Privacy Policy

1. Controller

FLAMEWRIGHT TECHNOLOGIES LTD, a company registered in England and Wales (company number 17351523), operates LLMFly AI and is its data controller ("Flamewright", "we", "us" or "our"). This Policy applies to llmfly.ai, the LLMFly AI dashboard, APIs, and related support communications.

2. Personal data we collect

• Account and authentication data, such as your name, email address, profile image, organisation, email-verification status, login method, login records, and account settings.
• Billing and transaction data, including billing contacts, payment status, transaction identifiers, purchased credits, invoices, and tax information. Full card details are handled by the payment provider rather than LLMFly AI.
• Service and device data, including IP address, browser and device information, cookie or device identifiers, API key identifiers, request times, selected models, token counts, usage records, diagnostic logs, security events, and referral or reward activity.
• Customer content, including prompts, uploaded files, inputs, generated outputs, task settings, and related metadata, to the extent needed to route, process, store, and display your requests.
• Information included in support, feedback, compliance, and other communications.

3. Google user data accessed

If you choose Sign in with Google, LLMFly AI requests only the OpenID Connect scopes `openid`, `email`, and `profile`. We receive your Google account identifier, name, email address, email-verification status, and profile image. We also receive authentication tokens and associated scope and expiry metadata needed to complete and maintain the sign-in connection.

• We do not request access to Gmail messages, Google Drive files, Google Calendar events, contacts, or other Google Workspace content.
• Google sign-in is optional. You may instead use the email-and-password method offered by LLMFly AI.
• LLMFly AI does not collect your Google password.

4. How and why we use personal data

• Create, authenticate, and administer your account and perform our contract with you.
• Use Google sign-in data only to verify your identity, create or link your LLMFly AI account, show basic profile information, protect the account, and maintain your signed-in session.
• Route AI requests, run content-safety checks where configured, measure usage, deduct credits, store task history, and provide requested outputs and support.
• Process payments, maintain accounting records, and meet tax obligations.
• Protect accounts, prevent fraud and abuse, enforce our Terms, and secure the platform.
• Comply with legal, sanctions, regulatory, and law-enforcement requirements.
• Analyse and improve service reliability, performance, and user experience using proportionate website and operational data.

5. Legal bases

Where UK or EEA data-protection law applies, we process data as necessary to perform our contract with you, to comply with legal obligations, and for legitimate interests such as securing, operating, supporting, and improving the service. We rely on consent where the law requires it, including for non-essential cookies in relevant jurisdictions; consent may be withdrawn at any time.

6. Cookies, analytics, and support tools

We use strictly necessary cookies or local storage for authentication, security, session continuity, referral attribution, reward-abuse prevention, and user preferences. Google Analytics may collect online identifiers, IP-derived information, device and browser information, page views, interactions, and approximate location information to help us understand website use. Intercom may collect device, browser, page, and conversation information when its support messenger loads or you use it. These providers may use cookies or similar technologies. Where required by law, we will obtain consent before using non-essential technologies. We do not use Google sign-in data for advertising.

7. How we share data

We do not sell personal data and do not share it for cross-context behavioural advertising.

• Google, to provide and secure Google authentication.
• Cloud hosting, database, storage, security, analytics, monitoring, email, and customer-support providers, including Cloudflare, Google Analytics, Intercom, and Resend, acting as appropriate to deliver their functions.
• AI model, processing, infrastructure, and content-safety providers only where necessary to fulfil or protect the request you submit. Your Google sign-in profile is not included in prompts sent to AI model providers.
• Payment processors and related providers where necessary to open checkout, confirm payment, prevent fraud, issue refunds, and maintain transaction records.
• Banks, accountants, auditors, insurers, and professional advisers where reasonably necessary.
• Authorities or other parties when disclosure is legally required or necessary to protect rights, safety, and security.
• A successor in connection with a merger, financing, reorganisation, or sale, subject to applicable safeguards.

8. Google API data use and disclosure

Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide or improve the user-facing sign-in and account functionality described in this Policy.

• We do not sell Google user data, use it for advertising, provide it to data brokers or information resellers, or use it to determine creditworthiness or for lending.
• We disclose Google user data only to service providers that help us provide or secure the sign-in and account functionality, when you direct or clearly consent to the disclosure, in a business transfer subject to safeguards, or when required by law.
• We do not use Google Workspace APIs to develop, improve, or train generalised or non-personalised AI or machine-learning models, and we do not transfer Google user data to third parties for such training.

9. International transfers

Our customers and service providers may be in different countries. When personal data is transferred outside the United Kingdom, we use an applicable lawful transfer mechanism and appropriate safeguards, such as adequacy regulations or approved contractual clauses, unless a legal exception applies.

10. Retention and deletion

We retain personal data only as long as reasonably necessary for the purposes described above. Completed, failed, or cancelled AI task records and associated stored assets are scheduled for deletion after 100 days; deleting an asset earlier removes the stored object and marks its record as deleted. Session records expire according to the session period, normally 30 days, although security records may be retained longer where necessary. Account and Google sign-in records are retained while your account remains active and are deleted or de-identified after account deletion, except where records must be retained for security, fraud prevention, dispute resolution, or legal, tax, and accounting obligations. Transaction and compliance records may therefore be retained for the applicable statutory period.

• You may delete eligible individual assets using the controls available in your account. Removing a task-history item from your account view hides it immediately; the underlying record remains subject to the 100-day deletion schedule and any required exceptions described above.
• To request deletion of your LLMFly AI account, linked Google sign-in data, or other personal data, email [email protected] from your account email address. We may verify your identity before acting.
• You can revoke LLMFly AI's Google access through your Google Account permissions. Revocation stops future access but does not by itself delete data already held by LLMFly AI; use the deletion method above for that.
• When an applicable retention period expires, we delete, aggregate, or de-identify the data, unless preservation is legally required.

11. Security

We use reasonable technical and organisational safeguards designed to protect personal data and Google user data, including HTTPS encryption in transit, access controls, credential and secret protection, limited staff access based on operational need, monitoring, abuse controls, and data minimisation. Service providers are selected and engaged under appropriate confidentiality and data-protection obligations. No system is completely secure, and you are responsible for protecting your account credentials and API keys.

12. Your choices and rights

Depending on applicable law, you may have rights to access, correct, erase, restrict, or object to the processing of your personal data, and to receive a portable copy. Where processing relies on consent, you may withdraw it. You may also complain to the UK Information Commissioner's Office or your local supervisory authority. To exercise a right, email [email protected]. We may need to verify your identity before responding.

13. Children

LLMFly AI is a business service and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data, contact us at [email protected] so we can take appropriate action.

14. Updates and contact

We may update this Policy to reflect changes in the service, law, or our data practices. We will publish the current version and date on this page and provide additional notice when required, including when we materially change how we use Google user data. Privacy questions, deletion requests, and rights requests may be sent to [email protected].