Privacy policy

FLAMA, a sole proprietorship of 1500 N Grant Street, Denver, CO 80203, is the data controller for everything described here. Contact us at support@flamahealth.com or (720) 472-8094. Requests to see, correct or delete what we hold go to that address, and the contact page lists every route.

Account. Your name, email address, and a password hash, we never see or store your actual password.

Phone number. Given at checkout so we can text you to arrange payment and delivery. Nothing else, and we do not pass it on.

Research-use declaration. Before you can browse the site we ask you to confirm you are over 21, that you are acquiring material for laboratory research, that you have read the disclaimer, and which kind of researcher you are, one of 5 options. That answer is kept in your own browser so we do not ask again, and it is recorded on any order you go on to place, alongside the version of the disclaimer you agreed to. It is the record of the basis on which we sold to you, so it is kept with the order rather than deleted when you clear your browser.

Shop orders. Name, email, and shipping address for any peptide order, plus the reference you paid against and the proof you submit. If you are signed in when you order, the order is attached to your account and appears in your order history. Guests can order without an account; that order belongs to nobody and is reachable only through the secret link we give you. If you create an account while placing an order, that order is added to it when you confirm your email address. We do that from the link itself, never by matching your email, because matching would let somebody read a stranger’s order by signing up with their address.

Payments. Orders are settled off-card, in cash when we hand the order to you. We never receive or store card numbers. As a customer, we hold the reference and the confirmation of what was paid, not your bank credentials. Affiliates are the exception, and the section below says why.

Payment confirmation. Because peptide orders are not paid by card, a person here checks each payment by hand. When we do, we record what actually arrived, the reference, and, on any method where the money is sent rather than handed over, the name or handle shown on the incoming payment. That name is often not the name on the order, that is precisely why we keep it, because otherwise we cannot tell whose money paid for what.

On-chain payments. If you pay in USDC we keep the wallet address you sent from and the transaction hash, because that is the only way to tie a transfer to your order. Both are already public on the blockchain, we did not put them there, and we do not link them to anything beyond the order they paid for. If you connect a wallet in your browser to pay, that connection happens between your wallet and the network; we see the address, not your keys.

On your device, not ours. Your delivery details and a pointer to your most recent order are kept in your own browser, so checkout can fill itself in and so an unpaid order is not lost when you navigate away. That copy never reaches us, it is not how we identify you, and clearing your browser data removes it. We hold the same details against the order you placed, described above.

Checkout device. When you place an order we record the IP address and browser user-agent the order came from. No card network sits behind these payments to settle a dispute for us, so this is the only evidence either of us has that an order was genuinely placed, it protects you against someone ordering in your name as much as it protects us. It is attached to the order and visible only to FLAMA administrators. We do not use it to track you across the site or anywhere else.

Technical. Standard server and security logs kept by our hosting provider.

Affiliates carry a discount code and earn on orders placed with it. That is a different relationship from being a customer, and it holds different data. This is all of it.

Your application. Your name, email address, date of birth, timezone, and the social media handles you give us, at least one of which is required. We record the IP address the application came from. The date of birth is there for one reason: the programme has a floor of 21 and we check it.

Your affiliate record. If we approve you: a display name, a title and biography if you provide them, a profile image if you upload one, your city and state, your referral code, and a link to your login. Photographs and video you upload are stored in a public bucket, because a public profile was what they were for.

How we pay you. Whichever you choose: a Zelle handle, a Venmo handle, or a bank account name, routing number and account number. The account number is the one genuinely sensitive thing we store about anybody, we hold it only because a wire cannot be sent without it, and only administrators can read it.

What you earn. Commission on each order placed with your code, the rate that applied at the time, your payout requests and what we paid against them, and any note an administrator wrote when deciding one.

Content you claim a bonus on.The link to the video, the view count you claim, a screenshot of it, and your statement that the content follows the affiliate rules. The screenshot is stored privately, unlike your profile images. We keep an administrator’s decision and note against it.

Applications from people we do not approve are kept rather than deleted, so the same person reapplying is not a stranger to us. Ask us and we will delete yours.

• To take payment, ship orders, and keep tax and order records, contract and legal obligation.
• To run the affiliate programme, pay commission and meet the tax reporting that comes with paying somebody, contract and legal obligation.
• To keep accounts secure and prevent abuse, our legitimate interests.
• To match incoming payments to orders, and to hold evidence if one is later disputed or charged back, our legitimate interests in being paid for what we ship and in not shipping against money that never arrived.

We do not sell your data, we do not share it with advertisers, and we do not use it to train machine-learning models.

FLAMA administrators, and nobody else.Your order, your address and the payment details you submit are read by the people who pack and settle it, and by no one outside FLAMA. Access rules are enforced in the database itself, by row-level security applied to every query, not by our interface choosing what to show, so a bug that asked for someone else’s order would still be refused.

We do not sell your data, share it with advertisers, or use it to train machine-learning models.

• Supabase, database, authentication. Hosted in Canada.
• Resend, transactional email such as order confirmations, password resets, and shipping notifications.
• Netlify, running the website itself.
• Twilio, text messages about your order, and alerts to us when one is placed. It receives the phone number you give at checkout and the content of those messages.
• NOWPayments, card and crypto payment processing for the shop where you choose that method. It receives the order amount and reference, and it, not us, handles the card.
• Reown (WalletConnect), the connection between your own crypto wallet and this site if you pay that way. It brokers the connection in your browser and sees your wallet address; it never holds your keys, and it is not involved unless you connect a wallet.

Each acts on our instructions under a data-processing agreement. Some operate outside your country; transfers are covered by standard contractual clauses or an equivalent safeguard.

• While you have an account, your profile and order history stays until you delete it or close the account.
• When an account is deleted, all of the above is removed.
• Affiliate records, kept while you are in the programme. Commission and payout records are kept with the order records below, because they are the same transaction seen from the other side and the same tax rules apply to them. Payout details are deleted on request once nothing further is owed.
• Order and payment records, kept for as long as tax and accounting law requires, typically 6–7 years, even after an account closes. The payment-confirmation and checkout-device details above are part of the order record and are kept with it, because a dispute can surface long after delivery.

Depending on where you live you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider.

Email support@flamahealth.com and we will respond within one month. If you are unhappy with the outcome you can complain to your local data protection authority.

Data is encrypted in transit and at rest. Access rules are enforced at the database layer, and the keys that could bypass them are held server-side only and never sent to a browser.

No system is perfect. If a breach affects you, we will tell you and the relevant regulator as required by law.

FLAMA is for people 21 and over. That is the floor for the whole site, not only for buying, and you confirm it before you can browse. We do not knowingly collect data from anyone younger. If you believe a minor has given us data, contact us and we will delete it.

If we change this policy the date at the top changes with it, and we will email you before anything material takes effect. Our terms and research-use policy sit alongside this document.