Privacy policy

1. Who we are

FilePlume (“FilePlume”, “we”, “us”) operates the online file conversion and utility tools available at tools.fyloxen.tech and any FilePlume domain that replaces it. This policy explains what we collect, why we collect it, and how long we keep it.

For privacy questions, data requests, or complaints, contact support@fyloxen.store. We aim to respond within 30 days.

2. Information we collect

Files and job data: the file you upload, its filename, size and MIME type, the tool used, the options you select, the job identifier, and the output file. We process this information to perform the conversion you requested.

Account data: if you create an account or sign in with Google, we receive your name, email address, profile image, and a provider identifier. Passwords are stored only as salted PBKDF2 hashes; we never store plaintext passwords.

Technical data: IP address, browser and device type, user agent, timestamps, requested URLs, HTTP status, error messages, and rate-limit counters. We use this to operate the service, diagnose failures, and prevent abuse.

Communications: messages you send to support, including any attachments you choose to include.

3. How we use information

To provide the service: receive, scan, convert, store temporarily and deliver files; maintain job status; and return download links.

To secure the service: detect malware, abuse, automated scraping and attacks; enforce rate limits; and investigate incidents.

To operate and improve: measure reliability, diagnose errors, and understand which tools are used. We use aggregated data where possible.

To communicate: send verification, security and support messages. We do not send marketing email without consent.

To comply with law: respond to lawful requests and enforce our terms.

4. Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the conversion you requested); legitimate interests (security, abuse prevention and service reliability); consent (optional analytics or marketing, where required); and legal obligation (tax, accounting and lawful requests).

You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Files, processing and retention

Uploads are processed for the job only. Files may be written to short-lived scratch storage when a tool requires a file on disk. They are deleted when the job completes or when the retention window ends, whichever is sooner. The current retention window is up to 60 minutes.

Output files are deleted on the same schedule, and download links expire. We do not index, publish, sell, or use uploaded files to train models.

Uploads are scanned with ClamAV before processing. A file that fails the scan is rejected and deleted; the job is blocked rather than returning an unscanned output.

Account data is kept until you delete your account or ask us to delete it. Support messages are kept for up to 24 months. Server logs are kept for up to 30 days, unless needed for an ongoing security investigation. Backup copies may persist for up to 30 days before rotation.

6. Sharing and subprocessors

We do not sell personal data. We share data only with service providers that help us run FilePlume, under contracts that limit their use of the data: cloud hosting and object storage (including Cloudflare R2), transactional email delivery, error monitoring, and payment processing where applicable.

We may disclose data if required by law, to protect rights or safety, or in connection with a merger, acquisition or sale of assets. We will notify you where required.

7. International transfers

Our providers may process data in countries other than yours. Where required, we use appropriate safeguards such as Standard Contractual Clauses and equivalent contractual protections.

8. Security

Traffic is protected with TLS. Services run in containers with dropped capabilities and resource limits. Access to production systems is restricted and logged. Files are scanned for malware, and job data is separated by job identifier.

No method of transmission or storage is completely secure. If you believe your data has been compromised, contact us immediately.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, receive a portable copy of your data, and withdraw consent. EEA and UK users may lodge a complaint with their local supervisory authority.

India: under the Digital Personal Data Protection Act, 2023, you may request access, correction, erasure and grievance redressal. Our grievance contact is support@fyloxen.store.

California: you may request to know, delete or correct personal information, and to opt out of sale or sharing. We do not sell personal information.

10. Children

The service is not directed to children. We do not knowingly collect personal data from children under 18, or under the age of digital consent in your country. If you believe a child has provided data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the service or the law changes. The current version is always published on this page, with the date below. Material changes will be announced on the site.

12. Contact

Privacy questions, data requests and security reports: support@fyloxen.store. We respond within 30 days, or sooner where required by law.