Privacy Policy

Privacy Policy

Effective: October 2026

Note: This English version is a translation of the German Datenschutzerklärung. In the event of any discrepancy, the German version shall prevail.

This Privacy Policy applies to the website flexling.com and all its subdomains (the "Website"), together with the Flexling web applications, the Flexling apps for iOS and Android, and the related services (the "Services"), operated by Paul Ermler (sole proprietorship, hereinafter "Flexling", "we", "us" or "our"). It describes how we collect, use, share and protect personal data and what rights you have.

1. Data Controller

Paul Ermler Sole Proprietorship Friedrich-Ebert-Straße 62 14467 Potsdam Germany Email: [email protected]

No Data Protection Officer has been appointed (not mandatory under Art. 37 GDPR for sole proprietorships without large-scale processing of special categories of data).

2. Definitions

Personal data means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR), including name, email address, IP address and usage behaviour.

3. Principles of Data Processing

We process personal data only where one of the following legal bases under Art. 6 GDPR applies:

• lit. a – Consent of the data subject
• lit. b – Necessity for the performance of a contract or pre-contractual measures
• lit. c – Compliance with a legal obligation
• lit. f – Legitimate interests (provided the interests of the data subject do not override)

We collect only data that is necessary for the respective purpose (data minimisation, Art. 5(1)(c) GDPR) and do not sell personal data.

4. What Data We Collect

4.1 Data You Provide

When registering for and using our Services, we collect:

• Name and email address
• Username and password (stored in encrypted form)

If you sign in with Apple or Google instead of a password, that provider confirms your identity to us and passes on your name and email address. With Apple you can choose to hide your email address; we then receive a relay address from Apple that forwards to you. We do not receive your Apple or Google password. If you sign in with Apple, we keep a token from Apple so that we can end the Apple sign-in when you delete your account. Apple and Google process the sign-in as independent controllers under their own privacy policies.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

4.2 Automatically Collected Data

When you visit our Website, our servers automatically log technical data from your browser: IP address, browser type and version, pages visited, date and time of the visit, and time spent on pages.

Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: technical operation, security and error diagnosis of our Website.

4.3 Data Generated Through App Use

When you actively use the Flexling application, the following data is created by you and stored by us:

• Flashcards and decks: Content of flashcards you create or import (front and back), deck names, settings and metadata such as creation date and last modified.
• AI chat messages: Messages you enter in the AI chat and the generated responses are stored to display the conversation history and ensure your experience.
• Learning progress and statistics: Card ratings, review timestamps, study session data and aggregated progress statistics.
• Offline study (Flexling apps for iOS and Android): So that you can keep studying without a connection, the app keeps some of your sentences ready on your device, with their audio: with a plan that includes offline study, the reviews due soon, new sentences, the start of Radio and Free Study, and the lists you choose to keep offline; without one, the next few sentences of the session you are in. These copies stay on your device and are left out of its backups. What you study offline (which sentence, when, the time spent and how accurate your answer was) is uploaded when the device is back online and kept on the device for up to three days after that; the answers you type are never uploaded. While it is on the device, this study record is part of the device's backup (iCloud, or Google's backup on Android); on an iPhone or iPad, so are your account ID and your offline pass (how long the app may run offline). To keep to the number of devices your plan allows, we store a random identifier for each app installation (the installation ID), its platform (e.g. iOS) and when it was last online, linked to your account; removing all downloads from a device frees its place.
• Voice recordings and transcriptions: When you use voice input, in the AI chat or to speak an answer in writing practice, your voice recording is transmitted via OpenRouter to a speech recognition model for transcription (see Section 6). The resulting text is stored as a chat message or used to check your answer; we do not retain the original audio after transcription.
• Uploaded content: Files and media you upload within the app (e.g. images or documents for card creation or in the chat) are processed and stored to the extent necessary to provide the respective feature.

Legal basis: Art. 6(1)(b) GDPR (performance of the service contract). This data is necessary to provide the core service.

4.4 Usage Analytics

We measure how our Services are used in order to improve them. Details on the provider are in section 5C.

• Without consent, measurement is cookieless: nothing is stored on or read from your device, no session recordings are made, and visits are counted using a server-side hash value that is regenerated daily. For signed-in users, individual usage events generated by our servers (for example that a message was sent or a course was created) are additionally linked to your pseudonymous account ID. Legal basis: Art. 6(1)(f) GDPR (legitimate interest: improving, securing, and managing the cost of our Services). You may object to this processing at any time (Art. 21 GDPR, see section 10).
• Only after your explicit consent via our cookie banner do we additionally use analytics cookies, record sessions (with all typed text masked in your browser), transmit the content of AI chat messages for quality analysis (see section 6), and load an advertising pixel that measures whether a visit from a ChatGPT ad led to a registration or subscription (see section 5C). Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

5. Third-Party Providers and Data Processors

We share data with the companies listed below, which act as data processors within the meaning of Art. 28 GDPR. A data processing agreement (DPA) or equivalent privacy agreement is in place with each of these providers. Data sharing is limited to the necessary minimum.

A) Required for Website Operation

Cloudflare (Cloudflare Inc., USA) Purpose: DNS, load balancing, DDoS protection, delivery of static content. Data: IP address, connection data. Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: security and availability of the Website. Third-country transfer: Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023, Art. 45 GDPR). Privacy policy: https://www.cloudflare.com/privacypolicy/

Hetzner (Hetzner Online GmbH, Germany/EU) Purpose: Server infrastructure (backend hosting). Data: IP address, stored user data. Legal basis: Art. 6(1)(b) and (f) GDPR. Processing exclusively within the EU/EEA. Privacy policy: https://www.hetzner.com/legal/privacy-policy/

Vercel (Vercel Inc., USA) Purpose: Frontend hosting and delivery of the Website. Data: IP address, technical connection data, access times. Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: reliable and fast provision of the Website. Third-country transfer: Secured by Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR. Privacy policy: https://vercel.com/legal/privacy-policy

| Provider | Purpose | Data | Location | |------------|------------------------------|------------------------|------------| | Cloudflare | Network, Security | IP address | USA (DPF) | | Hetzner | Server Infrastructure | IP address, User data | EU | | Vercel | Frontend Hosting | IP address | USA (SCCs) |

B) Required for the Web Application

Convex (Convex Inc., USA) Purpose: Backend database and real-time data synchronisation. Data: All personal user data stored in the application. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Third-country transfer: Secured by SCCs pursuant to Art. 46(2)(c) GDPR. Privacy policy: https://www.convex.dev/privacy

Stripe & Autumn (Stripe Inc., USA / Autumn, USA) Purpose: Sale of paid subscriptions, payment processing, and subscription management. For paid subscriptions Stripe acts as merchant of record, i.e. as the seller in its own name, and is therefore an independent controller for that transaction — it determines and collects the applicable tax, issues the receipt, and handles refunds, chargebacks, and transaction support. Autumn (useautumn.com) serves as a billing layer and forwards payment transactions to Stripe. Data: Name, email address, payment data, billing address, transaction data. A name and billing address are required at checkout because Stripe needs them to determine the applicable tax. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). These providers receive your data only when you make a purchase. Third-country transfer: Stripe is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Stripe privacy policy: https://stripe.com/privacy Autumn privacy policy: https://useautumn.com/privacy

Apple App Store, Google Play & RevenueCat (Apple Distribution International Ltd., Ireland / Google Commerce Ltd., Ireland / RevenueCat Inc., USA) Purpose: Sale and management of subscriptions bought inside the Flexling apps for iOS and Android. Subscriptions bought in an app are sold and billed by Apple or Google, which act as independent controllers for the purchase under their own privacy policies; we never receive your payment details. RevenueCat tells us which plan your account holds so that we can unlock it, and passes that status on to Autumn. Data: your pseudonymous account ID, purchase history (product, time of purchase and renewal, price, currency, storefront country, cancellation and refund status), app version, device type, operating system and IP address. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). RevenueCat receives data only when you use one of the Flexling apps for iOS or Android. Third-country transfer: Secured by SCCs pursuant to Art. 46(2)(c) GDPR. RevenueCat privacy policy: https://www.revenuecat.com/privacy Apple privacy policy: https://www.apple.com/legal/privacy/ Google privacy policy: https://policies.google.com/privacy

Resend (Resend Inc., USA) Purpose: Sending transactional emails (e.g. registration confirmation, password reset, system notifications). Data: Email address, message content. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Third-country transfer: Secured by SCCs pursuant to Art. 46(2)(c) GDPR. Privacy policy: https://resend.com/legal/privacy-policy

| Provider | Purpose | Data | Location | |----------------|----------------------------------|----------------------------------------|------------| | Convex | Database | All user data | USA (SCCs) | | Stripe/Autumn | Sale of subscriptions (Stripe as merchant of record), payment processing | Name, email, payment/billing data | USA (DPF) | | Apple/Google/RevenueCat | Sale of subscriptions in the iOS and Android apps, subscription status | Account ID, purchase history, device data | Ireland / USA (SCCs) | | Resend | Transactional Emails | Email address | USA (SCCs) |

C) Analytics and Optional Services

Emails about product news, your progress and offers are sent only after your explicit consent. For analytics, the legal basis is split as described for the service below: cookieless usage measurement rests on legitimate interest; everything that stores data on your device, records your screen, transmits AI chat content, or measures advertising conversions requires your consent via the cookie banner and can be withdrawn at any time.

Resend – Emails you have agreed to receive Only if you have agreed to it do we email you product news and learning tips (about once a month, occasionally with a question about how Flexling is working for you), a weekly summary of your learning progress, and occasional offers and discounts. We ask once, inside the app: when you create your account, or on the home screen if your account already existed. You choose each of these separately: you can agree to all of them, to some, or to none, switch each one on or off at any time under Settings, and unsubscribe through the link in every such email. Using Flexling does not depend on your answer.

We do not send a separate confirmation email. Your choice is recorded in your signed-in account, whose email address you have already confirmed, either by entering the code we emailed you or by signing in with Google or Apple.

If you agree, we pass your email address and your choices to Resend so that the emails can be delivered. If you have agreed to nothing, or have withdrawn every choice, no contact for you is kept at Resend.

Proof of consent. We must be able to prove that a consent was given. For each consent and each withdrawal we therefore record the kind of email concerned, the time, the version of the wording it relates to, and a hash value (SHA-256) of your email address instead of the address itself; for every choice you make yourself we also record the language the wording was shown in and how your email address had been confirmed. This record is pseudonymised, not anonymous. It is kept for three years after the consent ends, including after you delete your account (deleting your account ends your consents), and is used only to establish whether a consent existed. Data: Email address, choices per kind of email, timestamps; for the proof record, a hash value of the email address. Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 7(2) no. 2 UWG for sending the emails; Art. 6(1)(c) and (f) GDPR in conjunction with Art. 7(1) GDPR for keeping the proof record (legitimate interest: being able to demonstrate that consent was given).

Creator referrals and Tolt (Tolt, Inc., USA) Purpose: crediting and paying the creators and partners who recommend Flexling. If you arrive through a partner's link (flexling.com/r/…) or enter a creator's code, we save in your account which partner referred you, whether by link or code, and when. We report clicks on partner links, your sign-up, and the payments for your subscription, on the web or in our apps, to Tolt, the service that calculates our partners' commissions. Tolt receives neither your name nor your email address, only a random customer ID that only we can link to your account; partners see numbers of clicks, sign-ups, paying customers and commissions, never who you are. We also count the visits to each partner link in our product analytics (PostHog), again with only the link and the site that linked to it. Data: the partner and the link or code used, the time of the referral; for Tolt: the random customer ID, the time you signed up and, per payment, the amount we received after VAT and fees, the currency, your plan, the billing interval, the payment date, our payment reference and any refund or chargeback; for a click: the partner's link and the address of the website that linked to it (the site only, not the page), without your IP address. Legal basis: Art. 6(1)(f) GDPR (legitimate interest: paying our partners the commissions agreed with them). Tolt processes these data on our behalf under a data processing agreement (Art. 28 GDPR); transfers to the USA are based on the EU standard contractual clauses. The referral is deleted with your account; the pseudonymous payment and commission records in Tolt are kept as long as tax law requires us to keep accounting records. Whether a creator's link is also remembered in a cookie is up to you (see section 7).

Partners in our creator programme If you take part in our creator programme as a partner, we process your name, your partner name, your contact details, your payout and tax details, and the clicks, sign-ups, payments and commissions attributed to you, to run the programme, pay your commission and issue self-billed invoices (Gutschriften). Legal basis: Art. 6(1)(b) GDPR (the partner agreement) and Art. 6(1)(c) GDPR (tax and accounting duties). Tolt keeps your partner account and these figures on our behalf, as described above; for your own login to Tolt's partner portal, Tolt's privacy policy applies as well. Payouts go through your bank or PayPal. You never learn who the users you referred are. We keep partner data for the length of the partnership and afterwards as long as tax law requires us to keep accounting records.

PostHog (PostHog Inc., USA / EU server Frankfurt) Purpose: Product analytics, session replay, and error reporting. Data:

• Product analytics: pages visited, clicks, navigation, feature usage, device and browser information, IP address; for signed-in users additionally server-side usage events (for example number of messages sent, cards added, plan changes) linked to your pseudonymous account ID.
• Session replay (only with consent): a reconstruction of your screen and interactions within the application. All text you type into form fields is masked in your browser before transmission and never reaches PostHog. Email addresses shown in the application are likewise masked. Recording is disabled entirely on administrative pages.
• Error reporting: error messages, stack traces, and the technical context of a failure.
• AI usage: see section 6 — with your consent, the content of AI chat messages is also transmitted to PostHog.

Legal bases:

• Product analytics and error reporting without device storage: Art. 6(1)(f) GDPR (legitimate interest: improving, securing, and managing the cost of our Services). Without your consent, measurement is cookieless: nothing is stored on or read from your device, no session recording takes place, and visits are counted using a server-side hash value that is regenerated daily. You may object to this processing at any time (Art. 21 GDPR, see section 10).
• Analytics cookies, session replay, and AI content: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (consent via the cookie banner, withdrawable at any time via the "Cookie settings" link).

Retention: analytics events and error reports are retained for up to 12 months; session recordings for up to 30 days. Third-country transfer: Data is processed on EU servers in Frankfurt; where processing occurs outside the EU, secured by SCCs. Privacy policy: https://posthog.com/privacy

OpenAI – Advertising conversion measurement (OpenAI Ireland Ltd. / OpenAI Inc., USA) Purpose: Measuring whether a visit that started from an advertisement in ChatGPT led to a registration or a paid subscription, so that we can evaluate the effectiveness of our advertising campaigns. This is separate from the AI features described in section 6. How it works: Only after your consent, a measurement script (the "OpenAI pixel") is loaded from bzrcdn.openai.com and reports to bzr.openai.com. If you arrived via a ChatGPT ad, the ad link carries a click identifier (oppref), which the script stores in a cookie so that a later registration or subscription can be attributed to that ad. Without consent, the script is never loaded and no data reaches OpenAI. Data: click identifier, browser identifier, the conversion event (registration completed; subscription or trial started, including the plan name), a pseudonymous event identifier derived from your account ID (used only to avoid double counting), page URL, IP address, and browser information. No name, email address, or content of your learning material is transmitted. Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (consent via the cookie banner, withdrawable at any time via the "Cookie settings" link). Withdrawing deletes the pixel's cookies on your device. Retention: Apart from the device-side entries listed in section 7, we do not store these data ourselves. Retention at OpenAI is governed by its privacy policy. Third-country transfer: OpenAI is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Privacy policy: https://openai.com/policies/privacy-policy

| Provider | Purpose | Data | Location | |-------------|---------------------|-------------------------------|---------------| | Resend | Emails you agreed to | Email address, your choices | USA (SCCs) | | PostHog | Product analytics, session replay, error reporting | IP, clicks, usage behaviour, masked screen recordings, error reports, AI chat content | EU (Frankfurt) | | OpenAI | Advertising conversion measurement (ChatGPT ads) | Click identifier, conversion event, IP, browser information | USA (DPF) |

6. AI Features and Third-Party AI Services

Flexling uses AI-powered features. When you use the AI chat or other AI features of our application, your messages and, where applicable, relevant context data are transmitted to external AI providers for processing. We inform you that you are interacting with an AI system. Messages entered in the AI chat are stored by us. Please do not enter particularly sensitive personal data (e.g. health data, financial data) in the AI chat.

We use the following AI providers:

OpenAI (OpenAI Ireland Ltd. / OpenAI Inc., USA) Purpose: Processing user queries and generating AI responses. Data: Message content, query context. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). A DPA is in place with OpenAI. Third-country transfer: OpenAI is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Privacy policy: https://openai.com/policies/privacy-policy

Google (Google Ireland Ltd. / Google LLC, USA) – AI Services (e.g. Gemini) and Cloud Text-to-Speech Purpose: Processing user queries via Google AI services and speech synthesis (text-to-speech) to generate audio output for flashcard content. Data: Message content, query context, text content (when using speech synthesis). Legal basis: Art. 6(1)(b) GDPR. A DPA is in place with Google. Third-country transfer: Google is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Privacy policy: https://policies.google.com/privacy

OpenRouter (OpenRouter Inc., USA) Purpose: Gateway to various AI models and providers. Via OpenRouter, requests are forwarded to the AI models available on the OpenRouter platform. This includes speech recognition (audio transcription) of your voice input, currently by Microsoft (MAI-Transcribe) and Google (Gemini), and speech synthesis, currently by MiniMax and ElevenLabs. Data: Message content, query context, audio data (voice recordings when using voice input), text content (when using speech synthesis). Legal basis: Art. 6(1)(b) GDPR. A DPA is in place with OpenRouter. Third-country transfer: Secured by SCCs pursuant to Art. 46(2)(c) GDPR. Privacy policy: https://openrouter.ai/privacy

PostHog (PostHog Inc., USA / EU server Frankfurt) – AI usage analysis Purpose: Analysing the use, quality, and cost of our AI features. Data: Technical metadata of each AI call (model used, response time, token count, cost), linked to your pseudonymous account ID. With your consent, additionally the content of AI chat messages and the corresponding AI responses. Legal basis: technical metadata Art. 6(1)(f) GDPR (legitimate interest: cost control and quality assurance); message content Art. 6(1)(a) GDPR (consent, granted via the cookie banner). If you decline, no AI content is transmitted to PostHog. Third-country transfer: Data is processed on EU servers in Frankfurt. Privacy policy: https://posthog.com/privacy

| Provider | Purpose | Data | Location | |-------------|----------------------------------|--------------------------------|-----------------| | OpenAI | AI Responses | Message content | USA (DPF, DPA) | | Google | AI Responses, Text-to-Speech | Message content, text content | USA (DPF, DPA) | | OpenRouter | AI Gateway (multi-model), Transcription, Text-to-Speech | Message content, audio data, text content | USA (SCCs, DPA) | | PostHog | AI usage analysis | Call metadata; content only with consent | EU (Frankfurt) |

7. Cookies and Consent

We use cookies and similar technologies in accordance with § 25 TDDDG and Art. 6 GDPR.

Strictly necessary cookies: These are required for the operation of the Website and are set without consent. Legal basis: § 25(2)(2) TDDDG in conjunction with Art. 6(1)(f) GDPR. These are: your login session, your selected interface language, and your sidebar layout preference.

Analytics cookies: These are set only after your explicit consent via our cookie banner and are used for PostHog (see section 5C). Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

Advertising conversion cookies: Also only after your explicit consent, the OpenAI advertising pixel (see section 5C) stores the cookies __oppref (click identifier of a ChatGPT ad), __obref (browser identifier), and __oaiq_consent together with the local storage entry oaiq_consent (your consent status for the pixel). We additionally keep local storage entries prefixed flexling_oaiq_ that record which conversions have already been reported from this browser, so that none is counted twice. Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. All of these are deleted when you withdraw your consent.

Creator referral cookie: If a creator's link brought you to our website and you agree to it ("Accept all" in the cookie banner, or the "Creator referrals" switch in the cookie settings), we keep the link's name in the cookie flx_ref for 60 days, so that the creator is credited if you create an account later (see section 5C). Your choice itself is kept in the local storage entry flx_referral_consent. Without your consent, the referral is kept only while you stay on the website. The cookie is never set in our app-store apps. Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. The cookie is deleted when you withdraw your consent.

We do not use any other marketing or advertising cookies.

Until you make a choice, nothing is stored on or read from your device beyond the strictly necessary cookies above.

You may withdraw or change your consent at any time via the "Cookie settings" link in the footer of every page. In addition, you can restrict or disable the use of cookies at browser level; this may affect the functionality of our Services.

8. Data Security

We implement technical and organisational measures (TOMs) pursuant to Art. 32 GDPR to protect your data against unauthorised access, loss, destruction or misuse. Data transmission between your browser and our servers is encrypted via HTTPS/TLS. Access to personal data is restricted to individuals who require this information to provide, develop or improve our Services.

9. Retention and Deletion

We store personal data only for as long as is necessary for the respective processing purpose or as required by statutory retention periods (e.g. tax-law retention obligations under § 147 AO for invoice data: 10 years).

You can ask us to delete your account at any time: in the app under Settings → Delete account, or by email to [email protected] from the address of your account. We then delete all personal data associated with your account – including messages stored in the AI chat – within 30 days, unless statutory retention obligations apply. One record is kept beyond that: the pseudonymised proof of consent for emails you had agreed to receive, for three years after the consent ends (see section 5, "Resend – Emails you have agreed to receive").

Deleting your account does not cancel a subscription you bought in the Apple App Store or on Google Play, because only the store can do that. Please cancel it in your App Store or Google Play account settings first.

The steps, with and without the app, are also on a page of their own: Delete your account.

10. Your Rights as a Data Subject

Under the GDPR, you have the following rights, which you may exercise at any time:

• Withdraw consent (Art. 7(3) GDPR) – You may withdraw any consent given at any time with effect for the future.
• Access (Art. 15 GDPR) – You have the right to obtain information about whether and what personal data we process about you.
• Rectification (Art. 16 GDPR) – You have the right to have inaccurate or incomplete data corrected.
• Erasure (Art. 17 GDPR) – You have the right to request the deletion of your data, provided no retention obligations apply.
• Restriction of processing (Art. 18 GDPR) – You have the right to request the restriction of processing under certain conditions.
• Data portability (Art. 20 GDPR) – You have the right to receive your data in a structured, machine-readable format.
• Objection (Art. 21 GDPR) – You have the right to object to the processing of your data where it is based on Art. 6(1)(f) GDPR (legitimate interest).

Objection to advertising and withdrawal of consent to emails. You can stop the emails you agreed to receive at any time, free of charge and without giving a reason: through the unsubscribe link in every such email, under Settings in the app, or by writing to [email protected]. It takes effect immediately and does not affect emails sent before it.

To exercise your rights, please contact: [email protected]

Right to lodge a complaint: You have the right to lodge a complaint with the competent data protection supervisory authority. The authority responsible for our registered office in Potsdam is:

Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg Stahnsdorfer Damm 77, 14532 Kleinmachnow https://www.lda.brandenburg.de

11. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes in the legal framework or our services. The current version is always available at: https://flexling.com/legal/privacy

As of: October 2026