flamify.

Legal

Privacy Policy.

How Flamify handles information across the website, customer accounts, subscriptions, and REST API runtime.

Effective: September 19, 2026Version 1.1

1. Scope and who we are

This Privacy Policy explains how ALLIE LTD, a company registered in Cyprus under company number HE 460424 and VAT number 60076104S, doing business as Flamify (“Flamify”, “we”, “us”), handles personal data when you visit our website, create or administer an account, subscribe, contact us, or use our REST API and conversational runtime (collectively, the “Service”). Our registered address is Emmanouil Roidi 44, KIRZIS CENTER, Block A, Floor 1, Flat A11, 3031, Limassol, Cyprus.

This Policy does not cover a customer’s own application or independent privacy practices. Customers integrating Flamify must provide their own end users with appropriate privacy information.

2. Our privacy roles

Flamify generally acts as a controller for website, account, billing, security, support, and business-contact data, because we decide why and how that information is used.

For messages, user identifiers, session data, and other content a customer submits through the API (“Customer Content”), Flamify generally acts as a processor or service provider on the customer’s instructions. The customer is responsible for determining the lawful purpose of that processing and for responding to its end users. A separate data processing agreement may apply.

3. Information we collect

Information you provide

  • Account data: name, work email, organization, credentials, and account preferences.
  • Billing data: subscription, transaction, amount, currency, billing address, tax information, invoices, payment status, and limited payment-method details such as card brand, last four digits, and expiry date where supplied by Stripe. Full card or bank-account details entered in Stripe Checkout are collected and processed directly by Stripe and are not received or stored by ALLIE LTD.
  • Support and communications: messages, attachments, feedback, and records of our correspondence.
  • Customer Content: API messages, opaque user and session identifiers, context, memory items, configuration, and related metadata.

Information collected automatically

  • Service usage: request time, endpoint, response status, latency, feature usage, quota, and diagnostic events.
  • Device and log data: IP address, browser or client type, operating system, referring page, and security logs.
  • Derived signals: contextual, tone, or emotion-related signals produced to provide requested runtime features. These are probabilistic outputs, not clinical assessments.

The current static landing page does not use advertising cookies or third-party analytics. If that changes, this Policy and any required consent controls will be updated before collection begins.

4. How we use information

We use information to:

  • provide, authenticate, operate, maintain, and support the Service;
  • process requests, maintain sessions, retrieve relevant memory, and produce context-appropriate responses;
  • manage accounts, subscriptions, payments, invoices, and customer communications;
  • monitor performance, debug failures, prevent abuse, and protect accounts and infrastructure;
  • understand feature use and improve reliability and usability;
  • comply with law, enforce agreements, and establish or defend legal claims; and
  • send product or marketing communications where permitted, with an unsubscribe option.

5. Legal bases

Where laws such as the GDPR or UK GDPR apply, our legal bases may include:

  • Contract: processing necessary to provide an account, subscription, API access, support, or requested feature.
  • Legitimate interests: securing and improving the Service, preventing abuse, communicating with business users, and operating our business, balanced against your rights.
  • Legal obligation: tax, accounting, sanctions, law-enforcement, and regulatory requirements.
  • Consent: where we specifically ask for it, including certain communications or optional technologies. You may withdraw consent at any time.

When we process Customer Content for a customer, the customer determines the applicable legal basis.

6. How we disclose information

We may disclose information to:

  • Stripe: payment, billing, device, and transaction information needed to process payments, prevent fraud, issue refunds, and operate subscriptions. Stripe processes payment information under its Privacy Policy;
  • Other service providers that help with cloud hosting, infrastructure, model processing, security, email, support, and business operations, under appropriate contractual restrictions;
  • Customer administrators who manage the organization’s account;
  • Professional advisers such as lawyers, auditors, insurers, and accountants;
  • Authorities or other parties when reasonably necessary to comply with law, protect rights and safety, investigate fraud, or enforce agreements; and
  • Transaction participants in a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.

We do not sell personal data or share it for cross-context behavioral advertising. The Service does not serve third-party behavioral advertising.

7. Customer Content and AI processing

Customer Content may be sent to infrastructure or model providers acting for Flamify to produce the requested response. We apply contractual and data-protection safeguards appropriate to their role and provide information about material subprocessors where required by an applicable agreement or law.

Flamify will not use Customer Content to train generalized models unless the customer has explicitly opted in or a separate written agreement clearly permits that use. We may use aggregated or de-identified operational information that cannot reasonably be linked to a person or customer to analyze reliability and improve the Service.

Emotion- and tone-related signals are inferences from conversational context. They may be inaccurate and should not be used as medical diagnoses or as the sole basis for decisions with legal or similarly significant effects.

8. Data retention

We retain account, billing, support, usage, and security information only for as long as reasonably necessary to provide the Service, maintain business, accounting and tax records, resolve disputes, prevent fraud, enforce agreements, and meet legal obligations. Payment and invoice records may be kept after account closure where financial-recordkeeping law requires it.

Customer Content is retained according to the customer’s configuration and applicable agreement. When Customer Content is deleted or an account closes, residual copies may remain temporarily in backups and security records until they cycle out, unless law requires longer retention.

9. International data transfers

We and our service providers, including Stripe, may process information outside your country. Where required, we use safeguards such as adequacy decisions, standard contractual clauses, the UK addendum, or another lawful transfer mechanism.

10. Security

We use administrative, technical, and organizational measures designed to protect information, such as access controls, encrypted transport, credential management, logging, and vendor review. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Customers are responsible for protecting their API keys, configuring their integrations securely, minimizing submitted data, and promptly reporting suspected compromise to support@flamify.ai.

11. Your privacy rights

Depending on your location and subject to legal exceptions, you may have the right to access, correct, delete, restrict, or object to processing of your personal data; receive a portable copy; withdraw consent; and complain to a data-protection authority.

Submit a request to support@flamify.ai. We may need to verify your identity and authority. If Flamify processes your data only on behalf of a customer, please contact that customer first; we will assist the customer as required.

You may opt out of marketing email through its unsubscribe link. Service and security messages are not marketing.

12. California privacy notice

If the California Consumer Privacy Act applies, California residents may have rights to know, access, delete, and correct personal information; opt out of sale or sharing; limit certain uses of sensitive personal information; and receive equal service and pricing when exercising those rights.

In the preceding twelve months, we may have collected the categories described in Section 3—identifiers, customer records, commercial information, internet or network activity, professional information, Customer Content, and inferences—and used and disclosed them for the business purposes described in Sections 4 and 6. We do not sell personal information or share it for cross-context behavioral advertising.

Requests may be submitted to support@flamify.ai. An authorized agent may submit a request where permitted; we may verify the request with you directly.

13. Children

The Service is designed for businesses and developers and is not directed to children. You must be at least 18 to create an account. Customers must not knowingly submit personal data of children through the Service without a lawful basis, required parental authorization, and a written agreement confirming the Service is appropriate for that use.

If you believe a child’s data was submitted improperly, contact support@flamify.ai.

14. Changes to this Policy

We may update this Policy to reflect changes in the Service, our practices, or law. We will post the revised version and update the effective date. We will provide additional notice of material changes where required.

15. Contact

The controller for website and account data is ALLIE LTD, Emmanouil Roidi 44, KIRZIS CENTER, Block A, Floor 1, Flat A11, 3031, Limassol, Cyprus. Company registration number: HE 460424. VAT number: 60076104S.

For privacy questions or requests, contact support@flamify.ai.