This Privacy Policy describes how Fanflet, LLC ("Fanflet," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the Fanflet platform, website, and related services (the "Services"). It applies to all users of the Services, including Speakers, Sponsors, Audience Members, and Subscribers (as defined in our Terms of Service).

By using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

Account Information (Speakers and Sponsors):

Name, email address, and password
Profile information (bio, photo, slug, social links)
Organization or company name (if applicable)
Billing and payment information (processed by our payment provider; Fanflet does not store full credit card numbers)

Speaker Content:

Resource links, file uploads, text blocks, fanflet titles, descriptions, event details, themes, and survey questions

Sponsor Content:

Sponsored resource links, descriptions, logos, and promotional materials

Subscriber Information:

Email address (provided through fanflet subscribe forms)
Survey responses (if the Speaker includes a survey on their fanflet)
Name (if optionally provided)

SMS Bookmark Requests:

Phone number (used once to deliver the bookmark text message, then stored only as a keyed one-way hash; we do not store the number itself)

Ad Landing Page Form:

First name, last name, and email address
The type of talks you give (optional)
When you submit the form, we also store the campaign tags from the link you arrived on, your IP address, and your browser details
The ad click identifier, only when cookie consent is granted (or where consent is not required). With cookie consent, the values of Meta's _fbp and _fbc cookies are stored with the form submission alongside the click identifier
Form submissions are deleted automatically 90 days after you submit the form. If you create an account, your account information is kept as described for accounts (see Section 5)
We do not send what you enter in this form, including your name and email address, to Meta

Communications:

Support requests, feedback, and any other communications you send to us

1.2 Information Collected Automatically

Usage Data:

When you access the Services, including visiting a public fanflet page, we automatically collect:

Page views and resource click events
QR scan events
Email subscription events
SMS bookmark request events
Referral source (how you arrived at the page)
Device type, operating system, and browser type
General geographic location (country and region level, derived from IP address)
Timestamps of interactions

Technical Data:

IP address (used for rate limiting, security, and, when the first-party analytics cookie is not set, as an input to a one-way unique-visitor hash). Individual IP addresses are not stored beyond 90 days
Server logs (retained for security and debugging purposes)

Cookies and Similar Technologies:

Fanflet uses essential cookies for authentication and session management
We use a first-party analytics identifier (fanflet_vid) to count unique visitors for the Speaker, gated on cookie consent where required. See Section 7
Google Tag Manager loads the Meta (Facebook) pixel on Fanflet's own marketing pages and on the ad landing page, and only after cookie consent where a choice is required. These tags do not load on a speaker's public pages, audience pages, or signed-in dashboards. See Sections 4.4 and 7.2
See Section 7 (Cookies) for details and your choices

1.3 Information from Third Parties

Authentication providers: If you sign in using a third-party provider (e.g., Google), we receive your name and email address from that provider
Payment processor: We receive transaction confirmation and billing status from our payment processor

---

2. How We Use Your Information

2.1 To Operate the Services

We use your information to:

Create and manage your account
Host, display, and deliver fanflet content to Audience Members
Process subscriber sign-ups and deliver confirmation emails
Send SMS bookmark messages when requested
Generate QR codes linked to your fanflets
Provide analytics dashboards to Speakers and Sponsors
Process payments and manage subscriptions
Provide customer support

2.2 To Improve and Develop the Services

We use Usage Data to:

Understand how the Services are used and identify areas for improvement
Develop new features and products
Monitor and improve platform performance, reliability, and security
Generate Aggregate Data for benchmarking and product analytics (see Section 2.4)

2.3 To Communicate with You

We use your contact information to:

Send transactional emails (account verification, password resets, subscription confirmations)
Notify you of material changes to our Terms or this Privacy Policy
Send service-related announcements
Respond to your support requests

If you submit the form on our ad landing page, we may email you about starting or finishing your Fanflet trial. A sentence under the form's button tells you that by continuing you agree to this.

We will only send you marketing communications about Fanflet if you have opted in to receive them. You can opt out at any time using the unsubscribe link in any marketing email.

2.4 Aggregate Data, De-identified Data and Analytics

We use de-identified, aggregated Usage Data to:

Generate platform benchmarks (e.g., average engagement rates by industry or resource type)
Power machine learning features (e.g., resource recommendations, engagement scoring)
Produce anonymized industry research and reports
Provide Sponsors with platform-wide engagement benchmarks (without identifying individual Speakers, Subscribers, or Audience Members)

Aggregate Data cannot reasonably be used to identify any individual. We apply a minimum group size of five (5) accounts before reporting any aggregate metric. See our Terms of Service, Section 8, for details.

De-identified data. We may create de-identified or aggregated data from the information we collect, so that it cannot reasonably be used to identify you, an Audience Member or a device. We will keep it de-identified, will not attempt to re-identify it, and will require anyone we share it with to do the same. We may use de-identified data to operate, improve and develop our services, including to train and evaluate machine-learning and generative AI models. We do not use the content you upload, the personal information of you or your Audience Members, or the pseudonymous activity record itself to train generative AI models.

How we de-identify data. De-identified data must meet all of these:

We take reasonable technical measures so it cannot reasonably be linked to you, an Audience Member or a device.
We publicly commit, in this policy, not to re-identify it.
Anyone we share it with must agree by contract to keep it de-identified and not to try to re-identify it.

Before we use a model trained on de-identified data, we test it to check that it does not reproduce personal information.

When this applies. The use of de-identified data to train and evaluate generative AI models, and any other use beyond our earlier policy, applies only to data collected on or after November 12, 2026. Data collected before that date continues to be handled as our earlier policy described: de-identified aggregates, used for non-generative features only.

The pseudonymous activity record described in Section 5 is not Aggregate Data or de-identified data. We use it to produce reports for the Speaker whose fanflet it describes and, for activity on their own sponsored resources and fanflets, the Sponsor. We do not use the record itself to train any machine learning or AI model, and we do not use it for advertising. We may use it as a source for creating de-identified data, which must then meet the standard above.

2.5 For Safety and Security

We use technical data and Usage Data to:

Detect and prevent fraud, abuse, and security threats
Enforce rate limits to protect the platform
Investigate potential violations of our Terms of Service
Comply with legal obligations

2.6 To Advertise Fanflet

We advertise Fanflet on Facebook and Instagram, which are run by Meta. We use the Meta pixel and an ad click identifier to measure how well those ads work. Meta uses the information it receives from the pixel to measure our ads and to decide who sees them. See Sections 4.4 and 7.2.

---

3. How We Use Your Data for AI

Fanflet uses AI to improve features like recommendations and analytics. Here is what that means for your data:

Speaker Content (resources, files, text, configurations) is never used by Fanflet to train AI models, and our AI service providers are contractually barred from training on it. Public fanflet pages can be reached by outside crawlers we do not control (see our Terms of Service, Section 7.7).
Subscriber Data (email addresses, survey responses, individual engagement data) is never used for AI training. De-identified data created from engagement data, ratings and multiple-choice survey answers may be, as described below. Free-text survey answers are never used for AI training, even after de-identification.
Sponsor Content is never used for AI training without a separate written agreement.
Personal information about you or your Audience Members, and the pseudonymous activity record itself, are never used to train generative AI models.
Fanflet uses de-identified data (like "which resource types get more clicks across the platform") to operate, improve and develop the Services, including to train and evaluate machine learning and generative AI models. It must meet the de-identification standard in Section 2.4.
This use applies only to data collected on or after November 12, 2026. Data collected before that date stays limited to de-identified aggregates for non-generative features.
When Fanflet uses third-party AI services, those providers are contractually prohibited from using Fanflet customer data for their own model training.
Featured comments. When a speaker asks which open-text survey comments to feature, we send the open-text answers, an optional display name, the star rating, the fanflet title, and the question text to TypeSafe AI through Vercel's AI Gateway. TypeSafe acts as a processor under its data processing terms.
Writing assistant. When a speaker uses Fannie, we send the text the speaker types or asks the assistant to rewrite, and the fanflet copy, to Anthropic.
Analytics digests. Short summaries send summary counts to Anthropic. They do not send subscriber lists.
We put data protection agreements in place with these providers. The current list, including each provider's own terms, is at fanflet.com/legal/subprocessors.
If we change this approach, we will update this policy and notify you before it takes effect. We gave that notice for the de-identified data change above (see Section 11).

For full details, see our Terms of Service, Section 7.

---

4. How We Share Your Information

4.1 With Your Audience

When you publish a fanflet, the following information is publicly visible to anyone with the link or QR code:

Your Speaker profile (name, photo, bio)
Your fanflet content (title, event name, resource blocks)
Sponsor Content on your fanflet (if Sponsor Connections are active)

4.2 With Speakers (for Subscriber Data)

When an Audience Member subscribes to a fanflet, the Speaker receives the Subscriber's email address and any survey responses. Speakers are data controllers for this information and are responsible for their own use of it.

4.3 With Sponsors

By default, Sponsors receive aggregate engagement metrics for their own Sponsor Content (total clicks, conversion rates). Sponsors may receive identifiable Subscriber information (such as name and email) only when the Audience Member has given affirmative, captured opt-in to share that information with Sponsors — for example, through a contact-gate, a share-with-sponsors checkbox, or an equivalent consent control. Without that opt-in, Sponsors do not receive individual Subscriber emails or names. Fanflet does not sell Subscriber lists and does not share Subscriber personal information with Sponsors absent that opt-in. When a Sponsor receives that opted-in contact information, the Sponsor receives it as an independent controller and is responsible for its later use.

Sponsors still do not receive:

Individual Audience Member browsing behavior
Speaker analytics beyond their own Sponsor Content performance

4.4 With Service Providers

We share information with service providers who help us operate the Services. We put a data protection agreement in place with each provider that handles personal data. The current list, including purpose, the data involved, location, and a link to each provider's terms, is at fanflet.com/legal/subprocessors. We update that page at least 30 days before a new provider starts handling personal data. When we process personal data for a customer, the Data Processing Addendum applies.

That list includes the database, hosting, backups, email, background jobs, payments, the SMS bookmark text, product analytics, error monitoring, and the AI providers described in Section 3. How we protect the service is described at fanflet.com/security.

Meta Platforms is not on that list. Google Tag Manager loads the Meta pixel only on Fanflet's own marketing pages and on the ad landing page, and only after cookie consent where a choice is required (see Section 7.2). The pixel sends Meta the address and details of the page you viewed, what you did there (a page view, a button click, a form submitted, an account created, or a trial checkout completed), the pixel's cookies (_fbp, _fbc), your IP address, and browser details. It does not send names or email addresses. Meta handles that information under its own terms and privacy policy. The pixel does not load on a speaker's public pages, audience pages, or signed-in dashboards.

4.5 For Legal Reasons

We may disclose your information if required by law, legal process, or government request, or if we believe disclosure is necessary to:

Comply with applicable law, regulation, or legal process
Protect the rights, property, or safety of Fanflet, our users, or the public
Detect, prevent, or address fraud, security, or technical issues
Enforce our Terms of Service

4.6 Business Transfers

If Fanflet is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

4.7 What We Do Not Do

We do not sell personal information to third parties (as defined under CCPA/CPRA)
Other than the information sent to Meta through the Meta (Facebook) pixel (see Sections 4.4 and 7.2), we do not share personal information for cross-context behavioral advertising
We do not send names or email addresses to Meta through the pixel, and we have not uploaded customer lists to Meta
We do not sell Subscriber lists, and we do not provide Subscriber email lists to Sponsors or any third party as a bulk list. Identifiable Subscriber information (such as name and email) is shared with a Sponsor only when the Audience Member has given affirmative, captured opt-in to that share (see Section 4.3)
We do not use personal information for AI model training. We train only on de-identified data, for data collected on or after the AI-use effective date (see Sections 2.4 and 3).

---

5. Data Retention

Data Type	Retention Period	Notes
Account information	Duration of account + 30 days	30-day export window after account deletion
Speaker Content	Duration of account + 30 days	Available for export for 30 days post-deletion
Subscriber Data	Duration of Speaker account + 30 days	Deleted when the collecting Speaker's account is deleted
Ad landing page form submissions	90 days	First name, last name, email address, type of talks, campaign tags, IP address, browser details and, where stored, the ad click identifier and the values of Meta's `_fbp` and `_fbc` cookies. Deleted automatically 90 days after you submit the form, whether or not you create an account
Usage Data (identifiable event detail)	90 days, then removed with that month's records	Individual events: IP address, user-agent, path, device, and per-event timestamps. We store events in monthly batches and delete a whole month at once, after its last day is 90 days old. So an event is kept for between 90 and about 120 days. Before we delete a month, we check that its pseudonymous activity record (next row) is complete. If that check fails, the month waits until the problem is fixed. In rare cases we place a short, logged pause of at most 30 days on one month's deletion while that check is completed
Pseudonymous activity record	Until the fanflet or Speaker account is deleted. A Sponsor's copy: until the Sponsor account is deleted	One row per visitor, fanflet, day and action (for example "viewed", "clicked this resource"), with a count. The visitor is represented by a keyed one-way code derived from the unique-visitor key, not the key itself. No IP address, user-agent, path, email, name or time of day. Used for program and lifetime reporting (for example, how many distinct people engaged with a talk over a year). When a fanflet or Speaker account is deleted, the Speaker's copy is deleted. The copy that describes activity on a Sponsor's own sponsored resources and fanflets is kept for that Sponsor. When only a fanflet is deleted, the Sponsor's copy stays as it was. When the Speaker's account is deleted, the Speaker's identity in the Sponsor's copy is replaced by a meaningless placeholder. Not used for advertising. Not used itself to train machine learning or AI models; it may be a source for de-identified data (see Section 2.4).
Unique-visitor keys	Until the Speaker account or fanflet is deleted	Opaque identifier used only to count unique visitors (first-party cookie UUID with consent, or a one-way hash of IP + user-agent when that cookie is absent). No email, no path, no click stream. Not used for advertising. Deleted when the Speaker or fanflet is erased
Usage Data (de-identified aggregates)	Indefinite	Counts of views, clicks, signups, and similar metrics, retained as Aggregate Data
SMS phone hashes	90 days	A keyed one-way hash, used only for rate limiting. The phone number itself is not stored
Billing records	7 years	As required by tax law
Staff account-access logs	90 days	Records of staff viewing an account. Deleted after 90 days
Database backups	30 days	Fanflet-encrypted copies of the database. Deleted after 30 days
File backups	90 days	Copies of uploaded files. The storage provider encrypts them at rest. Deleted after 90 days
Pre-deletion snapshots	90 days	A copy taken before an account erasure. Deleted after 90 days

---

6. Your Rights and Choices

6.1 All Users

Access your data: Log in to your dashboard to view your information, or email privacy@fanflet.com for a data export
Update your information: Edit your profile and settings through your dashboard
Delete your account: Delete your account through dashboard settings, or email privacy@fanflet.com
Opt out of marketing emails: Use the unsubscribe link in any marketing email
Manage cookies: See Section 7

6.2 California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act, California residents have the right to:

Know what personal information we collect, use, and disclose
Delete personal information we hold about you
Opt out of sale/sharing of personal information (Fanflet does not sell personal information. Through the Meta pixel, Fanflet sends information about visits to its site to Meta for advertising, as described in Sections 4.7 and 7.2. To stop this in your browser, use the Cookie Preferences link described in Section 7.4)
Non-discrimination — we will not discriminate against you for exercising your rights
Correct inaccurate personal information

To exercise these rights, email privacy@fanflet.com or use the controls in your account settings. Put "Privacy request" in the subject line.

6.3 EU/EEA/UK Residents

Fanflet acknowledges the rights granted under the General Data Protection Regulation. While Fanflet is a US-based service that does not currently maintain full GDPR compliance infrastructure (such as an EU representative, Data Processing Agreement, or EU data residency), we will honor reasonable data subject requests from EU/EEA/UK residents, including:

Access — Request a copy of your personal data
Rectification — Request correction of inaccurate data
Erasure — Request deletion of your data
Data Portability — Receive your data in a structured format

To exercise these rights, email privacy@fanflet.com. Put "Privacy request" in the subject line. We aim to respond within 30 days.

---

7. Cookies and Tracking Technologies

7.1 What We Use

Cookie/Technology	Type	Purpose	Duration
Session cookie	Essential	Authentication and session management	Session
CSRF token	Essential	Security (cross-site request forgery protection)	Session
Preferences	Functional	Remember your settings (theme, timezone)	1 year
Cookie consent	Functional	Remember your cookie preference	1 year
`fanflet_vid`	Performance	First-party unique-visitor identifier for Speaker analytics and program reporting (see the pseudonymous activity record in Section 5). Set only when analytics cookie consent is granted (or where consent is not required). Not used for advertising	365 days
Analytics events	Performance	Server-side event tracking for usage analytics	Event detail: 90 days, removed with that month's records (90 to about 120 days). Unique-visitor key and pseudonymous activity record: until the Speaker or fanflet is deleted (a Sponsor's copy: see Section 5)
Google Tag Manager	Analytics	Site traffic on Fanflet's own marketing pages and the ad landing page. Loaded only after cookie consent where a choice is required. Not loaded on a speaker's public pages, audience pages, or signed-in dashboards	Varies
Meta pixel (`_fbp`, `_fbc`)	Advertising	Set by the Meta (Facebook) pixel, which Google Tag Manager loads. `_fbp` identifies your browser to Meta. `_fbc` holds the ad click identifier and is set only when you arrive from a Meta ad. See Section 7.2	90 days (set by Meta)
`ff_attrib`	Analytics	First-party record of how you first reached Fanflet (landing page, referring site, campaign tags). Also holds the Facebook ad click identifier (`fbclid`), only when cookie consent is granted (or where consent is not required)	30 days
`ff_new_account`	Advertising	Set only when a new account is created through Google sign-up and cookie consent is accepted. Used once to tell Meta that an account was created, then deleted. Holds the value `1` and nothing about you	Up to 1 hour

7.2 Third-Party Analytics and Advertising Cookies

Fanflet uses Google Tag Manager (GTM) to analyze traffic on our marketing pages and understand how visitors interact with the site. GTM may set third-party cookies from Google Analytics and related services.

GTM also loads the Meta (Facebook) pixel. We advertise Fanflet on Facebook and Instagram, and the pixel tells Meta about visits to our site. It sends Meta the address and details (such as the title) of the page you viewed, what you did there (a page view, a button you clicked, a form you submitted on an ad landing page, a Fanflet account you created, or a trial checkout you completed), the pixel's cookies (_fbp, and _fbc when you came from a Meta ad), your IP address and browser details. Account creation and trial checkout are reported for any visitor who has the pixel loaded, not only visitors who came from an ad. Meta uses this to measure our ads and to decide who sees them. We do not send your name or email address to Meta through the pixel.

When you arrive from a Meta ad, we also keep the ad click identifier (fbclid) in our own ff_attrib cookie. We keep it only if you have accepted cookies or no consent is required for you, as described below.

For users in the United States and Canada, we show the cookie banner on Fanflet's own marketing pages, sign-in pages, and sign-up pages, and we load Google Tag Manager and the Meta pixel only if you accept. On the ad landing page (/start), those tags load when your choice is saved as accepted, which happens automatically in the United States and Canada. On a speaker's public pages, audience pages, and signed-in dashboards, Google Tag Manager and the Meta pixel do not load. US and Canadian law does not currently require opt-in consent for analytics cookies.

For users outside the United States and Canada, Google Tag Manager and the Meta pixel stay blocked until you accept through our cookie banner, and they load only on Fanflet's own marketing pages and the ad landing page. If you decline, those tags do not load. Product analytics (PostHog) follows the same cookie choice. Our server-side analytics and Vercel Analytics continue to operate regardless of your choice.

7.3 What We Do Not Use

Other than the Meta (Facebook) pixel described in Section 7.2, we do not use third-party advertising cookies or cross-site tracking pixels
Other than advertising Fanflet through Meta (Facebook), we do not participate in ad networks or retargeting programs

7.4 Your Choices

Essential cookies are required for the Services to function.

You can change your cookie choice at any time, in any country, with the Cookie Preferences link in the footer of our marketing pages (including this page) and of public fanflet pages. It reopens the cookie banner. If you choose Decline, GTM and the Meta pixel are no longer loaded on later visits in that browser. They may keep running on the page you have open until you reload or close it. Declining does not delete cookies that were already set (for example _fbp, _fbc and ff_attrib); you can delete them in your browser settings.

If you previously accepted or declined analytics cookies, you can also clear the cookie_consent cookie from your browser to reset your preference. If the cookie banner applies to you (see Section 7.2), you will see it again on your next visit.

---

8. Security

We implement industry-standard security measures to protect your information, including:

Encryption in transit (TLS/HTTPS for all connections)
Encryption at rest (database encryption)
Row-level security (RLS) policies ensuring data isolation between accounts
Keyed one-way hashing of phone numbers (HMAC-SHA256) as soon as we receive them. We store only the hash
Access controls (role-based access, admin authentication with privilege checks)
Regular security reviews of our codebase and infrastructure

No method of transmission or storage is 100% secure. If we become aware of a personal data breach that affects your personal data, we will notify the affected customer within 72 hours after we become aware of it, and we will notify a regulator when the law requires that notice. A fuller description of these controls is at fanflet.com/security. The Data Processing Addendum is at fanflet.com/legal/dpa.

---

9. Children's Privacy

The Services are not directed at children under 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will delete it promptly. If you believe a child under 18 has provided us with personal information, please email privacy@fanflet.com.

---

10. International Data Transfers

Fanflet stores data in the United States. The database is in US East (N. Virginia). Content delivery and CAPTCHA checks may pass through servers in other countries. If you are located outside the United States, your information will be transferred to and processed in the United States.

Fanflet does not currently offer regional data processing or EU-based data storage. We put data protection agreements in place with the providers listed at fanflet.com/legal/subprocessors. TypeSafe AI's data processing terms include EU Standard Contractual Clauses. When Fanflet processes personal data for a customer, the Data Processing Addendum applies. It incorporates the EU Standard Contractual Clauses (Modules 2 and 3) and the UK Addendum by reference.

Users outside the United States should review this policy and our Terms of Service to determine whether the Services meet their data protection requirements.

---

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we will:

Provide notice via email to account holders at least 30 days before the changes take effect
Post the updated policy with a new "Last Updated" date on our website
Where required by law, obtain your consent before the changes take effect

We gave this advance notice for the change that lets us use de-identified data to train and evaluate generative AI models (Sections 2.4 and 3). That change applies only to data collected on or after November 12, 2026. It does not reach data collected before that date.

---

12. Contact Us

If you have questions about this Privacy Policy, your data, or your rights, please contact us:

Privacy: privacy@fanflet.com

Website: fanflet.com

Mailing address: Fanflet, LLC, PO Box 381, Holly Springs, NC 27540

For a privacy request, put "Privacy request" in the subject line.

---

This Privacy Policy was last updated on October 13, 2026.