Privacy Policy

1. Information we collect

When you request a consultation. Our form asks for your name, business name, and email address. You can also give us your phone number, your website or Google Business Profile link, the services you are interested in, and a message.

When you submit the form. We also record the date and time, the page you submitted from, your IP address, and a request number we assign.

When you visit the site. Our servers and our network provider keep standard logs, such as your IP address, browser type, the pages you request, the date and time, and the page that referred you.

When you email us. We receive your email and your contact details.

When you sign up for text messages. Our sign-up page asks for your name and mobile number, and you can add your business name. We record your consent, the exact consent wording you agreed to, the date and time, the page you signed up on, your IP address, and your browser type. If you opt out, we record that too.

When you use our free business page platform. If you create a business account, we collect your email address and a password (we store only a scrambled version of the password that cannot be turned back into it). When you build a business page, we collect the information you enter: business name, industry, city, short description, services, about text, service areas, hours, languages, phone number, WeChat ID, WeChat QR code, address, theme color, links to your social media accounts and YouTube videos, the logo and photos you upload, and any captions you add to your photos. When you upload a photo, we re-save it, which removes location and camera details stored in the file. When you upload a WeChat QR code, our server reads the code to confirm that it links to a WeChat contact or official account and not to a group or another website. We do not keep what the code contains apart from the image itself. We keep every version of your page and a record of each change: who made it and when. When you ask to claim a page that has already been set up, we collect the explanation you write. We record how we verified you, the result, the date and time, and which of our staff handled it. We also record the last 4 digits of the page's phone number and a one-way coded form of the full number (not the number itself) so we can tell if the phone number changes. When you publish a page, we record your account, the version you published, and the version of the confirmation you agreed to. For security, we also keep a record of sign-ins and account changes, with a one-way coded form of your IP address (not the address itself). If you choose a different email address for message notifications, we keep it with your account, after you confirm it from that inbox.

When you sign in with Google. If you choose to sign in with Google, Google sends us your email address, whether Google has verified it, and an account ID that Google assigns. We keep the account ID with your business account so we can recognize you next time. We do not receive your Google password, and we do not keep Google sign-in tokens.

When you use address suggestions. When you type a city or street address in your business account, or on a sample page link, what you type is sent to Google so it can suggest matching places. If you pick a suggestion, we receive the full address and Google's ID for that place. We keep the place ID with your page's address so the map link on your page opens the right place, and we keep the place's map coordinates, refreshed at least every 30 days, to tell search engines where the business is. We do not keep what you typed or the list of suggestions. We keep only a count of requests, for up to 48 hours, to limit use.

When we prepare a sample page for a business. We may prepare an unpublished sample business page using information a business has posted publicly, such as its name, services, service areas, phone number, and WeChat ID, and send the business a private link to it. Our team may use the AI assistant described below to organize that posted text into a first draft; we do not keep the posted text itself. We do not copy photos from those posts; sample pages use generic industry images.

When you open a sample page link. We record when the link is first opened and when the sample page was last opened or edited, so that unused sample pages can be deleted on time. Changes made through the link are saved like any other page edit.

When you use the AI assistant. If you ask the AI assistant to suggest changes to your page, we send it your request, the current content of your page, your earlier messages in that conversation, and any photos or screenshots you add. Its suggestions change your page only if you confirm them. We do not keep the text of your requests or the AI's replies on our server. We keep only a count of how many requests were made, for up to 48 hours, to limit use.

When you publish a page or upload a photo. Before a page is published or updated, and when you upload a logo or photo, we send the page's text and the photos it uses to our AI provider to check for content our terms do not allow. Photos are resized and re-saved first, which removes location and camera details. We keep the result of each check (whether it passed and any problems it found), but not a copy of what was sent.

When you visit a business page. Business pages count visits so that each business can see how its page is doing. When a business page loads, when you leave it, and when you tap its phone, WeChat, map, social media, video, share, or copy-link buttons, the page sends a short message to our server. From that message and the request, we record the page, the type of action, how you reached the page (for example, a WeChat chat, a WeChat group, Moments, a QR code, a search engine, or another website), roughly how long the page was open, and your approximate city, state, and country as provided by our network provider. To count each visitor only once a day, we combine your IP address and browser information with a random value that changes every day and turn the result into a one-way code. We keep that code until the next day and then delete it, together with the random value, so visits on different days cannot be linked. We do not store your IP address for this purpose, we do not set cookies or store anything in your browser, and we keep only daily totals for each page. Visits by the page's own owner while signed in, and visits by automated programs that we can recognize, are not counted.

When you send a message to a business. Some business pages have a message form. If you use it, we collect what you enter, such as your name, phone number, WeChat ID, email address, your message, and any other questions the business added to its form, together with the time and the page you sent it from. Before the message is sent, a short security check runs, as described below. We use your IP address only to limit abuse, and we keep only a one-way coded count of requests, for up to 48 hours. We do not send you any email or text message about your message.

Website analytics. Our network provider adds a small analytics script to the pages of aflame.cc so that we can see, in aggregate, how many pages are viewed and how quickly they load. Each time a page loads, the script sends our network provider the page address, the page that referred you, your browser and operating system type and version, and page loading and performance measurements. Like any request, this also reaches our provider with your IP address. The script does not set cookies or store anything in your browser. Our provider states that it does not fingerprint visitors or track individual visitors across websites. We see only aggregate reports, not information about individual visitors.

Security checks. Our text message sign-up page, our business account sign-up page, and the message forms on business pages show a short security check, run by our network provider, to tell people apart from automated programs. To run the check, our provider collects information from your browser and device, such as your IP address, browser type and settings, and signals about how the page is being used. When you submit the form, our server sends our provider a one-time code from the check and your IP address to confirm the result. We receive only whether the check was passed.

We do not use advertising pixels or other tracking tools on aflame.cc. Our marketing pages do not set cookies or store information in your browser. When you sign in to a business account, we set one strictly necessary cookie that keeps you signed in. It expires after 30 days, or after 7 days without use, and it is removed when you sign out. If you sign in with Google, we set a short-lived cookie for up to 10 minutes that protects the sign-in from forgery. If you open a sample page link and choose to sign up or sign in to publish it, we set a cookie that remembers which sample page you came from, for up to 7 days. Business account pages and business pages do not load the website analytics described above; business pages use only the visit counting described under “When you visit a business page.” Our network provider may set a strictly necessary security cookie if it needs to check whether traffic is automated.

Please do not send sensitive information, such as health details, financial account numbers, or government ID numbers, through the form or by email.

2. How we use information

• To respond to your request and prepare for your consultation
• To communicate with you about the services you asked about
• To run the business page platform: to create and show your page, check pages for prohibited content when they are published, verify ownership when someone claims a page, handle claims and disputes, and send you account emails (email verification, password reset, security notices, and notices about your page)
• To keep a record of who approved what on each business page, so we can resolve disputes and respond to complaints
• To prepare unpublished sample pages from information businesses have posted publicly, and to invite those businesses to review, edit, publish, or delete them
• To suggest page edits with the AI assistant when you or our team ask for it
• To tell you about our paid services, such as a website, Google Business Profile management, SEO and AI search visibility, or social media management, but only if you ask about them or agree to hear about them
• To show each business the daily visit totals for its own page, such as how many people opened it, where visits came from, and how many tapped the phone or WeChat buttons
• To understand, in aggregate, which pages are viewed and how well the site performs
• To protect the site, the form, and the business page platform from spam and abuse, for example by limiting how often requests can be sent from one IP address
• To fix technical problems, keep records of inquiries, and comply with law

We do not use your information for marketing without your consent. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

3. How we share information

Business pages are public. Once a business page is published, the information on it, including the phone number, WeChat ID, address, logo, and photos the business chose to show, can be seen by anyone, and people can share links and preview images of it.

Business owners see visit totals. The owner of a business page can see the daily totals for that page in their business account: numbers of visits and visitors, sources, the most common cities, button taps, and the average time on the page. They do not see any information about an individual visitor.

Messages go to the business. When you send a message through a business page, the owner of that page sees everything you entered in their business account. We email the owner to say that a new message has arrived; that email does not include what you wrote or your name. The business decides how to reply to you and is responsible for using your contact details only to answer your message. We do not use your message for marketing.

Our affiliated brand. Our team uses the internal tools of AflameAI, an affiliated brand of HUIWANLI LLC, to keep track of business pages and sample pages. Those tools can read, but not change, the status of each business page or sample page (for example, sent, opened, claimed, or published), the business name, industry, city, phone number, and WeChat ID shown on the page, a summary of what the page includes, messages the business left on its sample page, and the page's daily visit totals. They do not receive account email addresses, passwords, sign-in records, invitation links, or any information about individual visitors. We use this only to follow up with businesses about their pages and, if a business asks about or agrees to hear about them, our paid services.

Otherwise, we share personal information only with service providers that help us run the website and respond to you, and only for that purpose:

• Hosting: our hosting provider runs the servers that receive form submissions, run the business page platform, and keep logs. Our servers are in the United States.
• Network, security, and analytics: all website traffic passes through our content delivery and security network, which receives your IP address and request details and also provides the website analytics described in section 1. It also tells us the approximate city, state, and country of each visit, which we use for the business page visit totals described in section 1. It also runs the security check on our sign-up pages described in section 1.
• Email: our email provider delivers consultation requests to our team inbox and stores them there. It also delivers account emails from our business page platform, such as email verification, password reset, and review result messages.
• Notification emails: a separate email delivery service sends the emails that tell business owners about new messages and confirm a notification email address. It receives the recipient's email address and the text of that email, which never includes message content.
• Text messages: when we text you, our messaging provider receives your mobile number and the content of the message so it can deliver it.
• Team notifications: a messaging service alerts our team to new requests. Each alert includes only your name, business name, the services you selected, and the submission time. It does not include your email address, phone number, website, message, or IP address. When a business publishes or updates a page, asks for verification, or asks to claim a page, our team receives an alert with only the type of request, the business name, the time, and a link to our sign-in-only review page. These alerts do not include phone numbers, WeChat IDs, email addresses, or the business's explanation. When a business first opens a sample page we prepared, asks to publish it, or deletes it, the alert includes the business name and the type of event.
• Payments: our payment processor handles online checkout and card details on its own secure pages.
• Custom domains: our domain registrar and a certificate authority register the domain name and issue the security certificate for a business page's custom domain. They receive the domain name, not the business owner's personal details.
• AI assistant: our AI provider receives the requests described in section 1 so it can generate suggestions, and the page content and photos described in section 1 so it can check them. It processes them under its own policies, may keep them for a limited time to monitor for abuse, and under its business terms does not use them to train its models.
• Videos: if a business page shows a YouTube video and you tap play, the video loads from YouTube in its privacy-enhanced mode. YouTube then receives your IP address and browser information and may use cookies or similar technologies under its own privacy policy. Nothing loads from YouTube until you tap play.
• Google sign-in: if you choose to sign in with Google, Google knows that you signed in to our platform.
• Address suggestions: when you type in the city or address fields described in section 1, our server sends what you type to Google so it can suggest matching places. Your browser does not connect to Google for this. Google processes it under its own privacy policy.
• Fonts: our home page and the information pages of aflame.cc load fonts from Google Fonts, so your browser sends your IP address and browser information to Google. Business pages do not.

We may also disclose information if the law requires it, to protect our rights or the safety of others, or as part of a merger, acquisition, or sale of assets.

4. Free business pages

Pages whose address starts with aflame.cc/c/, and pages at an address a business chose, such as aflame.cc/your-shop-name, are free business pages on the Aflame.cc platform. Businesses create, manage, and publish them with an Aflame.cc business account, or claim a sample page we prepared for them. Each page is checked automatically for prohibited content when it is published, and our team may review published pages and take down pages that break our terms. The free business page does not require you to buy anything. We also offer paid services, such as a website, Google Business Profile management, SEO and AI search visibility, and social media management, and we tell you about them only if you ask about them or agree to hear about them.

A business can choose to show its page at its own domain name instead (a custom domain). This is an optional paid feature offered in the business account. A page shown at a custom domain works the same way as described in this section.

Business pages have no forms, and they do not use cookies, advertising or tracking tools, the website analytics described in section 1, or outside fonts. The only exception is a YouTube video a business adds: it loads from YouTube only after you tap play, as described in section 3. They count visits and button taps as described in section 1 under “When you visit a business page,” and keep only daily totals. When you tap a business's phone number or copy its WeChat ID, the call or the copy happens on your own device; we record only that the button was tapped, not your call or what you do next. Map links open only if you tap them. Social media links also open only if you tap them; when you do, you leave our site, and that platform's own privacy policy applies.

Published business pages are open to search engines and are listed in our sitemap and in our business directory at aflame.cc/shops, which shows each business's name, category, city, short description, some of its services, and logo. Unpublished pages, sample pages, disabled pages, and published pages with very little content (until the business adds more) are hidden from search engines and are not listed. We may turn off search engine listing for a particular page, which also removes it from the directory, and a business can ask us to do so.

Sample pages. Sample pages we prepare are not public. They are hidden from search engines and can be opened only with the private link we send to the business. Anyone who has the link can view and edit the sample page until it is published, so please do not forward it. A sample page becomes public only after the business signs up, claims it with the private link, and publishes it. If the business chooses “Not interested, delete,” we delete the sample page right away. On that page the business can instead send us a message, for example to ask us to fix something on the page. We keep the message with the sample page and delete it when the sample page is deleted; our team alert says only that a message arrived. A sample page that nobody opens or edits for 30 days is deleted automatically, unless we extend it, for example at the business's request. After a sample page is deleted, we keep only a record that it existed, when each step happened, and why it was deleted, without the business name or contact details.

The information on each page is provided and confirmed by the business. If you own a business shown on one of these pages and want it corrected or removed, or want a photo deleted, email [email protected] from your account email address, or tell us how we can confirm that you represent the business.

5. Payments and client services

Custom domains for business pages. If you add a custom domain to your business page, payment is handled on a secure checkout page run by our payment processor. We do not receive or store your full card number. We receive your email address, the amount and date of each payment, the payment status, and the brand and last four digits of your card. We keep a record of the terms you agreed to and when you agreed.

If we register a domain name for you, it is registered through our domain registrar under our own account, so your personal details are not submitted to the registrar or published in the domain's public registration record. If you connect a domain you already own, we store only the domain name.

aflame.cc does not take payments for our marketing services online. If you become a client of our marketing services, we will tell you how client information is handled before any work begins. We will update this policy before we offer online payments or client accounts for our marketing services on this site.

6. Text messages

If you sign up on our SMS sign-up page (aflame.cc/sms-opt-in/), we use your mobile number only to send you Aflame.cc Customer Care messages: replies to your inquiries, consultation scheduling, appointment confirmations, project updates, and service updates. We do not send marketing texts. Message frequency varies. Message and data rates may apply. Consent is not a condition of purchase.

We do not sell, rent, or share mobile numbers, text message opt-in data, or consent with third parties or affiliates, including AflameAI, for their marketing or promotional purposes. The sharing described in section 3 does not include text message opt-in data or consent, except that our messaging provider receives your mobile number so it can deliver our messages.

To stop receiving texts, reply STOP to any message, or email [email protected] with the subject “SMS opt-out.” For help, reply HELP or email us.

7. How long we keep information

• Form submissions stored on our server are deleted automatically 90 days after they are submitted. If a request could not be delivered to our team by email, we keep it until we have followed up, and then delete it on the same schedule.
• Consultation emails in our team inbox, and our replies, are kept for up to 24 months after our last contact with you, and then deleted.
• Team notifications stay in our messaging app until we delete them.
• Text message consent records (sign-ups and opt-outs) are kept for 4 years after the latest sign-up or opt-out for that number, and then deleted. If we delete a sign-up this way, we no longer text that number unless you sign up again.
• Text messages we send and receive are kept on our server for 90 days, and then deleted.
• Business accounts that never verify their email address are deleted automatically 30 days after sign-up. Sign-in links in emails expire after 24 hours (email verification) or 1 hour (password reset), and we delete them 7 days after they are used or expire.
• Sample pages that are never published are deleted 30 days after they were last opened or edited, or right away if the business asks, as described in section 4.
• AI assistant requests and replies are not stored on our server.
• Google account IDs are kept with the business account and deleted when the account is deleted.
• Business account sign-in and security records, with coded IP addresses, are kept for 180 days. Records used to limit how often requests can be made are deleted after 48 hours.
• Business account emails are not kept on our server after they are sent. We keep only the type of email, the recipient, the time, and whether it was delivered, for 30 days.
• Records that a team alert about a business page was sent are deleted 90 days after it was sent.
• Business pages, their versions, photos, and the records of ownership, verification, claims, publishing, content checks, and our review decisions are kept while the page is on our platform. Temporarily suspending a page does not delete anything. If a page is permanently closed (at the business's request, when the business deletes its account, or when we decide it will not return), we delete its photos 90 days after it is closed, and we delete its versions and the related records 4 years after it is closed. We keep them longer only if we need them to handle a complaint, a dispute, or a legal requirement, and then only until it is resolved. When we delete a photo at a business's request, we delete the file and it can no longer be shown; we keep a record that it was deleted and why.
• Messages sent through a business page are deleted automatically 90 days after they are sent. They are deleted sooner if the business deletes them, or when the business page or the owner's account is deleted. When a page gets a new owner, the new owner cannot see messages sent before they took over.
• Business page visit totals are kept for about 13 months (400 days) and then deleted. They are also deleted when the business page is permanently removed.
• The one-way codes used to count each visitor once a day, and the daily random value used to make them, are deleted the day after the visit.
• Custom domain payment and consent records are kept for at least 3 years after the subscription ends. Records of setting up a custom domain are kept for 1 year after the subscription ends.
• Server logs that include IP addresses are kept for up to 11 weeks. Backup copies of logs are kept for up to 7 more days. Nightly backup copies of business page platform records are kept for up to 8 days, so information we delete stays in those backups for up to 8 more days.
• We may keep information longer when the law requires it, or to resolve a dispute or prevent fraud or abuse.

Our network provider and Google keep the information they receive under their own policies.

8. Your privacy requests

You can ask us what personal information we hold about you, or ask us to correct or delete it. Email [email protected] with the subject “Privacy request.” To protect your information, we may ask you to send the request from the email address you used with us, or confirm your identity in another reasonable way. We will respond within 45 days. If we cannot complete a request, for example because the law requires us to keep a record, we will tell you why. We will not treat you differently for making a request.

Business accounts. You can ask us to delete your business account and personal information by emailing [email protected] from your account email address (or we will confirm your identity another reasonable way, such as calling the phone number on your page). We will delete your email address, password, and sign-in records, take down your business page, and delete its photos. We keep a record of what your page showed and who confirmed and approved it, with your personal details removed, until the period described in section 7 ends, so we can respond to complaints or disputes about the page.

9. Do Not Track

We do not track visitors over time or across other websites, and we do not allow third parties to do so through our site. For this reason, we do not change how the site works in response to Do Not Track or Global Privacy Control signals.

10. Security

Our site uses encrypted HTTPS connections. Business account passwords are stored only in a scrambled form. Staff who review business pages must sign in with a password and a one-time code from an authenticator app. Stored form submissions, text message consent records, and business page review records can be read only by authorized administrators, and team notifications leave out contact details. Photos that are not part of a published page are visible only to the business that uploaded them and to our administrators. No method of transmission or storage is completely secure.

11. Children

Our website and services are for businesses. They are not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has sent us information, contact us and we will delete it.

12. Visitors outside the United States

Our services are offered to businesses in the United States. If you contact us from another country, your information will be processed in the United States and in other countries where our service providers operate.

13. Changes to this policy

We will post changes on this page and update the effective date. For a material change, we will also post a notice on our website, and we will email existing clients if the change materially affects them.

14. Contact us

HUIWANLI LLC, Los Angeles, California

Email: [email protected]