Privacy Policy

1. Who we are

Fflipp (fflipp.com) is operated by JCAD Studio Limited, a company registered in New Zealand (NZBN 9429042135777). Our contact details are in section 14.

JCAD Studio Limited decides how and why the personal information described in this policy is used (in data protection law, we are the "controller"), with two exceptions where you are in control and we only handle the information on your behalf:

• personal information about other people that you include in content you upload or publish, such as names or photos in a flipbook; and
• details that readers enter in your lead-capture forms.

For that information, you are responsible for having the right to use it and for complying with the privacy laws that apply to you, as set out in our Terms of Use and Acceptable Use Policy.

This policy explains what we collect, why, who we share it with, how long we keep it and your rights. Questions or requests: privacy@fflipp.com.

How we handle lead-capture details for creators is explained in section 5.

2. Information we collect

To open an account we need your email address, a password (or a sign-in with Google, LINE or Adobe) and your age band. Everything marked optional below is up to you.

When you create an account

• Your profile name, email address and password (stored as a secure hash, never in plain text). If you sign up with Google, LINE or Adobe, we receive your name, email address and an account ID from that service.
• Your age band. You enter your date of birth once to confirm you meet our minimum age. We use it to check your age and then discard it. We keep only whether you are 16–17 or 18 and over, and, for 16–17-year-olds, the month you turn 18.
• Your sign-up country, worked out from your IP address on our own server. We keep the country only, not the IP address.
• Where you came from, if you arrived through a link we track: the referring website's domain and any campaign tags in the link (for example "utm_source" or "ref=made-with"). We don't keep the full referring address.
• Your answers to two optional questions after sign-up: what you are making and who it is for. You can skip them.
• Your marketing choice (yes or no, and when and where you made it).
• A record of which versions of our Terms of Use, Acceptable Use Policy and Privacy Policy you accepted, and when.

When you buy something

• The date, amount, currency, what you bought, and Stripe's payment references.
• Your billing country and your card's issuing country. We need these to work out New Zealand GST and keep tax records.
• A record of the statements you ticked at checkout (for example, your request that the service starts straight away), with the wording version and time.
• We never see or store your full card number. Stripe handles payment details.

Content you upload

• Flipbooks, PDFs, images, video, audio, text, links and other material you add, plus the settings you choose (for example public, listed, password-protected or private).

When you use Fflipp

• Which features you use and actions you take in your account, used to run the service and produce totals.
• Standard technical information: IP address, browser and device type. IP addresses in our own records are deleted after 7 days, except failed sign-in records (30 days).

When someone reads a flipbook

To give creators statistics, we record views, likes and lead-form submissions on each flipbook:

• the reader's country, worked out from their IP address on our own server using a self-hosted database (IP Geolocation by DB-IP); no IP address is sent to any outside company;
• the reader's IP address and a scrambled (hashed) code made from it, kept for 7 days only so we can match an "unlike" and count how many different readers opened a flipbook (for example, whether 3 or more different readers opened it within 7 days);
• creators only ever see totals, never readers' IP addresses or codes.
• this does not apply to flipbooks marked as children's content (see section 9).

Lead-capture forms (Business plan)

If a reader fills in a creator's lead-capture form, we store the details they enter (such as name and email) for that creator.

Security and abuse prevention

• On our email sign-up form we record, for each attempt, the email domain only (not the full address), the results of our anti-spam checks and the account number if one is created. The IP address is deleted after 7 days.
• Failed sign-in attempts: email address and IP address, deleted after 30 days.
• Google reCAPTCHA checks our email sign-up form for bots (see section 5).

When you contact us or report content

• Emails to support@, privacy@ or dmca@, and what you write in report or copyright forms, including your contact details if you give them.

2A. Information we get from other people

Sometimes we receive information about you from someone else:

• Sign-in providers. If you choose "Continue with Google / LINE / Adobe", that service sends us your name, email address and account ID. You authorise this when you choose that option.
• Stripe. When you pay, Stripe tells us whether the payment worked and your card's issuing country, for payments and tax records.
• People who report content. If someone reports your flipbook, or sends a copyright notice about it, we receive what they tell us about you and your content. We use it only to review the report under our Acceptable Use Policy and Copyright Policy, and we tell you when content is placed under review.
• Creators' lead-capture forms. Readers give their details to a creator through the creator's form; see section 5.

You can ask to see and correct information we hold about you (section 8). We may withhold details that would identify someone who reported content, other than a copyright claimant, or that would harm an ongoing review.

3. How we use your information

• To run Fflipp: create and secure your account, host and show your flipbooks, process payments and give you the features of your plan.
• To check age: confirm you meet our minimum age, and hide adult (NSFW 18+) content from visitors who aren't signed in and from accounts whose age band is under 18.
• To give creators statistics: total views, likes and views by country. Creators never see readers' IP addresses.
• To understand and improve Fflipp: internal totals and rates, such as how many people sign up each week, which countries they come from, how many create a first flipbook, which links bring people to us, and how many flipbooks reach 3 or more readers. These are shown to us only as totals.
• To keep Fflipp safe: block spam and fake accounts, prevent abuse, and review reported content under our Acceptable Use Policy and Copyright Policy.
• For tax and accounting: work out GST and keep the records the law requires.
• To contact you:
  • service emails you need, such as account confirmation, receipts, trial and renewal reminders, security notices and replies to your messages;
  • a monthly account report about your own flipbooks, which you can switch off at any time;
  • news, tips and offers, only if you opted in; you can unsubscribe at any time.

We don't sell your personal information, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects.

4. Our legal bases

Where laws such as the EU or UK GDPR apply, we rely on:

• Contract: running your account, hosting your content, payments and service emails.
• Legitimate interests: security and spam prevention; creator statistics; internal totals (sign-up country, sign-up source, onboarding answers, audience activation); handling reports; the monthly account report. We use the minimum data needed and you can object (section 8).
• Consent: marketing emails. You can withdraw consent at any time.
• Legal obligation: where EU or UK law requires it, for example VAT records if we are registered there.
• Our legitimate interests also include complying with the other laws we are subject to, such as New Zealand tax law, responding to copyright notices, and reporting content that endangers children to the authorities.

5. Who we share it with

We don't sell your personal information. We share it only with these service providers, each for a specific job:

• Our web hosting provider (a United States company; cloud servers): hosts the website, database and files, sends our emails and runs automatic backups. It holds everything stored on Fflipp.
• Stripe: processes payments, subscriptions, refunds and invoices. It receives your name, email, payment details, billing country and what you bought.
• Google, LINE or Adobe: sign-in, only if you choose "Continue with Google / LINE / Adobe". You sign in on their page; they send us your name, email and account ID.
• Google reCAPTCHA (Google Cloud): bot and abuse protection on our email sign-up form. Google processes device and browser information and your IP address for us, as our service provider, and may set a security cookie (_GRECAPTCHA).
• YouTube, Vimeo and Google Maps: videos and maps inside flipbooks, loaded only when you press play or open the map. They receive your IP address and device information, under their own privacy policies.

Our country lookup (IP Geolocation by DB-IP) runs on our own server, so no IP address is sent to DB-IP.

Others who may receive information

• Creators see totals for their flipbooks. Business users receive the details readers enter in their lead-capture forms and are responsible for how they use them. For those details we act as the creator's service provider: we use them only to run the form, pass any request from a reader about their details to the creator, and delete them when the creator deletes them or their account.
• People who send copyright notices or counter-notices: to let the other side respond, we pass on the notice, including the sender's name and contact details (see our Copyright Policy). For all other reports, we never tell the owner who reported them.
• Authorities: when the law requires it, or to report content that endangers children.
• A buyer of our business, if Fflipp is sold or merged, under the terms of this policy.

A feature we removed

From 30 December 2025 until 5 November 2026, an optional "Generate with AI" button on the flipbook creation page could send the text or images of the first pages of an uploaded PDF to OpenAI (USA) and Google Cloud Vision (USA) to suggest a title and description. This could include pages of any uploaded PDF, including books later marked as children's content. No name or email address was sent. According to the providers' published API terms, this content was not used to train their AI models, and OpenAI may keep API inputs for up to 30 days for abuse monitoring. We switched this feature off on 5 November 2026 and no longer send content to either company.

6. International transfers

We are based in New Zealand. Our website is hosted by a United States web hosting company, on cloud servers that may be located in several countries, including the United States, and Stripe and the sign-in providers may process data in other countries. The European Union and the United Kingdom recognise New Zealand as providing adequate protection for personal data. Where data goes to a country without that recognition, we rely on our providers' data protection terms, including standard contractual clauses where they offer them.

7. How long we keep it

• Account details, age band, sign-up country, sign-up source, onboarding answers: while your account exists; deleted when you delete your account.
• Accounts never confirmed by email: deleted automatically if not confirmed within 30 days after our confirmation reminder (the reminder email gives the exact date).
• Your flipbooks and uploads: until you delete them or your account.
• Readers' IP addresses and scrambled reader codes: 7 days.
• Reader statistics (country, counts): while the flipbook exists, as totals.
• Lead-capture details: until the creator deletes them or their account.
• Sign-up anti-spam log (email domain, check results): 90 days (the IP address within it: 7 days).
• Failed sign-in attempts: 30 days.
• Payment records, billing and card country, checkout statements: 7 years, as New Zealand tax law requires.
• Record of the Terms and policies you accepted: while your account exists, then 6 years after deletion, as proof of agreement (no email or IP address kept).
• Copyright notices, counter-notices and actioned reports: 3 years after closing.
• Reports where we took no action: 12 months; reporters' email addresses removed after 12 months.
• Support emails: 2 years.
• Automatic backups: overwritten within 7 days.
• Our web-server access logs (including IP addresses): deleted after 35 days.
• Security logs kept by our hosting provider itself: for a limited period under its own practices, which we don't control.

When you delete your account, we delete your data as described on our Data Deletion page, except what we must keep for the reasons above. Copies in automatic backups disappear within 7 days. If content is under review for child safety, we keep it, and pause account deletion, until the review ends.

8. Your rights

Depending on where you live, you can:

• ask for a copy of your personal information, including in a portable format;
• correct it;
• delete it (you can delete your account yourself in Edit My Account);
• object to, or ask us to limit, how we use it, including uses based on our legitimate interests;
• withdraw consent to marketing at any time (unsubscribe link or account settings);
• complain to a data protection authority, such as the New Zealand Privacy Commissioner, the UK Information Commissioner's Office, or the authority where you live in the EU.

Email privacy@fflipp.com from your account email. We reply within 20 working days, and in any case within one month. If you can't sign in, tell us the email address on the account and we'll confirm it's you before acting.

9. Children

Fflipp accounts are for people aged 16 and over. We check age by asking for your date of birth at sign-up; we don't verify it with identity documents, and we keep only an age band. Explicit sexual content is not allowed on Fflipp. Other adult (NSFW 18+) content is hidden from visitors who aren't signed in and from accounts whose age band is under 18.

Creators can mark a flipbook as children's content (made mainly for children under 16) in its settings, and we may mark it ourselves. Readers of those flipbooks may include children, so on them we record only a total view count: we don't store readers' IP addresses, scrambled codes or countries, likes from visitors who aren't signed in are turned off, and third-party content (such as videos) loads only when clicked. If you believe a child under 16 has an account, email privacy@fflipp.com and we'll delete it.

10. Security

We use HTTPS, store passwords as secure hashes, limit who can access personal information, and delete data on the schedules above. No system is completely secure. If a breach affects personal information, we will notify regulators and affected users as required by applicable law.

11. Cookies

Our own site uses only essential cookies, and no advertising or analytics cookies. Google reCAPTCHA, which protects our email sign-up form, may set a security cookie (_GRECAPTCHA) when that form is used. See our Cookie Policy and use "Manage Cookie Preferences" in the footer at any time.

12. Fflipp Chrome Extension

The extension doesn't collect usage data and doesn't create any ID. Only when you click it does it open fflipp.com with the web address (URL) of the PDF you are viewing, so we can turn it into a flipbook. If you are signed in, that address is linked to your Fflipp account for the conversion. We hold the address only in your session (it also appears in our web-server logs, which are deleted after 35 days), and we delete our downloaded copy of the PDF within 24 hours unless you save it as a flipbook. The extension does not collect your browsing history, passwords or other personal information, and we don't sell or share its data. Our use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

13. Changes to this policy

When we make important changes, we'll email you before they take effect and show a notice on the site. Previous versions are available at /legal/archive.

14. Contact

Privacy questions and requests: privacy@fflipp.com · JCAD Studio Limited, GridAKL / John Lysaght, 101 Pakenham Street West, Wynyard Quarter Innovation Precinct, Auckland 1010, New Zealand.