Privacy Policy

This Policy applies to FlamePages accounts, workspaces and related services. On customer-created pages, the customer generally determines what visitor data is collected and why; in that context, FlamePages processes data to provide the contracted infrastructure.

Page owners are responsible for publishing their own privacy notices and obtaining consent where required.

We may process name, email, protected password data, locale, workspace memberships, roles and permissions, email verification, notification preferences and information related to 2FA.

We also keep sessions, security tokens and the access log described in the next section, used for fraud prevention and account protection.

Every email-and-password login, failed login attempt, signup and signup attempt with an email that is already registered creates a record with the date, the email entered, the full IP address, the country reported by Cloudflare, the browser’s full user agent and the device type, browser and operating system derived from it. The IP and user agent are stored without hashing because they serve as evidence in payment disputes and to protect the account.

We also store the account’s signup country, read from the same Cloudflare header at signup or, for older accounts, at the first login. We do not use external IP geolocation services.

Stripe processes payment data used for checkout and subscriptions. FlamePages records operational billing identifiers and metadata such as Stripe customer, subscription, invoice, payment intent, charge, associated payment method, currency, amounts, status, billing periods, refund-guarantee dates, legacy trial dates, refunds and disputes.

FlamePages does not receive full card numbers. The events Stripe sends us may include email, name, billing address and the last 4 digits of the card; the content of those events has a deletion period (see “What we keep and for how long”).

We store builder content and configuration, pages, domains and media. Published forms can create leads containing name, email, phone, source, UTM parameters and other fields configured by the customer. With each submission we also store an IP hash, the browser class (for example, “chrome:mobile”) and a technical fingerprint of the submission, used against spam and repeated submissions.

Form submissions and lead data remain within the customer workspace context and are controlled by authorized workspace users.

On published pages, each visit records path, referrer, UTM parameters, source channel, device type, browser, operating system, country and consent state. The full user agent is not stored. Ad click identifiers in the URL (such as gclid and fbclid) are only used to classify where the visit came from and are not stored.

When the visitor accepts the page’s analytics notice, the browser receives random visitor and session identifiers; we store only a hash of them, scoped to the workspace, and an IP hash. Without that answer, the visit is counted anonymously (no IP hash and no identifier) in countries that require consent, is not counted when the page owner requires prior acceptance and, in other cases, is recorded with an IP hash and no identifier. If the browser sends Global Privacy Control or Do Not Track, the visit is not recorded.

Customers can configure Google Analytics, Google Tag Manager, Meta Pixel and custom tracking code. Those services may use their own cookies or technologies according to customer configuration and visitor consent.

Newsletter features may process email, name, tags, custom fields, subscription status, double opt-in confirmation, consent timestamp, an IP hash and the browser class at the time of consent, and a snapshot of the consent text. The full IP and user agent are not stored.

Delivery, open and click events may record the clicked link, the browser class and identifiers used for metrics and unsubscribe flows.

Support tickets may store subject, category, priority, messages, attachments, workspace, related page and conversation history.

Audit logs may record administrative, security, billing, integration and other important actions to investigate incidents and protect the platform.

When you connect an integration, we may store settings, identifiers, tokens or encrypted credentials needed for the connection. Google integrations may use OAuth; other integrations may use API keys, webhooks or credentials you provide. What each form sends to an integration and the response received are logged for a short period, for troubleshooting.

Data sent to third parties is also subject to their privacy policies.

When generation features are used, we may process prompts, instructions, files, generated results, credit consumption and technical metadata required to perform and record the operation.

OpenAI processes this data to generate the requested text and images.

• provide, authenticate and secure accounts and workspaces;
• publish pages, deliver forms and operate leads;
• process subscriptions, payments, invoices, refunds and disputes;
• run integrations, analytics, newsletters and automations;
• provide support, investigate incidents and maintain audit records;
• improve reliability, performance and security;
• comply with contractual and legal obligations.

Where required by applicable law, we process data based on contract performance, legitimate interests related to security and operations, consent, or legal obligations. Google Analytics on the FlamePages site and PropellerAds ad attribution depend on your consent, which you can withdraw at any time under “Cookie preferences” in the footer.

For tracking, marketing and newsletters on published pages, customers are responsible for configuring and obtaining the consent required for their audiences.

We do not sell personal data. We share data with the recipients listed in the next section and with the integrations selected by customers.

We may also disclose information when required by law, to protect rights and safety, or as part of a corporate transaction subject to applicable safeguards.

Each recipient receives only the data needed for its function:

• Stripe: payments, subscriptions and invoices. Card data is handled by Stripe directly; we do not store it. With your advertising consent, the ad click id is included in the checkout metadata.
• Google: Google Analytics on the FlamePages site, only with your consent; Sign in with Google (OAuth), when you choose to sign in that way; reCAPTCHA, when a page owner turns on that check in a form; and the Google integrations you connect.
• OpenAI: generates the text and images of AI-created pages from the brief and instructions you send. We do not use that content to train third-party models.
• Cloudflare: delivery and protection network in front of the site and the published pages. It receives the traffic, including the IP, issues certificates for custom domains, reports the country of each request and runs the Turnstile check when a page owner turns it on in a form.
• Email delivery provider (SMTP): delivers account emails, notices and newsletters.
• Vultr: managed database (PostgreSQL) where platform data is stored.
• Backblaze B2: stores the daily database copy for disaster recovery.
• PropellerAds: only with your advertising consent. It receives the click id of the ad that brought you when there is a signup, a checkout start and a paid subscription. Name and email are not sent.
• api.qrserver.com: when you turn on two-factor authentication, the dashboard loads the QR code image from this service. To draw the code, the image address carries the 2FA secret and the account email.

We announce material changes to this list before they take effect.

Part of the infrastructure and some recipients are located outside Brazil and outside your own country. In those cases transfers rely on the applicable legal grounds, including standard contractual clauses and the safeguards required by art. 33 of the LGPD and Chapter V of the GDPR.

You may request information about destination countries and safeguards through the privacy contact.

An automatic cleanup runs every 6 hours and applies these periods:

• visits to published pages (path, referrer, UTM, IP hash, browser class, device, country and the visitor and session hashes): deleted after 90 days;
• account access log (full IP, country, full user agent and email entered): deleted after 400 days;
• leads: name, email, phone, notes and form answers are anonymized 730 days after the lead was last updated; the lead record remains, without those fields;
• payment events received from Stripe: the event content is deleted after 90 days; only the identifier and status remain;
• page versions: deleted after 365 days, always keeping the 20 most recent of each page;
• AI-generated versions you did not choose: deleted after 30 days;
• logs of what forms sent to integrations and the response received: deleted after 30 days; the queue of completed or failed deliveries, after 30 days;
• technical analytics processing queue: completed or failed items deleted after 7 days.

The data below has no automatic deletion period. It is kept while the account exists, and you can request deletion through the privacy contact:

• account and workspace data, pages, media and domains;
• each lead’s attribution (channel, campaign, country, device and the visitor hash), which remains after the lead is anonymized;
• the daily lists of visitor and session hashes used to count unique visitors;
• newsletter subscribers, with their consent record, and delivery, open and click events;
• audit logs and records of ended sessions;
• support tickets and attachments.

Backups: the daily database copy stays on the server for 14 days, always keeping at least the 7 most recent. An independent copy goes to Backblaze B2, where it is locked against deletion for 30 days, and the Vultr managed database keeps point-in-time recovery. Deleted data leaves the backups only when those copies expire.

Deletion requests are evaluated in light of legal obligations, financial records and fraud prevention.

The Cookie Policy lists every cookie and local storage item FlamePages writes to your browser, with its purpose and duration, including PropellerAds ad attribution, which only works with your consent.

It also describes the cookies on pages published by customers: fp_vid, created on the first visit without asking for consent to keep the same A/B test group, and the analytics cookies, which only exist after the visitor accepts the page’s notice.

Depending on your location, you may have rights to access, correct, export, delete, restrict or object to processing, and to withdraw consent where processing relies on consent.

We may verify identity and workspace information before fulfilling a request.

We use technical and organizational controls including authentication, optional 2FA, encryption of sensitive secrets, role-based permissions, audit logs, webhook validation and session protections.

No system is perfectly secure, so we recommend unique credentials, 2FA and periodic access reviews.

FlamePages serves data subjects in Brazil, the European Union and Latin America. We process personal data under the Brazilian General Data Protection Law (13.709/2018) and, where the data subject is in the European Economic Area, under the General Data Protection Regulation (EU) 2016/679.

For your account and workspace data, FlamePages acts as controller. For the leads and contacts you capture on the pages you publish, you are the controller and FlamePages acts as processor, handling that data on your instructions.

Data subject requests, questions and incidents go to the channel listed under “Privacy contact”. We answer within 15 days, extendable with justification.

FlamePages is intended for people aged 18 or over, or for minors duly represented, as set out in the Terms of Service. Accounts identified as created by unrepresented minors under 18 are closed.

If you capture data from minors on your own published pages, you are responsible for obtaining the specific and prominent consent required by art. 14 of the LGPD and by equivalent rules in your jurisdiction.

We may update this Policy to reflect new features, integrations, security requirements or legal changes. The date at the top identifies the current version.

Send privacy requests to support@flamepages.com with the subject “Privacy”, including the account email and the related workspace.

By mail: FlamePages, Av. Portugal, 1148, Órion Business & Health Complex, Setor Marista, Goiânia/GO, ZIP 74150-030, Brazil.