Privacy Policy

Effective: May 23, 2026

This Privacy Policy describes how Candles and Clones LLC (“we,” “our,” “us”) collects, uses, and protects information when you use the cbd.domains portfolio and agentic-SEO demo at cbd.domains (the “Service”). By using the Service you agree to this Policy.

1. Information we collect

We collect only what we need to operate the Service:

• Contact info you submit — business name, your name, email, optional phone, city. Provided when you submit the opt-in widget on /seo/audit or /contact.
• Magic-link authentication tokens — short-lived one-time codes we email you to verify ownership of an email address for admin access. Tokens expire within 15 minutes and are single-use.
• Account activity — sign-in timestamps, source IP address (for security/abuse detection), and any content or settings you create on the platform.
• Cookies — a session cookie to keep you signed in after authentication. We do not use third-party advertising cookies.

2. How we use information

• To deliver requested SEO audits, follow-up communication, and partnership inquiries you opt into.
• To send transactional email related to your account: magic links and notifications you have opted into.
• To detect and prevent abuse, spam, and unauthorized access.
• To comply with legal obligations.

Marketing communications are sent only with double opt-in via oglife.app under a clearly named cohort. Standard opt-out applies.

3. The oglife.app round-trip

When you submit a form on cbd.domains, your information is sent to oglife.app (operated by BM Distribution LLC under a data-processing arrangement with Candles and Clones LLC) which handles the double opt-in and consent ledger. A copy is mirrored back to cbd.domains so we can deliver the audit or other content you requested.

4. Third-party services

We use a small number of vendors to operate the Service. Each only receives the data needed for its function:

• Vercel Inc. — web hosting, CDN, request logs.
• Neon Inc. — managed Postgres database.
• Resend — transactional email (magic links).
• Twilio — SMS delivery via oglife.app's dispatcher.

5. Data retention

We retain account information for as long as your account is active. When you delete your account or revoke opt-in, we delete the associated personal data within 30 days, except where retention is required by law or for legitimate fraud-prevention purposes.

6. Your rights

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate data by contacting us.
• Deletion — revoke opt-in via the unsubscribe link in any message we send, or by emailing the contact below.
• Portability — request an export of your content.

7. The /seo activity feed

cbd.domains/seo displays a real-time activity feed of SEO work being done for clients. Business names are never shown publicly — only sector and city. Clients can request to be excluded from the public feed at any time by contacting us.

8. Security

We use industry-standard safeguards including TLS in transit, encrypted storage at rest, passwordless magic-link authentication (no stored passwords), and least-privilege access. No system is perfectly secure; we encourage you to use a unique email address you control.

9. Children

cbd.domains is not directed to children under 13 and we do not knowingly collect personal information from children under 13. If you believe a child has provided us their information, contact us and we will delete it.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced on the Service and the effective date above will be updated.

11. Contact

Candles and Clones LLC (cbd.domains)
Privacy inquiries: privacy@cbd.domains
General contact: hello@cbd.domains