Affiliate Privacy Notice

• The referral code, and which affiliate it belongs to.
• An opaque visitor identifier we generate. It is a random value with no meaning outside our database.
• The page landed on, and any campaign, source and medium tags the affiliate added.
• A one-line summary of the browser, such as “Chrome on Windows”.
• A keyed hash of the IP address. The IP address itself is never stored. The hash uses a server-side secret so it cannot be reversed by trying every address, and it exists only to notice implausible click volume from one source.
• The time of the visit.

No name, no email address and no account details are recorded at this point, because at this point we do not know them.

Opening a referral link sets one first-party cookie containing only the opaque visitor identifier. It is HttpOnly, so page scripts cannot read it, and SameSite=Lax. It expires at the end of the attribution window, 30 days by default.

It carries no referral code, no affiliate identity and nothing about the person. Where the program is configured to require consent, the click is still counted but no cookie is set and no attribution is stored.

If a visitor with a live attribution creates an account, we link the attribution to that account so a later purchase can be credited. If they then buy, we record a commission holding the amounts, the product, the payment provider’s identifiers, and which customer account it relates to.

Affiliates see counts, amounts and statuses. They do not see who bought: no name, no email address, no organization name, no billing address, no invoice, and no payment reference. Each commission carries a short opaque reference that can be quoted in a support conversation and identifies nobody.

This is enforced by what the queries behind those screens select, rather than by hiding fields in the interface.

A vendor sees referred orders for their own products — amounts, commission cost and their proceeds — and nothing about the purchaser or the referring affiliate. A vendor cannot see another vendor’s orders.

• Click records: 180 days by default, then deleted automatically. Aggregate performance survives.
• Attribution records: closed when the window expires; retained as part of the commission record where one was created.
• Commissions, ledger entries and payouts: retained as financial records for as long as accounting and tax obligations require. These are append-only and are not deleted.

Payment processing and payouts involve a payment provider, which receives what it needs to process the payment. We do not sell this data, do not use it for advertising, and do not share it with affiliates beyond what section 4 describes.

Depending on where you live you may have rights to access, correct, export or erase personal data we hold about you. Contact us to exercise them. Note that financial records we are required to keep cannot be erased on request; where that applies we will say so and explain why.

Two decisions in this notice are legal positions rather than technical facts, and both need confirming before the program opens publicly:

• Whether arriving on a referral link is a sufficient basis for setting the attribution cookie in every market served, or whether explicit consent is required in some. The program supports both and is currently set to the former.
• Whether the keyed IP hash is personal data in the relevant jurisdictions, and therefore what retention and access rights attach to it.