Privacy Notice

Fanli.com, LLC is responsible for the personal information described here. Its business and service address is 112 Robinson Road, #03-01, Singapore 068902; privacy requests may be sent to service@en.fanli.com.

Whether a UK representative, data protection officer, ICO fee or data protection impact assessment is required must be documented against the real operation before approval.

For email registration, Fanli processes your email address, display name and a one-way hash derived from your password; it does not store the password itself. If you register or sign in with Google, Fanli receives the Google account identifier and issuer, email address and verification status, display name and, when available, a profile-image URL. Fanli does not request access to Gmail, contacts or Google Drive.

Fanli records your selected country site and locale and the version, action, source and time of the User Terms acceptance, Privacy Notice presentation and age confirmation. Those legal records do not contain a date of birth, raw IP address, user agent, OAuth token or cookie.

When you select GoShop, Fanli creates a pseudonymous member identifier and a unique click identifier with country-site, store, offer and destination snapshots. Those identifiers are sent to the affiliate-link service so that partner-reported order identifiers, amounts, currencies, statuses and timestamps can later be matched and used to administer cashback.

For application-level abuse prevention, Fanli uses short-lived HMAC-derived identifiers. The application rate-limit store does not retain the raw IP address or raw email address in those identifiers, and the counters expire after 15 minutes. Support and withdrawal information is created only when you use those features.

We use this information to create and secure accounts, provide requested services, attribute purchases, administer cashback and withdrawals, prevent abuse, answer requests, maintain accounting and dispute records and comply with law.

Account and confirmation fields marked as required are needed to create or secure an account. Without them, Fanli cannot complete registration, sign-in or the requested account feature.

Optional marketing, profiling and non-essential browser tracking are currently disabled. If Fanli offers those purposes later, this notice and the available choices must be updated before they are enabled.

Depending on the purpose, processing relies on taking steps at your request or performing our contract, complying with legal obligations, or legitimate interests in security, fraud prevention, service operation and legal claims. Any consent-based activity will be offered separately and can be withdrawn.

We do not use the registration checkboxes as consent for optional marketing or tracking. Those activities remain disabled until separately reviewed and clearly offered.

The final purpose-by-purpose basis for accounts, security, GoShop, orders, cashback, withdrawals, support and required records must be documented against the real operation before approval.

If you use Google, identity information is exchanged with Google. Production verification email is designed to use AWS SES. GoShop sends the pseudonymous identifiers and routing data described above to the affiliate-link service and the selected store. Fanli also relies on application-hosting, managed MySQL and Redis, security and content-delivery providers. The web application has no direct bank API or automated payment processor; approved withdrawals are handled through a separate finance process.

Stores and affiliate networks receive or create information connected with the relevant shopping journey under their own roles and notices. The final production inventory must identify the actual providers, roles, purposes and processing locations and document any applicable opt-out or transfer safeguards before launch.

UK restricted-transfer safeguards and the actual processing locations must be documented before approval.

Google OAuth security data and email-verification codes expire after ten minutes; application rate-limit counters expire after 15 minutes. User sessions expire after seven days by default and may be configured from five minutes to 30 days; staff sessions expire after no more than eight hours.

Persistent account, click, order, cashback, withdrawal, support, legal-acceptance and audit records are kept only for their purposes and applicable security, dispute, tax, accounting and legal periods. The final schedule must state a period or usable criterion for each category before launch. The current release does not irreversibly delete those persistent records automatically.

Fanli uses technical and organisational measures intended to protect accounts and records against unauthorised access, alteration or loss. No service can promise absolute security; material incidents are handled under the applicable requirements.

Contact service@en.fanli.com to exercise applicable UK GDPR rights, including access, correction, erasure, restriction, portability, objection or withdrawal of consent. You may use the same privacy contact to raise a data-protection complaint. Fanli will acknowledge that complaint within 30 days, investigate it without undue delay, keep you informed as appropriate and tell you the outcome. You may also complain to the Information Commissioner's Office.

Fanli may request proportionate information to verify a request. We will explain when a request cannot be fulfilled in full and identify any available complaint or appeal route.

Fanli uses automated matching to associate partner-reported orders with GoShop click identifiers and to update cashback status. Fanli is intended for adults aged 18 or over and does not currently make solely automated decisions that produce legal or similarly significant effects.

We update this notice when purposes, recipients, retention or legal requirements materially change. The version and effective date above identify the notice that applies.