Privacy Policy

Last updated: September 28, 2026

This policy explains what personal data Affiliatops collects, why, and what you can ask us to do about it. It covers affiliatops.com and the tracking script Businesses install on their own sites. Affiliatops is the controller for account data and the processor for the customer and partner data Businesses store in their workspaces.

1. Who’s who

Businesses create workspaces and decide which customer and referral data goes in. For that data, the Business is the controller and Affiliatops is the processor — the Business’s own privacy notice applies to its customers and Partners. Affiliatops is the controller for the account data described below.

2. What we collect

• Account data: name, email, password hash, role, company name and business type for workspaces, and any payout details a Partner enters (for example bank or e-wallet information) so the Business can pay them.
• Tracking data: when someone clicks a referral link or uses a referral code, the tracker script sets first-party cookies on the Business’s site — a referral/code value, a random visitor id, a short session id, and visit parameters (UTM values, page URL). No cross-site profiles, no advertising, no selling of data.
• Referral and commission records: what the Business records about referred customers — which can include a customer’s name and email. Businesses can turn on email masking for Partners, and our APIs then hide or mask customer contact details from partner-facing views.
• Operational data: product emails we send (invites, one-time codes, notifications, scheduled reports), server logs, and security audit logs.

3. Why we use it

• To run the service: attribute referrals, calculate commissions, show dashboards, send notifications, webhooks, and reports you configure (performance of a contract).
• To keep accounts and the platform secure, prevent fraud such as fake referrals, and enforce our Terms (legitimate interests).
• To send service emails — sign-up review, one-time login codes, receipts, product notifications. Marketing is not sent without an opt-in.

4. Cookies

We use first-party cookies only; there are no third-party advertising cookies:

• auth-token — signs you in (httpOnly, 24 hours). affiliatops-workspace — remembers the last workspace you opened (httpOnly, up to 1 year).
• On sites using the tracker: affiliatops_ref (or legacy refferq_ref) — the referral code that should get credit, 30 days; affiliatops_vid — a random visitor id, 365 days; affiliatops_sid — a visit session marker, 30 minutes; affiliatops_utm — the visit’s campaign parameters, 30 days; affiliate_attribution — set after a referral-link click, 30 days.
• Session and analytics-style cookies above are strictly necessary or equivalent-to-necessary for the referral program to work, so they are set without a banner; clearing them stops attribution for new visits.

5. Who we share data with

• Processors we use: hosting on our own server with Docker/Dokploy behind Cloudflare; email delivery through Resend; payment processing for Affiliatops’s own plans through Stripe; outbound signed webhooks to addresses each Business configures.
• Within the workspace: admins and teammates the Business invites see its workspace data; Partners see only their own performance, and customer contact details only if the Business has not hidden them.
• We do not sell personal data and do not share it for others’ advertising.

6. Where data lives and how long

Data is hosted on our server and processed with the providers above. Account and workspace data is kept while your account is open; after a workspace is deleted there is a short recovery window before removal. Tracking cookies keep the lifetimes listed above. Server and audit logs are kept for a limited period for security and troubleshooting.

7. Security

Passwords are stored only as bcrypt hashes. Sessions use signed, httpOnly cookies. Webhook payloads are signed so receivers can verify them. Access to production is limited, and partner-facing APIs apply per-workspace permissions and customer-email masking.

8. Your rights

You can ask to see, correct, export, or delete your personal data, and can object to or restrict certain processing. Business users can manage most of this directly in the workspace. Email [email protected] and we will respond within a reasonable time. If you are in a region with a data-protection authority, you can also complain to yours.

9. Children

Affiliatops is for businesses and working partners. We do not knowingly collect data from children, and partner programs must not target them.

10. Changes

If this policy changes materially we will note the new date here and, for account holders, notify by email where required.

11. Contact

Privacy questions: [email protected].