Privacy Notice

Fanli.com, LLC is responsible for the personal information described here. Its business and service address is 112 Robinson Road, #03-01, Singapore 068902; privacy requests may be sent to service@en.fanli.com.

At this draft's effective date, the US service is not publicly launched and Fanli has no US office or employees, US-targeted advertising, live US users or US revenue. State-law scope, California thresholds, notice-at-collection obligations, sale or sharing analysis and Global Privacy Control behaviour must be reassessed before a public US launch and whenever those operating facts change.

For email registration, Fanli processes your email address, display name and a one-way hash derived from your password; it does not store the password itself. If you register or sign in with Google, Fanli receives the Google account identifier and issuer, email address and verification status, display name and, when available, a profile-image URL. Fanli does not request access to Gmail, contacts or Google Drive.

Fanli records your selected country site and locale and the version, action, source and time of the User Terms acceptance, Privacy Notice presentation and age confirmation. Those legal records do not contain a date of birth, raw IP address, user agent, OAuth token or cookie.

When you select GoShop, Fanli creates a pseudonymous member identifier and a unique click identifier with country-site, store, offer and destination snapshots. Those identifiers are sent to the affiliate-link service so that partner-reported order identifiers, amounts, currencies, statuses and timestamps can later be matched and used to administer cashback.

For application-level abuse prevention, Fanli uses short-lived HMAC-derived identifiers. The application rate-limit store does not retain the raw IP address or raw email address in those identifiers, and the counters expire after 15 minutes. Support and withdrawal information is created only when you use those features.

We use this information to create and secure accounts, provide requested services, attribute purchases, administer cashback and withdrawals, prevent abuse, answer requests, maintain accounting and dispute records and comply with law.

Account and confirmation fields marked as required are needed to create or secure an account. Without them, Fanli cannot complete registration, sign-in or the requested account feature.

Optional marketing, profiling and non-essential browser tracking are currently disabled. If Fanli offers those purposes later, this notice and the available choices must be updated before they are enabled.

Registration is not consent to marketing, targeted advertising, profiling or non-essential tracking. Depending on applicable state law and thresholds, you may have rights to know, access, correct, delete or obtain a copy of information and to opt out of certain sale, sharing, targeted advertising or profiling.

We do not use the registration checkboxes as consent for optional marketing or tracking. Those activities remain disabled until separately reviewed and clearly offered.

The final state-law scope, notice-at-collection categories and treatment of sale, sharing, targeted advertising and Global Privacy Control must be documented against the real operation before approval.

If you use Google, identity information is exchanged with Google. Production verification email is designed to use AWS SES. GoShop sends the pseudonymous identifiers and routing data described above to the affiliate-link service and the selected store. Fanli also relies on application-hosting, managed MySQL and Redis, security and content-delivery providers. The web application has no direct bank API or automated payment processor; approved withdrawals are handled through a separate finance process.

Stores and affiliate networks receive or create information connected with the relevant shopping journey under their own roles and notices. The final production inventory must identify the actual providers, roles, purposes and processing locations and document any applicable opt-out or transfer safeguards before launch.

Actual processing locations and any contractual or other transfer safeguards must be documented before approval.

Google OAuth security data and email-verification codes expire after ten minutes; application rate-limit counters expire after 15 minutes. User sessions expire after seven days by default and may be configured from five minutes to 30 days; staff sessions expire after no more than eight hours.

Persistent account, click, order, cashback, withdrawal, support, legal-acceptance and audit records are kept only for their purposes and applicable security, dispute, tax, accounting and legal periods. The final schedule must state a period or usable criterion for each category before launch. The current release does not irreversibly delete those persistent records automatically.

Fanli uses technical and organisational measures intended to protect accounts and records against unauthorised access, alteration or loss. No service can promise absolute security; material incidents are handled under the applicable requirements.

Contact service@en.fanli.com to exercise applicable privacy rights. We will verify requests proportionately, respond within the applicable period and explain any available appeal. You will not receive unlawful discriminatory treatment for exercising a right.

Fanli may request proportionate information to verify a request. We will explain when a request cannot be fulfilled in full and identify any available complaint or appeal route.

Fanli uses automated matching to associate partner-reported orders with GoShop click identifiers and to update cashback status. Fanli is intended for adults aged 18 or over and does not currently make solely automated decisions that produce legal or similarly significant effects.

We update this notice when purposes, recipients, retention or legal requirements materially change. The version and effective date above identify the notice that applies.