any folder you like!!
If you don't want user to access the uploaded files directly, you may want to write it to any sub folder of WEB-INF.
You could also write it out anywhere outside the web-app, its a file - you could copy it anywhere you like (assuming you have the permission to write to that directory)