Short version: we collect the minimum needed to run the affiliate program, we never store plaintext passwords, and third-party ad networks (where used) have their own policies linked directly.
| Field | Purpose | Stored |
|---|---|---|
| Affiliate ID | Public identity + storefront + tracking attribution | plaintext |
| Contact email | Operational contact + support | plaintext |
| Password | Sign-in only | hash (bcrypt/scrypt class) — never plaintext, never logged |
| Tracking links created for you | Attribution of provider-approved commissions | link records keyed to your ID |
| Session token | Keeping you signed in | HTTP-only cookie, short-lived |
❌ We don't display, log, or store plaintext passwords — yours, or any master account secrets. Owner/provider connections use encrypted server-side storage with least-privilege access.
❌ We don't sell or share your registration data. Provider attribution uses numeric sub-IDs, not your personal details.
❌ We don't invent tracking events. Reports on the dashboard show live provider data only, when a provider connection is active.
When a site carries ads, the ad network (currently ExoClick) may store data on your device to select ads. Each ad carries its own disclosure + link to the provider's privacy policy. Where required (e.g. DSA transparency), we present the provider's own dialog and a decline control. A consent notice appears before personalized ad storage where applicable; declining keeps the page layout intact with ads collapsed.
ExoClick privacy policy: https://www.exoclick.com/privacy-policy/
Test affiliates and automation-test records are clearly labeled as test data and are never used to fabricate statistics or payable commissions.
Account data persists while your account is active. Deleted accounts: hashed credential destroyed; minimal audit trail (timestamps, totals only) retained. Contact via support to request deletion.