Privacy Policy

This Privacy Policy explains how AffRef ("we," "us") collects and uses personal information when you use our affiliate-marketing platform (the "Service"). If you are an affiliate or a shopper of one of our merchant customers, the merchant is the data controller and we process your data on their behalf.

1. Information we collect

• Merchant accounts: name, email, hashed password, billing details (handled by Stripe), Shopify store URL, plan.
• Affiliate accounts: name, email, hashed password, payment-method details you submit (e.g. PayPal handle, bank-transfer reference), commission history.
• Tracking data: when a shopper clicks an affiliate link, we record the affiliate code, referring URL, landing URL, IP address (and derived approximate country), user agent and timestamp. Attribution is stored in a first-party cookie on the merchant's own domain.
• Conversion data: Shopify order ID, order total, currency, discount codes and customer email forwarded to us by your merchant's webhook to attribute commissions.

2. How we use information

• To provide, maintain and improve the Service.
• To attribute clicks and conversions and calculate affiliate commissions.
• To process subscription payments through Stripe.
• To send service-related email (receipts, welcome emails, security notices, support replies).
• To detect fraud, abuse and unusual activity.
• To comply with legal obligations.

3. Sharing

We do not sell personal data. We share it only with the subprocessors needed to run the Service:

• Stripe — payment processing for merchant subscriptions.
• Shopify — receives our tracking script and sends order webhooks.
• Email provider (e.g. Resend) — sends transactional email.
• Cloud hosting — stores the database and serves the application.
• Klaviyo — only if a merchant explicitly enables the Klaviyo integration.

We may also disclose information if required by law or to protect our rights.

4. Cookies & tracking

The AffRef tracking script writes a first-party cookie on the merchant's own domain to remember which affiliate referred a shopper. The cookie does not contain personal information beyond the affiliate's referral code and an attribution timestamp. We use no third-party advertising cookies.

5. Retention

We keep merchant and affiliate account data for as long as the account is active and for a reasonable period afterwards to handle disputes and comply with legal obligations. Click and conversion records are kept while the merchant's program is active or until the merchant deletes them. Backups may be retained for up to 90 days.

6. Your rights

Depending on where you live, you may have the right to access, correct or delete the personal data we hold about you, to object to certain processing, and to lodge a complaint with a data-protection authority. Email [email protected] to exercise these rights. If you are an affiliate or shopper, we may direct your request to the merchant who controls the data.

7. Security

Passwords are stored hashed (bcrypt). Payment-card data never touches our servers — it is collected and stored by Stripe. We use HTTPS everywhere and follow industry-standard practices to protect data in transit and at rest. No internet service can be guaranteed 100% secure.

8. Children

The Service is not intended for anyone under 18.

9. Changes

We may update this Policy. Material changes will be communicated by email or in-app notice.

10. Contact

Privacy questions? Email [email protected].