Privacy Policy

1. Who we are

Afflo is an affiliate-marketing platform operated by [TO FILL] Legal company name, [TO FILL] Registered address, Slovakia, company ID [TO FILL] IČO. This policy explains how we handle personal data under the EU General Data Protection Regulation (GDPR) and Slovak data-protection law (Act No. 18/2018 Coll.).

We have not appointed a Data Protection Officer unless stated here. For privacy questions, write to [TO FILL] privacy e-mail.

2. Controller or processor

Our role depends on whose data it is and why we hold it:

• We are the controller for data about people who use Afflo directly: brand owners and their team members, affiliates and creators who sign up, visitors to our own website, and the people listed in our creator directory.
• We are a processor for data we handle on behalf of a brand: the clicks, visits, leads and orders tracked on that brand's store, and the details of the affiliates in that brand's program as the brand manages them. The brand is the controller and decides why this data is collected. Our Data Processing Addendum governs that processing. If you bought from a brand and have questions about tracking, contact that brand first; we will help them answer you.

3. Account holders (brands, team members and affiliates)

What we collect

• Account data: name, e-mail address, password (stored only as a secure hash), brand name, and the workspace you belong to.
• Affiliate profile: social handle, discount code, referral link, the team member who invited you (if any), and program membership and status.
• Earnings and payouts: commissions, payout history and payout details you provide (for example a PayPal e-mail or bank details, or a Stripe Connect account ID).
• Integration data: when a brand connects Shopify, WooCommerce, Stripe or PayPal, the access tokens and settings needed for the connection.
• Usage and security data: session identifiers, sign-in times, and technical logs (IP address, browser, error messages) kept by our hosting provider.
• Messages you send us, for example support requests.

Why we use it, and our legal basis

• To create and run your account, track referrals, calculate commissions and help brands pay affiliates: performance of a contract (Art. 6(1)(b) GDPR).
• To keep the Service secure, prevent fraud and abuse, and fix errors: legitimate interests (Art. 6(1)(f)) in a safe and working service.
• To send service messages, such as invitations, payout notices and changes to our terms: contract and legitimate interests.
• To keep accounting and tax records and answer lawful requests from authorities: legal obligation (Art. 6(1)(c)).
• If we ever send marketing e-mails, we will do so only with your consent or as otherwise allowed by law, and every message will have an unsubscribe link.

When an affiliate joins a brand's program, that brand can see the affiliate's name, e-mail, handle, code, performance and payout details, so it can run the program and pay them. From that point the brand also acts as a controller for that data.

4. Shoppers on brands' stores

Brands add our tracking snippet to their store or connect their store by webhook. On their behalf we process the following, as their processor:

• Click and visit data: a random visitor ID and click ID (stored in first-party cookies and local storage on the brand's site, see the Cookie Policy), the affiliate link or code used, landing page, referring page, browser user agent, approximate country, and a salted hash of the IP address.
• Leads: after someone arrives through an affiliate link, if they type an e-mail address into a form on the brand's site, the snippet sends it to us so a later purchase can be credited. We store only a salted hash of the e-mail address.
• Orders: order ID, amount, currency, discount codes, refund status, the landing page and the order fields the brand's store or system sends us. The customer's e-mail and IP address are used to match the order and are stored only as salted hashes.

We use this data only to attribute sales to affiliates, detect fraud (for example self-referrals and bot clicks) and show the brand why a sale was credited. We do not use it to build advertising profiles, we do not combine it across different brands for marketing, and we do not sell it. The brand is responsible for informing its shoppers and, where required, getting their consent for this tracking.

5. Creator directory

Our creator directory helps brands find creators to invite to their affiliate programs. We are the controller for this data.

What we collect, and from where

• Public channel information only: channel or show name, handle, profile image, public description, topics, country and language (where published), and public statistics such as subscribers, followers, total views and number of videos or episodes.
• A business contact e-mail address, only where the creator has published one in their public channel description or podcast RSS feed. This e-mail is never shown publicly; it is visible only to signed-in brands.
• Sources: the official YouTube Data API, Apple Podcasts and the show's public RSS feed, and the Twitch API. Every profile links back to the original channel. We do not scrape private data, and we do not collect information about viewers or listeners.

Purpose and legal basis

We rely on our legitimate interests (Art. 6(1)(f) GDPR), and those of brands, in connecting creators who publicly present themselves as available for business enquiries with brands that want to work with them. We limit the data to public, channel-level business information, keep contact details away from the public, and make removal immediate, so we believe this does not override creators' interests. You can ask us for our balancing assessment.

Removing or claiming your profile

• Remove: open your profile and press Remove this profile. It disappears right away and will not be imported again. No account is needed.
• Object by e-mail: you can also write to [TO FILL] privacy e-mail with a link to your channel. You have the right to object at any time (Art. 21 GDPR).
• Claim: put the code we show you in your channel or show description to prove ownership. You can then hide or show your profile whenever you like.

Freshness and retention

Profiles are refreshed from the source regularly. YouTube data is refreshed or hidden once it is 30 days old, as YouTube's API terms require. If a channel is deleted or no longer available at the source, we remove it from the directory. When a profile is removed, it is hidden at once and its contact e-mail is deleted; we keep a record of the removed channel (its platform and channel ID) so that it is not imported again.

Brands that contact you through the directory are independent controllers of the messages they send and must follow anti-spam laws and our acceptable use rules. YouTube users can also review Google's Privacy Policy.

6. How long we keep data

• Account data: while your account is open. After you close it, we delete or anonymise it within 90 days, except what we must keep by law.
• Commission, payout and invoice records: for as long as accounting and tax law requires (in Slovakia generally up to 10 years).
• Sessions: sign-in sessions expire after 30 days.
• Tracking data processed for brands: for as long as the brand keeps its account, unless the brand deletes it earlier; deleted within 90 days after the brand closes its account.
• Creator directory: as described in section 5.
• Server logs: for the limited period our hosting provider keeps them.

7. Sub-processors and recipients

We do not sell personal data. We share it only with:

• Vercel Inc. (hosting and content delivery; servers in the EU and the US).
• Neon (managed Postgres database hosting).
• Resend (sending transactional e-mails, such as invitations and password resets).
• Shopify, WooCommerce (the brand's own site), Stripe and PayPal, only when a brand connects them, to receive orders, create discount codes or send payouts. These services are chosen by the brand and act under their own terms.
• Google (YouTube Data API), Apple (Apple Podcasts) and Twitch as sources of public creator data. We send them only search requests, not your personal data.
• The brand whose program you join (for affiliates), and affiliates see their own referred sales without shoppers' contact details.
• Professional advisers, and authorities or courts where the law requires it.
• A buyer or successor if our business is sold or merged, under the same protections.

We will update this list before adding a new sub-processor that handles brands' data, as described in the DPA.

8. International transfers

Some of our providers are based in, or can access data from, countries outside the European Economic Area, mainly the United States. Where that happens we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework, for providers certified under it) or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and get a copy.
• Rectify inaccurate data. Most account data can be edited in the app.
• Erase your data ("right to be forgotten") where there is no reason for us to keep it.
• Restrict how we use your data in certain cases.
• Data portability: receive data you gave us in a machine-readable format.
• Object to processing based on legitimate interests, including the creator directory, and to direct marketing at any time.
• Withdraw consent at any time, where we rely on consent, without affecting earlier processing.

Write to [TO FILL] privacy e-mail. We will reply within one month (extendable by two months for complex requests) and may need to confirm your identity first. Where we process data for a brand, we will forward your request to that brand and help it respond.

You can also complain to a data-protection authority. In Slovakia this is the Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk. You may also complain in the EU country where you live or work.

10. Security

• All traffic is encrypted with HTTPS. Passwords are stored as salted hashes, never in plain text.
• Shoppers' e-mail and IP addresses are stored as salted hashes, so they can be matched but not read back.
• The session cookie is HTTP-only, and API keys are stored as hashes.
• Access to production data is limited to staff who need it, and brands only see their own workspace.

No system is perfectly secure. If a breach affects your data and puts you at risk, we will tell you and the authorities as the law requires.

11. Children and automated decisions

The Service is not meant for anyone under 18, and we do not knowingly collect their data.

We use automated checks to flag possibly fraudulent clicks and orders for review. These checks do not by themselves produce legal or similarly significant effects: a flagged commission is held for the brand to review, and you can ask the brand for a human review.

12. Changes to this policy

We will update this policy when our processing changes. For significant changes we will notify account holders by e-mail or in the app. The date at the top shows the latest version.

13. Contact and complaints

• Company: [TO FILL] Legal company name
• Registered office: [TO FILL] Registered address, Slovakia
• Company ID (IČO): [TO FILL] IČO, [TO FILL] Commercial register entry
• VAT ID: [TO FILL] VAT ID (IČ DPH)
• Contact: [TO FILL] contact e-mail
• Data protection contact: [TO FILL] privacy e-mail