Privacy Policy

Flexam Technologies GmbH

Version: 15 September 2026 · Effective 15 September 2026

1. Who we are

The controller responsible for the processing described here is:

Flexam Technologies GmbH
Dr.-Karl-Lueger-Platz 5
1010 Vienna
Austria

Email: hello@flexam.tech
Website: https://flexam.tech

2. Scope

This Privacy Policy applies to flexam.tech and its subdomains, including our public website, the Flexam Platform and the shared Flexam account used across it, and our authenticated product applications:

  • Flexam Slicer — preparing and slicing models for robotic additive manufacturing
  • Flexam Toolpath Editor — reviewing and editing machine code

Not every processing activity described below applies to every product. Where something applies only to a specific product or only when you use a specific feature, we say so.

3. Account and authentication data

To use our authenticated products you need an account. We process the identifier, email address, display name, and group or role assignments held for your account, together with sign-in events and related security records.

We also record that you accepted the Terms of Use and this Privacy Policy, including the versions displayed to you and the time you continued past the notice. That acceptance is what lets you use the products; it is a different record from the three optional choices in section 6, and from the fact that you were shown an updated notice, which we record separately and which does not by itself change any of those choices.

Legal basis: Art. 6(1)(b) GDPR to provide the account and the product functionality you request, and Art. 6(1)(f) GDPR for the security and integrity of the sign-in process.

4. Product use and technical data

When you use our products we process technical data needed to deliver and operate them, such as IP address, date and time of access, browser and device information, requested pages or endpoints, errors, and performance data. Our applications and infrastructure keep operational logs for this purpose.

Legal basis: Art. 6(1)(b) GDPR to provide the requested functionality, and Art. 6(1)(f) GDPR for security, reliability, abuse prevention, and necessary diagnostics.

5. Cookies and local storage

Our public website uses only storage required for basic functionality and security.

In our product applications, cookies and browser local storage are also used to keep you signed in, to remember interface preferences and the acceptance you have given, and — where the product analytics described in the next section are active — by our analytics provider to recognise a returning session. We do not use advertising or remarketing cookies.

6. Product analytics and session replay

Selected Flexam applications use PostHog, in its EU region, to understand how features are used, to diagnose problems, and to improve the product. We have a data processing agreement in place with PostHog.

Depending on how the product is configured, the data processed through PostHog may include:

  • a user or account identifier
  • page or screen views
  • clicks and product actions
  • browser and device data
  • network information derived from your IP address
  • errors and performance data
  • session replay — a reconstruction of your interaction with the application

Session replay records how the application appeared and behaved while you used it. This can include the content visible on screen within the application at that time.

We do not use PostHog for advertising, and we do not use it to train AI models.

Three separate controls. Product analytics, AI diagnostics (section 7) and session replay are independent. Each can be switched off on its own, at any time, in Privacy settings: in the Slicer from the account menu, and in the Toolpath Editor from the toolbar menu. The setting belongs to your Flexam account, so a change applies to both products and to your other devices.

Switching any of them off does not disable the products or AI features, and does not end your access. Data needed to provide the service, keep your account secure and process your requests is still handled as described in this policy.

Switching a control off stops future collection for that purpose. It does not by itself delete data already collected; that is covered by retention in section 12 and by your rights in section 13.

When you first enter the Flexam Platform you are shown a short notice describing this processing, with a Continue action. Our applications are built so that optional collection does not begin before that action: analytics start opted out, and the recorder is not started, so there is no earlier recording to upload later. Ordinary technical requests needed to load the application still occur, as described in section 4.

Legal basis: where this processing relies on consent, that is Art. 6(1)(a) GDPR. Storing or accessing information on your device is subject to separate requirements, which this processing is assessed against independently. You can change any of the three controls yourself in Privacy settings, or contact us at hello@flexam.tech. Withdrawal takes effect for future processing.

7. AI-powered features

Some Flexam products offer features powered by large language models. Where you invoke such a feature, the content you submit to it — together with the operational context needed to answer, such as the relevant file or machine-code content — is transmitted to the AI provider configured for that feature and processed to generate a response.

We currently use Google Cloud (Vertex AI) and OpenAI as AI providers for these features. This applies only where an AI-powered feature is enabled and you actively use it.

AI diagnostics is a separate purpose. In addition to the request that answers you, we may keep a diagnostic copy of the exchange — your prompt, the response, tool results, and relevant excerpts of the code or file in context — so we can investigate poor answers and improve the feature. This copy is processed by our analytics provider (PostHog, EU region) alongside the data in section 6.

This diagnostic copy is optional and has its own control: AI diagnostics in Privacy settings. Turning it off stops the copies being made. The AI feature keeps working, because the request that answers you is separate from the copy kept for diagnostics. Where session replay is on and AI diagnostics is off, AI conversation content is masked in the recording, so the recording cannot reconstruct what the diagnostic copy no longer holds.

We do not use this content to train AI models.

Legal basis: Art. 6(1)(b) GDPR to deliver the feature you requested, and Art. 6(1)(a) GDPR, consent, for the optional diagnostic copy.

8. Files, intermediate data, and generated artifacts

Our products process the files you upload — for example geometry and configuration — along with intermediate data and the artifacts generated from them, such as machine code, toolpaths, previews, and job records. This processing is what delivers the product function you asked for, and the data is stored so you can return to your projects and jobs. This operational storage is separate from the development copies described below and does not depend on the Share files setting.

The two products differ in what leaves your machine, and the difference matters:

  • Flexam Slicer uploads the files you submit and stores them with your project, together with the jobs and artifacts generated from them.
  • Flexam Toolpath Editor opens a local file in your browser and keeps it in that browser workspace; the file itself is not uploaded for that purpose. Three things can leave it: content you send to an AI feature (section 7); where you have left session replay on, what was visible on screen; and, while Share files is on, the development copies described below. The Editor can also open an artifact belonging to a Slicer job, and that artifact is stored with the job like any other.

We do not claim that files never reach our servers. Which of the above applies depends on the product and on what you do in it.

Share files. Separately, we keep development copies while Share files is on. Share files is a setting in Privacy settings, and it is also shown on the Early Access notice. It is on by default: the notice shows it switched on, and if you continue without switching it off, it is recorded as on for your account. You can switch it off on the notice, or at any time later in Privacy settings, without losing access. If you had already turned Share files on or off before this version of the policy, that choice is kept. It is separate from product analytics, AI diagnostics and session replay (sections 6 and 7). The setting reads: “Allow Flexam to retain copies of your uploaded models, input/output code and related diagnostics for up to 30 days to reproduce errors, test fixes and improve the product. Only share materials you are authorised to provide for these purposes. You can turn this off at any time without losing access.”

  • What is copied. Copies of the models and files you work with, the code going in and coming out, and related diagnostics. At present, copies are made only from Flexam Toolpath Editor sessions: while Share files is on, the Editor sends these copies to our servers, including content from a file you opened locally. Files uploaded to Flexam Slicer are not copied under this setting. We will update this policy before copying starts in any other product.
  • When copying starts. Only once Share files is recorded as on for your account, together with the time and the version of the wording displayed to you. It applies only to content submitted while it is on; we do not copy earlier material retrospectively.
  • Purposes. During Early Access, authorised Flexam team members may review the files you upload and your associated workflow to understand difficulties, troubleshoot issues and improve your experience with the product. Your files remain yours and are not used for other customers’ projects or AI training. We do not publish or sell the copies, do not use them to train third-party AI models, and do not use them contrary to confidentiality obligations that apply to them. This permission does not cover training AI models; any such use would require a separate decision and would not take place under this permission.
  • Who has access. Authorised Flexam personnel, and the hosting and infrastructure providers (section 10) we have contracted to store and process the copies.
  • Copies are linked to your account. This is what allows withdrawal and deletion to reach them. Files and code can themselves contain personal data, for example names or comments.
  • Ownership and other people’s rights. You keep ownership of your content. Your permission covers only material you are authorised to share and does not override the rights of your employer, your customers or anyone else in it.
  • Deletion and withdrawal. Copies are automatically deleted within 30 days. Turning Share files off stops new copying immediately and starts deletion of the development copies already made; it does not affect your projects or your access. Deletion is performed by a scheduled job run by our own service against the storage we operate, not by a storage provider’s own retention feature. That job runs about once an hour, so in the worst case deletion completes roughly one hour after the 30-day point or after you turn Share files off.

Legal basis: Art. 6(1)(b) GDPR for providing the product, including storing your projects, jobs and artifacts. For personal data contained in or linked to Share files copies, Art. 6(1)(f) GDPR, our legitimate interest in reviewing uploaded files and the associated workflow to understand difficulties, troubleshoot issues and improve your experience with the product, limited by the purposes and 30-day deletion described above. You can object at any time, with effect for the future, by turning Share files off or by contacting us at hello@flexam.tech.

9. Website contact form

When you use the contact form or contact us by email, we process the information you provide, such as your name, company or organization, email address, and message content, in order to respond.

We use Formspree to process messages submitted through the contact form on this website. Formspree acts as a processor and states that its services are hosted on AWS in the United States and that it relies on Standard Contractual Clauses for GDPR-related international transfers. Messages delivered to our business email may be processed through Google Workspace.

We do not use contact form data for advertising, profiling, newsletter automation, or CRM enrichment.

Legal basis: Art. 6(1)(b) GDPR where your request relates to a possible business relationship, and Art. 6(1)(f) GDPR for our legitimate interest in responding to inquiries.

10. Processors we use

We use the following categories of service providers to operate the website and our products:

  • hosting and infrastructure providers, for servers, storage, and network delivery
  • product analytics and session replay — PostHog (EU region)
  • AI model providers — Google Cloud (Vertex AI) and OpenAI, where an AI-powered feature is used
  • contact form processing — Formspree
  • business email and productivity — Google Workspace

We do not share personal data with third parties for advertising or unrelated commercial purposes, and we do not sell personal data.

11. International transfers

Some of the providers above are established outside the European Economic Area or may process data outside it. Where that is the case, we rely on the transfer mechanisms available under Chapter V of the GDPR, in particular Standard Contractual Clauses, together with the safeguards offered by the provider.

We select EU regions where a provider offers them and it is practical to do so — our PostHog instance runs in the EU region — but we do not claim that every provider stores all data exclusively within the EU.

12. Retention

  • Product analytics events: up to 12 months.
  • Session recordings: up to 30 days.
  • AI diagnostic content — prompts, responses, tool results and code excerpts: 30 days. These are held in our analytics provider’s designated fields for AI content, which carry their own shorter retention than ordinary events.
  • Share files development copies (section 8): automatically deleted within 30 days, and deletion starts when you turn Share files off; deletion can complete up to roughly one hour after either point.
  • Account and consent records, including the record of your Share files setting: for as long as the account exists, and afterwards where a legal retention obligation applies.
  • Project files, jobs, and generated artifacts: for as long as the account exists or until you delete them.
  • Inquiry data: as long as needed to handle the request and the related communication, unless a legal retention obligation requires longer.
  • Technical logs: for a limited period necessary for security and operation.

13. Your rights

Under the GDPR you may have the right to request access, correction, deletion, restriction, and data portability, to object to processing based on legitimate interests, and to withdraw consent you have given, with effect for the future.

To exercise your rights, contact us at hello@flexam.tech.

For the three optional collection purposes described in sections 6 and 7, you do not need to contact us: Privacy settings in either application — the account menu in the Slicer, the toolbar menu in the Toolpath Editor — turns each of product analytics, AI diagnostics and session replay on or off. The change takes effect in the application you are using straight away. The setting belongs to your account, so it also applies to the other product and to your other devices; a session already open elsewhere picks it up within about a minute, or immediately when you return to that window. Turning a control off stops future collection for that purpose; it does not itself delete data already collected, which remains subject to the retention periods above and to your deletion rights.

You can also turn Share files (section 8) on or off yourself in Privacy settings at any time.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Austria
https://www.dsb.gv.at

14. Security

Our products are served over encrypted connections, access to the authenticated applications requires sign-in, and access to production systems is limited to the people who need it. We take reasonable technical and organizational measures appropriate to the risk. No system can be guaranteed to be entirely secure.

15. Changes to this policy

We may update this Privacy Policy when our website, our products, or legal requirements change. The current version and its effective date are shown at the top of this page.

16. Legal Notice

Company identification details are set out in our Legal Notice.