How we handle and protect data

Aflame AI, operated by HUIWANLI LLC, may collect information that you submit through this website, including your name, phone number, email address, company, and inquiry details.

We may also collect standard website usage information such as IP address, browser type, device information, visit time, and page activity. Some of this information is sent to Google through the Google Analytics and Google Ads code on our site; see “Analytics and ad measurement” below.

We may collect information through cookies and analytics tools to improve our services, website performance, and user experience.

When you submit an inquiry form, we also record how you found us: the page where you submitted the form; the landing page of your first and most recent visit; the domain of the referring website (not the full address); campaign parameters in advertising or promotional links (utm_source, utm_medium, utm_campaign, utm_term, utm_content); and Google Ads click identifiers (gclid, gbraid, wbraid — random identifiers Google adds to the link when you click an ad). This information is first kept in two first-party cookies set by our site (af_src_first for your first visit, and af_src_last for your most recent visit from an ad, a promotional link, or another website). The cookies expire after 90 days and are sent to us only together with a form you submit, so we can understand which channels bring us inquiries.

If you use AI phone answering services, call transcripts and conversation summaries may be processed and stored as part of service delivery, subject to the relevant service agreement.

If you choose “Sign in with Google” for the client portal, we receive only your Google account identifier, email address, email verification status, and name from Google, and use them solely to confirm your identity and sign you in to the matching client account. This sign-in requests only the basic openid, email, and profile scopes. We do not receive or store your Google password, do not store Google access tokens, and do not gain access to your Google Ads account, YouTube channel, or any other Google data through it; those features require a separate connection inside the client portal. You can unlink Google sign-in at any time in your account settings.

We use contact information to respond to inquiries, prepare quotes, schedule demos, deliver services, and support ongoing client communication.

Usage data is used for website operations, security monitoring, performance improvement, and internal analytics. Inquiry source information is used to measure how many inquiries and clients each marketing channel brings, so we can adjust our marketing. We do not use it to track your activity on other websites.

If you choose to receive SMS messages, we will only send messages related to inquiries, service updates (including content approval requests and publishing results), appointment scheduling, follow-up communication, and support-related notifications.

We do not sell or rent personal information to third parties.

SMS messages from Aflame AI are sent only to users who have explicitly opted in through one of our website forms: the public SMS opt-in form at aflameai.com/sms-opt-in, the checkout page when purchasing a service, or the notification settings inside the authenticated client portal. In every case the SMS consent checkbox is optional, unchecked by default, and never a condition of purchase.

If you opt in to receive SMS communication from Aflame AI, your phone number will only be used for inquiries, service updates (including content approval requests and publishing results), appointment scheduling, follow-up communication, and support-related notifications.

Mobile information, phone numbers, and SMS consent will not be shared, sold, or disclosed to third parties or affiliates for marketing or promotional purposes.

Message frequency may vary. Message and data rates may apply. Reply STOP to opt out or HELP for help.

If you provide your phone number and request a callback, schedule a consultation or appointment, submit a service inquiry, request customer support, or otherwise ask Aflame AI to contact you, Aflame AI, operated by HUIWANLI LLC, may call you regarding your inquiry, requested service, appointment coordination, customer support, or related service updates.

We use phone numbers only for the purpose for which they were provided and related customer-service communications. We do not use branded outbound calls for unsolicited cold calling. Outbound calls are placed only where there is an existing business relationship, a service-related reason to contact you, or you have directly requested contact.

We may share information with service providers only when necessary to operate the website or deliver services, such as cloud hosting, messaging providers, or communications platforms, and with Google for website analytics and ad measurement through Google Analytics and Google Ads (see “Analytics and ad measurement”). These providers must protect the information to standards consistent with ours or process it under their published privacy terms.

We may disclose information when legally required or when necessary to comply with a lawful request from an authorized authority.

Outside these cases, we do not disclose personal information without your authorization.

For clarity, mobile information, phone numbers, and SMS consent are not shared with third parties or affiliates for marketing or promotional purposes.

If you choose to connect a Facebook or Instagram account to Aflame AI, the connection is made through Meta's official authorization flow (Facebook Login for Business). Granting access is entirely your choice: you select which Pages and Instagram business accounts to include, and you may cancel at any point during the flow.

Once you authorize the connection, we may receive your Facebook user ID and name, basic information about the Pages and Instagram business accounts you selected (such as account ID, name, and profile image), and an access token issued by Meta.

We use this information solely to perform the actions you authorized, such as publishing content to your own accounts on your behalf and reading basic account and content performance information. We do not use it to read your private messages or friend list, we do not sell or rent it, we do not use it for advertising targeting, and we do not use it for any purpose unrelated to the access you granted.

Statistics snapshots: to show you how your accounts are trending in your client portal (for example follower growth and recent content performance), we read and store a statistics snapshot once a day while an account remains connected. This includes follower and Page like counts for Facebook Pages; follower, following and post counts for Instagram accounts; for content you published in the last 90 days, the publish time, a short caption excerpt, thumbnail and permalink, and view counts (Facebook only), like or reaction counts, comment counts and share counts (Facebook only); and daily Facebook Page statistics (views, reach, engagement, new follows and unfollows, video views and Page visits). These snapshots are used only to show you your account data and to provide our managed social media service. Daily per-post data is deleted automatically after 13 months, and when you disconnect an account we immediately delete all statistics snapshots for that account. For YouTube channels, the daily snapshot includes only the channel's subscriber count (not recorded if you hide it), total view count and video count; it is kept for up to 13 months, shown only to you in your own client portal to show how these numbers change over time, and never shared publicly or combined with other customers' data.

Access tokens are stored encrypted, are accessible only to authorized personnel who need them to operate the service, and are retained only while the connection remains active. When you disconnect, revoke access, or the token expires, we stop using it and delete the corresponding token and connection data.

You may revoke access at any time by disconnecting the account in our admin console, or from Facebook under Settings & Privacy → Settings → Apps and Websites. Revoking access immediately ends our ability to access the connected accounts.

To request deletion of the connection data we obtained through Meta, see our data deletion instructions at aflameai.com/data-deletion, or email [email protected].

Our handling of Meta platform data is also governed by the Meta Platform Terms.

If you choose to connect your Google or YouTube account to Aflame AI, the connection is made through Google's official OAuth authorization process. Granting access is entirely your choice, and you may revoke that access at any time.

Aflame AI requests only the permissions needed to provide the features you choose to use. For YouTube features we request exactly two scopes: youtube.readonly, used to read basic information about your own channel (channel name, channel ID, avatar and public counts) so you can confirm which channel is connected; while your channel remains connected, to record your channel's subscriber count, total view count and video count once a day so that you can see how they change over time in your own client portal; and to check the processing status of videos we upload for you. youtube.upload is used to upload videos you approve to your own YouTube channel.

We request no other YouTube permission. We do not read comments, subscriptions, playlists, captions or analytics reports, and we do not edit or delete videos on your channel.

After you explicitly confirm a publication, Aflame AI may upload the confirmed video to your YouTube channel at the publishing time you confirmed, using the title, visibility and made-for-kids declaration you selected. We do not publish content without your confirmation.

When you authorize a Google or YouTube connection, Aflame AI may receive OAuth access and refresh tokens, along with the limited account or channel information necessary to establish and operate the connection.

We use Google and YouTube user data only to provide features that you explicitly request, including publishing videos that you approve to your own YouTube channel.

We do not sell Google user data, use Google user data for advertising targeting, or use it for purposes unrelated to the features you authorize.

OAuth credentials and tokens are stored using reasonable security measures and are used only as necessary to provide the connected service.

You may revoke Aflame AI's access at any time by disconnecting the channel in your Aflame AI client portal, or through your Google Account security settings. When you disconnect your YouTube channel in Aflame AI, we revoke the authorization with Google and delete the YouTube data we stored for that channel — including its statistics snapshots, channel name, channel ID and avatar, and the YouTube video and request identifiers in our publishing records — within 7 days. If access is revoked through your Google Account or can no longer be refreshed, we delete that data within 30 days. If you ask us to delete the YouTube data we store about you, we do so within 7 days.

Aflame AI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AflameAI allows users to connect their own Google Ads accounts through Google OAuth. After authorization, AflameAI may access Google Ads account information and campaign performance data, including account identifiers, campaign names and status, impressions, clicks, cost, and conversions, solely to provide Google Ads reporting and related account features within AflameAI.

AflameAI does not receive or store users’ Google account passwords. OAuth tokens are stored securely and are used only to provide the authorized Google Ads functionality. Users may disconnect their Google Ads account at any time. When disconnected, AflameAI revokes the Google authorization where supported and deletes the stored connection record, including the OAuth tokens.

At this stage, AflameAI uses Google Ads access for reading and displaying account and campaign performance data and does not create or modify ads, budgets, bids, or campaign status through the customer portal.

Scope: we request a single OAuth scope, https://www.googleapis.com/auth/adwords. The Google Ads API does not offer a read-only scope, so this is the only scope through which any Google Ads data can be read, and a narrower scope is not technically available. Our integration issues only read requests: listing the ad accounts you can access, reading an account's name, currency and time zone, and reading campaign performance for the last 7 or 30 days. It contains no write or mutate operation of any kind.

Data transfer: We do not sell, rent or trade Google user data, and we do not share Google Ads data obtained through the Google Ads API with any third party for that third party's own purposes. The data is processed on servers we operate. The only external providers in the delivery path are infrastructure providers acting solely on our instructions — our hosting provider, and Cloudflare, which provides CDN and security services and therefore handles our traffic in transit. We do not send Google Ads API data to any analytics service, advertising platform, artificial intelligence or machine learning service, or any other third-party processor.

Data protection: OAuth access and refresh tokens are encrypted at rest using AES-256-GCM and are never returned in plain text to a browser, to any page, to any API response, or to our logs. If the encryption key is unavailable, we decline to store the authorization at all rather than store it unprotected. All traffic is served over HTTPS. Google Ads campaign data is fetched from Google on demand for display and is not copied into any separate analytics store or reporting database. Access is limited to the authenticated portal account that created the connection, and we operate no internal dashboard that displays customers' Google Ads data.

Data retention and deletion: When you disconnect, we revoke the authorization with Google and delete the connection record in full — the access and refresh tokens, the connected ad account identifier and name, and the connection timestamps. Nothing about the connection is retained in our live database. Encrypted operational backups are rotated on a seven-day cycle, so a copy may persist in backup for up to seven days before it is overwritten. You may also revoke access at any time from your Google Account under Security → Your connections to third-party apps & services.

Prohibited uses: We do not use Google user data obtained through the Google Ads API to serve or target advertising of any kind, to determine creditworthiness or for any lending purpose, or to develop, improve, or train generalized or foundation artificial intelligence or machine learning models. No AflameAI personnel accesses this data in the ordinary course of operating the feature; access would occur only with your explicit consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.

AflameAI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you choose to connect your own Google Business Profile in the client portal, the connection is made through Google's official OAuth authorization process. Whether to authorize is entirely your choice. Authorization happens on Google's own pages, and we never receive or store your Google password.

Scope: we request a single OAuth scope, https://www.googleapis.com/auth/business.manage, which is the scope Google provides for managing business profile, review and performance data. We use it to read your location information, reviews and performance data, and — only after you confirm each reply — to publish the reply you confirmed to the corresponding review, or to publish an update you confirmed to your business profile. Other than review replies and updates that you confirm one by one, we do not publish anything through the connection; we do not edit your business profile, delete reviews, or edit or delete existing review replies.

Data we read: the business accounts your Google account can manage (account identifiers and names); for the locations you connect, the business name, categories, storefront address or service area, verification status, and the review link Google generates for the location; reviews (star rating, reviewer display name, time posted, review text, and whether it has been replied to) along with the average rating and total review count; and daily performance metrics (of which the portal displays only views, website clicks and call clicks).

AI reply suggestions: only when you click “Generate AI reply suggestion” on a specific review in the client portal do we send that review's star rating, review text and language, together with your location's name and categories, to the third-party artificial intelligence service provider we use, in order to draft a suggested reply. The reviewer's name is not sent to the AI service, and no other location data is sent. The provider processes this data under its commercial API terms and data controls; under the currently applicable settings, the data is not used to train general-purpose models, but it may be retained briefly for security, abuse-prevention or legal reasons. AI only drafts suggestions and never publishes anything automatically. You may use the suggestion as is, edit it, or write your own reply without using AI at all.

Publishing review replies: only after you confirm the final text of a reply in the client portal and confirm again in the confirmation dialog will AflameAI publish that reply, in your business's name, to the corresponding review through the Google Business Profile API. We never reply automatically or in bulk, and we never publish anything without your confirmation of each individual reply. Before publishing, we check with Google that the review still exists and has not already been replied to; if a reply already exists, we will not overwrite it. Once published, the reply is publicly visible on your Google Business Profile, Google Search and Maps.

Photos and videos you submit: if you use “Send photos or content” on the Google Business page of the client portal, we store the original image and video files you upload, the note you write, file names and upload times, and technical details read from the files (dimensions, duration, codec), and we generate a smaller preview image or a video cover frame. Images are stored on our servers and videos in the cloud storage service we use; neither is public, and they can be accessed only by you when signed in and by our authorized staff who prepare content for you. These materials are used to prepare content for your Google Business Profile; our team decides whether and how to use them, and not every item will be used. We do not use them for purposes unrelated to your Google Business Profile, and we currently do not send them to any artificial intelligence service. Materials are kept so they can be used over the following weeks or months, until you delete them; you can delete them one by one in the client portal at any time, even after your service has ended. When you delete an item that has not been used, its file is removed from our servers or cloud storage; when you delete an item that was used in a published update, it is no longer shown to you, but the file and its usage record are kept as a service record — to have them deleted as well, email [email protected] and we will complete it within 7 days.

Publishing updates: we may use the materials you submit to prepare updates for your Google Business Profile (text plus one image or one video). Every update is first sent to you for confirmation by email and in the client portal; only after you click “Confirm and post” on the confirmation page will AflameAI publish that update, in your business's name, to your business profile through the Google Business Profile API. We never post automatically, and we never publish an update without your confirmation of that individual update; if the content changes in any way after it is sent to you, the original confirmation link stops working and the update must be confirmed again. The confirmation link is for your use only: anyone who has the link can view and confirm the update, so please do not forward it. When an update is published, Google retrieves its image or video from us: the image is a copy with capture metadata (including location data) removed, served from an unguessable address; the video is served from a time-limited address. Once published, the update is publicly visible on your Google Business Profile, Google Search and Maps; whether and for how long it is shown is decided by Google. To take down a published update, contact us or delete it in your Google Business Profile.

Update records: if we prepare or publish updates for you, we keep the update text, the material used, each version sent to you and when, when you first opened the confirmation page, when you confirmed or the changes you requested, the publishing time, publishing status, necessary technical result codes and error categories, the update identifier and view link returned by Google, and our notes from manually checking whether the update is publicly visible. These records are used to show status, limit the number of updates per month, prevent duplicate publishing, and for audit and service records; we do not keep the original error text returned by Google. Update records are kept as service records; to have them deleted, email [email protected] and we will complete it within 7 days.

Data we store: to provide location management and new-review monitoring, we store on our servers the encrypted access and refresh tokens; business account identifiers and names; a snapshot of each connected location (name, categories, address or service area, verification status, review link), its average rating and total review count; the identifiers of reviews already checked (used to tell which reviews are new); records of new reviews (star rating, reviewer display name, time posted, the first 120 characters of the review text, whether it has been replied to, and whether you marked it as seen); and the brand grouping and hidden status you set. If you use AI reply suggestions or publish replies, we also store: the AI-generated reply suggestions, with the number, time and status of each generation (to show suggestions in your portal, enforce generation limits and prevent abuse); and publishing records, including your account email, the location and review identifiers, the final reply text you confirmed and submitted, whether the reply came from an AI suggestion as is, was edited by you, or was written entirely by you, the corresponding original AI suggestion, the time published, and the publishing status with any necessary technical result code and error category (to show publishing status, prevent duplicate publishing, and keep audit and service records). Neither record contains the original review text, full API responses from Google or any other Google content; to tell whether a review has been edited, we store only a checksum computed from the rating and review text. Review lists and performance data are fetched from Google on demand and cached only briefly in server memory (about 5 minutes for reviews and about 3 hours for performance data); they are not written to our database.

Data use: this data is used only to show location status, reviews, new-review alerts and performance data in your own client portal, and, when you choose to use these features, to draft reply suggestions and publish the replies and updates you have confirmed. We do not sell, rent or trade Google user data, use it to serve or target advertising, or provide it to any third party for that party's own purposes. Other than sending an individual review when you click to generate a suggestion, as described under “AI reply suggestions” above, we do not send Google Business Profile data to any artificial intelligence or machine learning service, and we do not use it to develop, improve or train generalized AI models.

Data access: the data is shown only to you in your signed-in client portal. Authorized AflameAI personnel access it only when necessary to provide the service to you, troubleshoot issues, or for security purposes.

Data protection: access and refresh tokens are encrypted at rest using AES-256-GCM and are never returned in plain text to a browser, to any page, to any API response, or to our logs. All traffic is served over HTTPS.

Disconnection and deletion: when you disconnect in the client portal, we revoke the authorization with Google, clear the tokens, and immediately delete the location snapshots, checked review identifiers, new-review records and all AI reply suggestions for every location under that connection. Two kinds of records are not deleted immediately on disconnection: (1) publishing records, which we keep as service and audit records for 12 months from the time each reply was published and then delete; and (2) a token-free “disconnected” connection record (business account identifier and name, and connection time), used to prevent duplicate connections and keep an operations record. To have either deleted sooner, email [email protected] and we will complete it within 7 days. The photos and videos you submit and update records are not data read from Google and are not deleted when you disconnect; see above for how to delete them. Please note that deleting our records does not remove replies or updates already published on Google; to edit or delete a published reply or update, do so in your Google Business Profile. Copies in operational backups are overwritten as backups rotate. You can also remove AflameAI at any time from your Google Account under Security → Your connections to third-party apps & services.

AflameAI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you choose to connect your TikTok account to Aflame AI, the connection is made through TikTok's official OAuth authorization process. Granting access is entirely your choice, and you may revoke that access at any time.

Aflame AI provides a managed social media publishing service: our team prepares the content, you review and confirm it, and Aflame AI then publishes it on your behalf to the TikTok account you connected. You do not need to post it yourself, and Aflame AI publishes only content you have confirmed.

Aflame AI requests only the TikTok permissions needed to provide this service: user.info.basic to identify the connected TikTok account; video.upload and video.publish to upload and publish the videos and photos you have confirmed; and user.info.profile, user.info.stats and video.list to read your profile information (such as your bio, profile link and verification status), your account statistics (follower, following, like and video counts) and a list of your recent public videos. These last three permissions are read-only. They are used only to show you, in your Aflame AI client portal (the Social accounts and Publishing records pages), an overview of your TikTok account and the view, like, comment and share counts of videos we published on your behalf, and never to change your profile or videos.

When you authorize a TikTok connection, Aflame AI may receive limited account information such as your TikTok open_id, union_id, display name, avatar information, the scopes you granted, OAuth access tokens, refresh tokens, and other data necessary to establish and operate the connection.

The account overview (profile information, statistics, and recent public videos with their view, like, comment and share counts) is retrieved from TikTok when you open it in the client portal and is displayed only to you. We do not store this data in our database.

Before publishing, Aflame AI retrieves creator settings from TikTok, including available privacy levels and interaction settings. These settings are presented to you when you confirm the content, so that you can choose the options TikTok permits for your account, and they are checked again at the time of publication. If an option you chose is no longer available, we do not change it for you; we ask you to confirm again.

Aflame AI publishes TikTok content only after you have reviewed the prepared content, chosen the publishing settings available for your account (who can view the video, whether comments, Duet and Stitch are allowed, and commercial content disclosure), and explicitly confirmed that you approve the publication. After you confirm, Aflame AI publishes the confirmed video or photo and caption on your behalf, at the publishing time you confirmed, to the TikTok account you authorized and selected for that post. If the content or settings change after your confirmation, we ask you to confirm again. We do not publish any content without your confirmation.

To provide the service and keep a record of what you confirmed, we retain the publishing settings you confirmed, the publish and post identifiers returned by TikTok, and the publishing result as part of the content record for your account. We do not use this data for any other purpose.

We use TikTok user data only to provide the TikTok features described above. We do not sell TikTok user data, use it for advertising targeting, or use it for purposes unrelated to the connected features you authorize.

TikTok access tokens and refresh tokens are stored encrypted, are used only on our servers as necessary to provide the connected TikTok service, and are never returned in plain text to your browser, to any page, or in any API response.

You may disconnect a TikTok account at any time from the Social accounts page of your Aflame AI client portal, or remove Aflame AI's access in TikTok's app settings. When you disconnect in Aflame AI, we request that TikTok revoke the authorization and we clear the stored access and refresh tokens, after which we no longer publish to or read from that account. Content already published on TikTok is not affected.

To request deletion of the connection data we obtained through TikTok, see our data deletion instructions at aflameai.com/data-deletion, or email [email protected].

Our handling of TikTok user data is also subject to TikTok's Terms of Service and TikTok's Developer Terms and policies.

We use reasonable technical and administrative measures, including HTTPS, access controls, and operational safeguards, to protect data.

No online system can guarantee absolute security, but we take practical steps to reduce risk and protect the information we handle.

Our website uses the following kinds of cookies: (1) necessary cookies that keep the site working, such as sign-in and form state; (2) analytics cookies from Google Analytics, used to understand how the site is visited; (3) ad measurement cookies from Google Ads, used to tell whether visits and inquiries came from our ads; and (4) source cookies set by our own site (af_src_first and af_src_last), which record how you arrived, expire after 90 days, and are sent to us only with an inquiry form you submit.

We do not collect sensitive personal information through cookies. You can delete or block cookies in your browser settings. Blocking cookies does not prevent you from browsing the site or submitting an inquiry, but we will not be able to tell how you found us.

Tools we use. We use Google Analytics to understand website traffic and Google Ads conversion tracking to measure our ads — for example, how many people visited the site or submitted an inquiry after clicking one of our ads. For these purposes Google receives information about your page visits on our site through its code and cookies, and processes it under Google’s Privacy Policy (policies.google.com/privacy). You can install the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout) or manage ad settings for your Google account at myadcenter.google.com.

What we do not do today. We have turned off, in our website code, the use of data sent to Google for personalized advertising (ad personalization signals), and we do not currently use remarketing — we do not target our ads to you on other websites or apps because you visited our site. We do not sell your personal information.

If we start remarketing in the future, we will first update this policy to describe the features we use and provide a way to opt out (including honoring the Global Privacy Control signal sent by your browser) before turning those features on.

Third-party tracking. Other than Google Analytics and Google Ads as described above, and two services used for security — Stripe on our checkout pages (payment processing and fraud prevention) and Cloudflare Turnstile on some forms (bot detection) — we do not allow third parties to collect personal information about your online activities over time and across websites through our site. These third parties may use cookies or similar technologies to recognize the same browser across different websites and process that information under their own privacy policies.

Do Not Track. There is currently no uniform industry standard for Do Not Track signals, and our website does not change the data collection described above in response to a browser’s Do Not Track signal. You can delete or block cookies as described above.

Information submitted through our inquiry forms is kept for up to 24 months to follow up on your inquiry and keep service records. If you become a client, related records are kept for the duration of the relationship, and longer where required by law or needed to resolve disputes.

Google Ads click identifiers, IP addresses, and browser information attached to an inquiry are deleted 90 days after submission; campaign names (utm) and source channel statistics stay with the inquiry record. Source cookies stay in your browser, expire automatically after 90 days, and can be deleted by you at any time.

We retain personal data only as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. You can ask us to delete your inquiry records at any time.

If you want to request access to, correction of, or deletion of the information we hold about you, contact us at [email protected].

This includes the information you submitted through our inquiry forms and its source records (such as ad click identifiers). After verifying your identity, we will respond within 15 business days. We will not deny you service or treat you differently for exercising these rights.

Aflame AI is operated by HUIWANLI LLC, Los Angeles, California, United States.

We may update this policy from time to time. When we do, the latest version will appear on this page with the updated date.