, whether 3 or more different readers opened it within 7 days);
- creators only ever see totals, never readers' IP addresses or codes.
No statistics or third-party features are loaded on flipbooks marked as children's content beyond what is needed to show them.
Lead-capture forms (Business plan)
If a reader fills in a creator's lead-capture form, we store the details they enter (such as name and email) for that creator.
Security and abuse prevention
- On our email sign-up form we record, for each attempt, the email domain only (not the full address), the results of our anti-spam checks and the account number if one is created. The IP address is deleted after 7 days.
- Failed sign-in attempts: email address and IP address, deleted after 30 days.
- Google reCAPTCHA runs on our email sign-up form (see section 5).
When you contact us or report content
- Emails to support@, privacy@ or dmca@, and what you write in report or copyright forms, including your contact details if you give them.
3. How we use your information
- To run Fflipp: create and secure your account, host and show your flipbooks, process payments and give you the features of your plan.
- To check age: confirm you meet our minimum age, and keep adult (NSFW 18+) content away from accounts under 18 and visitors who aren't signed in.
- To give creators statistics: total views, likes and views by country. Creators never see readers' IP addresses.
- To understand and improve Fflipp: internal totals and rates, such as how many people sign up each week, which countries they come from, how many create a first flipbook, which links bring people to us, and how many flipbooks reach 3 or more readers. These are shown to us only as totals.
- To keep Fflipp safe: block spam and fake accounts, prevent abuse, and review reported content under our Acceptable Use Policy and Copyright Policy.
- For tax and accounting: work out GST and keep the records the law requires.
- To contact you:
- service emails you need, such as account confirmation, receipts, trial and renewal reminders, security notices and replies to your messages;
- a monthly account report about your own flipbooks, which you can switch off at any time;
- news, tips and offers, only if you opted in; you can unsubscribe at any time.
We don't sell your personal information, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects.
4. Our legal bases
Where laws such as the EU or UK GDPR apply, we rely on:
- Contract: running your account, hosting your content, payments and service emails.
- Legitimate interests: security and spam prevention; creator statistics; internal totals (sign-up country, sign-up source, onboarding answers, audience activation); handling reports; the monthly account report. We use the minimum data needed and you can object (section 8).
- Consent: marketing emails. You can withdraw consent at any time.
- Legal obligation: tax and accounting records; responding to valid legal requests, including copyright notices and reports to authorities about child safety.
5. Who we share it with
We don't sell your personal information. We share it only with these service providers, each for a specific job:
- Our web hosting provider (a United States company; cloud servers): hosts the website, database and files, sends our emails and runs automatic backups. It holds everything stored on Fflipp.
- Stripe: processes payments, subscriptions, refunds and invoices. It receives your name, email, payment details, billing country and what you bought.
- Google, LINE or Adobe: sign-in, only if you choose "Continue with Google / LINE / Adobe". You sign in on their page; they send us your name, email and account ID.
- Google reCAPTCHA: spam protection on our email sign-up form. It receives device and browser information and your IP address, under Google's privacy policy.
- YouTube, Vimeo and Google Maps: videos and maps inside flipbooks, loaded only when you press play or open the map. They receive your IP address and device information, under their own privacy policies.
Our country lookup (IP Geolocation by DB-IP) runs on our own server, so no IP address is sent to DB-IP.
Others who may receive information
- Creators see totals for their flipbooks. Business users receive the details readers enter in their lead-capture forms; they are responsible for how they use them.
- People who send copyright notices or counter-notices: to let the other side respond, we pass on the notice, including the sender's name and contact details (see our Copyright Policy). For all other reports, we never tell the owner who reported them.
- Authorities: when the law requires it, or to report content that endangers children.
- A buyer of our business, if Fflipp is sold or merged, under the terms of this policy.
A feature we removed
Until November 2026, an optional "Generate with AI" button on the flipbook creation page could send the text or images of the first pages of an uploaded PDF to OpenAI (USA) and Google Cloud Vision (USA) to suggest a title and description. No name or email address was sent. We switched this feature off on 5 November 2026 and no longer send content to either company.
6. International transfers
We are based in New Zealand. Our website is hosted by a United States web hosting company, on cloud servers that may be located in several countries, including the United States, and Stripe and the sign-in providers may process data in other countries. The European Union and the United Kingdom recognise New Zealand as providing adequate protection for personal data. Where data goes to a country without that recognition, we rely on our providers' data protection terms, including standard contractual clauses where they offer them.
7. How long we keep it
- Account details, age band, sign-up country, sign-up source, onboarding answers: while your account exists; deleted when you delete your account.
- Accounts never confirmed by email: deleted automatically after 30 days.
- Your flipbooks and uploads: until you delete them or your account.
- Readers' IP addresses and scrambled reader codes: 7 days.
- Reader statistics (country, counts): while the flipbook exists, as totals.
- Lead-capture details: until the creator deletes them or their account.
- Sign-up anti-spam log (email domain, check results): 90 days (the IP address within it: 7 days).
- Failed sign-in attempts: 30 days.
- Payment records, billing and card country, checkout statements: 7 years, as New Zealand tax law requires.
- Record of the Terms and policies you accepted: while your account exists, then 6 years after deletion, as proof of agreement (no email or IP address kept).
- Copyright notices, counter-notices and actioned reports: 3 years after closing.
- Reports where we took no action: 12 months; reporters' email addresses removed after 12 months.
- Support emails: 2 years.
- Automatic backups: overwritten within 7 days.
- Server logs kept by our host: a short time for security and running the service; we keep no archived copies beyond 30 days.
When you delete your account, we delete your data as described on our Data Deletion page, except what we must keep for the reasons above. Copies in automatic backups disappear within 7 days. If content is under review for child safety, we keep it, and pause account deletion, until the review ends.
8. Your rights
Depending on where you live, you can:
- ask for a copy of your personal information, including in a portable format;
- correct it;
- delete it (you can delete your account yourself in Edit My Account);
- object to, or ask us to limit, how we use it, including uses based on our legitimate interests;
- withdraw consent to marketing at any time (unsubscribe link or account settings);
- complain to a data protection authority, such as the New Zealand Privacy Commissioner, the UK Information Commissioner's Office, or the authority where you live in the EU.
Email privacy@fflipp.com from your account email. We reply within one month. If you can't sign in, tell us the email address on the account and we'll confirm it's you before acting.
9. Children
Fflipp accounts are for people aged 16 and over. We check age at sign-up and keep only an age band. Adult (NSFW 18+) content is hidden from accounts under 18 and from visitors who aren't signed in.
Creators can mark flipbooks as children's content. Readers of those flipbooks may include children, so we don't load optional features or third-party content on them until clicked, and we keep reader data to the minimum described in section 2. If you believe a child under 16 has an account, email privacy@fflipp.com and we'll delete it.
10. Security
We use HTTPS, store passwords as secure hashes, limit who can access personal information, and delete data on the schedules above. No system is completely secure. If a breach is likely to cause serious harm, we will tell affected users and the authorities as the law requires.
11. Cookies
We use only essential cookies, and no advertising or analytics cookies. See our Cookie Policy and use "Manage Cookie Preferences" in the footer at any time.
12. Fflipp Chrome Extension
The extension sends the address (URL) of a PDF you choose to convert to our servers, so we can turn it into a flipbook, and records basic usage (such as clicks) to improve it. It does not collect your browsing history, passwords or other personal information, and we don't sell or share its data.
13. Changes to this policy
When we make important changes, we'll email you before they take effect and show a notice on the site. Previous versions are available at /legal/archive.
14. Contact
Privacy questions and requests: privacy@fflipp.com · JCAD Studio Limited, GridAKL / John Lysaght Building, 101 Pakenham Street West, Auckland 1010, New Zealand.
