Privacy Policy

AffiliateBase ("we," "our," or "us") provides affiliate tracking and commission management software. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

1. Information We Collect

1.1 Account Information

Account Administrators and Team Members:

• Email address
• Name (first and last)
• Account name and details
• Stripe Connect account information (account ID, OAuth tokens)
• Role within the account (owner, admin, member)

Affiliates:

• Email address
• Name (first and last)
• Payment information (PayPal email, Wise email, or payout references)
• Profile information you choose to provide

When an affiliate refers a sale, we add the affiliate's name and email address to the referral details we store on the business's Stripe records for that sale (see section 4.1).

1.2 Tracking and Referral Data

When visitors click affiliate referral links or use promo codes on websites using our tracking script, we collect:

• Device Information: Browser type, operating system, device type (desktop/mobile/tablet)
• Network Information: IP address
• Browsing Information: Referring URL, page URL, page title
• Tracking Identifiers: Visitor ID (randomly generated), referral ID, affiliate token

1.3 Transaction Data

When integrated with payment processors (Stripe), we receive:

• Customer email and name (as provided to the payment processor)
• Transaction amounts and dates
• Subscription and invoice details
• Coupon/promo code usage
• Refund information

1.4 Automatically Collected Information

• Log data (access times, pages viewed, errors)
• Browser and device information and a first-party analytics identifier
• Product interactions, setup progress, and account-level usage events
• Authentication events

1.5 AI Connector Information

When an account owner or admin connects an AI assistant (such as ChatGPT) or creates an AI connector token, we keep:

• The connector's name, the account it can access, who authorized it, when it was created, when it was last used, and when it expires or was revoked
• For assistants connected by sign-in, the assistant's registration details (its name and the address it returns to after you approve access)
• Access and refresh tokens, which we store only in hashed form

We use PostHog to understand use of our website and application. We remove query strings and redact secret-bearing routes before analytics events are sent. Session replay is disabled on the marketing website and on password reset, invitation, and campaign join pages in the application. Where application replay is enabled, form inputs and page text are masked and images are blocked.

2. How We Use Your Information

We use collected information to:

• Provide the Service: Track referrals, calculate commissions, and manage payout records
• Attribution: Determine which affiliate referred which customer
• Fraud Prevention: Detect suspicious patterns, self-referrals, and invalid clicks
• Communication: Send transactional emails (commission notifications, payout confirmations, invitation emails)
• Support: Respond to inquiries and provide customer service
• Improvement: Analyze usage patterns to improve our service
• Legal Compliance: Meet regulatory requirements and enforce our terms

3. Cookies and Tracking Technologies

3.1 Cookies We Use

When a visitor arrives through an affiliate link on a website that uses our tracking script, the script stores referral details in a cookie on that website's own domain. When our tracking server records the referral, it also sets cookies on the affiliatebase.io domain; on the business's website these are third-party cookies. Referral cookies last for the campaign's cookie duration, which the business sets (60 days by default). Cookies set by affiliatebase.io are sent only over HTTPS.

3.2 Local Storage

On websites that use our tracking script, we store the same referral details in browser localStorage (ab_attribution:<account ID>) as a backup in case cookies are blocked. When the script finds referral data saved under the older ab_referral cookie or ab_attribution localStorage names, it moves that data to the current names and clears the old entries.

On our marketing website, we also store a first-visit record in localStorage (affiliatebase.first_touch): the first page you visited, any campaign tags (UTM source, medium and campaign) in that page's address, and the type of site that referred you, such as a search engine or AI assistant. We do not store the referring address itself. When you sign up, this record is passed to our application with your account so we can understand which marketing brings customers.

We also store an analytics opt-out flag in localStorage on this browser. The cookie control below applies across our website and application and prevents Google Analytics from loading on our marketing website when you have opted out.

3.3 Cookie Control

To opt out of browser-based AffiliateBase product analytics, use the control below. The choice is stored in a first-party cookie and applies across our website and application. We may still process limited server-generated operational events needed to provide, secure, and troubleshoot the service.

Opt out of browser analytics

Our referral tracking script is installed by our customers on their websites. If you wish to disable those referral tracking cookies, you can:

• Adjust your browser settings to block cookies
• Use browser extensions that block tracking scripts
• Contact the website owner directly

4. Information Sharing and Disclosure

4.1 With Organizations (Our Customers)

We share affiliate and referral data with the organizations that use our platform, including:

• Affiliate performance metrics (clicks, conversions, commissions)
• Customer attribution (which affiliate referred which customer)
• Commission and payout records

For a referred sale, we also add referral details to the metadata of the business's Stripe records for that sale (the customer, payment, invoice, charge, and subscription). These details include the referring affiliate's name and email address, the referral link token, and the campaign name, and the business can see them in its Stripe account.

4.2 With Affiliates

Affiliates can view:

• Their own referral and commission data
• Customer information (if enabled by the organization)
• Payout history

4.3 Service Providers

We share data with the following service providers, who process it on our behalf to operate our service:

A dash means we do not list a single processing location for that provider.

If you enable self-billing invoices, we check EU VAT numbers with the European Commission's VIES service. VIES receives the VAT number being checked and, where available, your own VAT number.

4.4 Legal Requirements

We may disclose information if required by law, legal process, or government request, or to protect our rights, privacy, safety, or property.

4.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, user information may be transferred to the acquiring entity.

4.6 AI Assistants You Connect

An account owner or admin can connect an AI assistant to their AffiliateBase account, either by signing in and approving access (for example, from ChatGPT) or by creating an AI connector token for a tool such as Claude Code, Cursor, or Codex. We share data with an AI assistant only when it requests that data on behalf of the connected account, typically because a user asked it a question.

Depending on what is requested, a connected AI assistant can receive:

• Setup status and installation guidance for the account
• Campaign details and dashboard summary figures
• Affiliate names, statuses, and referral counts; email addresses and ban details are included only when the user explicitly asks for those details
• Referral records and attribution details, without visitor IDs or raw link tokens
• Commission and payout amounts, statuses, and dates
• If the connector was created with promo-code management, the Stripe promo codes and discounts assigned to affiliates

AI assistants do not receive your customers' names or email addresses, affiliates' payout details, or Stripe credentials. The AI provider processes data it receives under its own terms and privacy policy, not ours. Review the provider's policy before you connect it.

Owners and admins can see and revoke every connection in Settings → AI Connectors. Revoking a connection stops access immediately. A connection also stops working when the person who authorized it leaves the account.

5. Data Retention

We retain data as follows:

• Account Data: Until the account is deleted. Owners can delete an account from Settings while it has no affiliate program, billing, or Stripe event records; to delete an account that has any of these, such as campaigns, affiliates, referrals, sales, commissions, payouts, or Stripe webhook events, contact us
• Referral Records: For as long as the account exists, because commission and payout history depends on them. A referral record includes the visitor ID, referring page, and landing page from the visitor's first tracked visit, and the referred customer's email address once known. The visitor's IP address and browser details are removed from the record 180 days after that visit, as is the IP address recorded with a conversion
• Visit Logs: Each tracked visit (with IP address, browser details, and pages) is deleted after 180 days. Daily click totals per affiliate, which contain no personal information, are kept for reporting
• Sales, Commission, and Payout Records: For as long as the account exists. When an account with these records is deleted, we keep what we need for tax and legal compliance for up to 7 years
• Stripe Webhook Events: For events we don't act on, such as events from an account that has disconnected, we keep only identifiers: the event ID and type, the Stripe account, and the ID of the Stripe object. Payments not linked to an affiliate and checkout events are kept in full for 30 days, other processed events for 90 days, and events that failed for 1 year, then reduced to the same identifiers (checkout events also keep their referral reference). Events for Stripe accounts with no AffiliateBase account are deleted after 30 days
• Outbound Webhook Delivery Logs: 90 days
• Email Delivery Records: Recipient address and delivery status, 1 year
• Sign-In Sessions: IP address and browser details, deleted 30 days after the session expires
• AI Connector Records: Until the AffiliateBase account is deleted, including revoked connectors, so owners and admins can review past access. A sign-in connection is also deleted when the person who authorized it deletes their login
• Backups: Deleted data can remain in our private database backups for up to 30 days

6. Data Security

We implement industry-standard security measures including:

• Encryption in transit (TLS/HTTPS)
• Encryption at rest for sensitive data
• OAuth 2.0 for the Stripe connection, with automatic token refresh. When you disconnect Stripe, we delete the Stripe tokens we store; to revoke access on Stripe's side, also remove the AffiliateBase app in your Stripe Dashboard
• OAuth 2.1 with PKCE for AI assistant connections, with short-lived access tokens and connector tokens stored only as hashes
• Account-scoped access controls: every request is limited to data in your own account
• Automated security and dependency scanning before every release

7. Your Rights and Choices

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data
• Portability: Receive your data in a portable format
• Objection: Object to certain processing activities
• Withdrawal: Withdraw consent where processing is based on consent

To exercise these rights, contact us at support@affiliatebase.io.

8. International Data Transfers

Our services are hosted in the United States. If you access our service from outside the US, your information may be transferred to and processed in the US, which may have different data protection laws than your country.

9. Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it.

10. Third-Party Links and Integrations

Our service integrates with third-party services (Stripe, payment processors) and with AI assistants you choose to connect (see section 4.6). These services have their own privacy policies, and we encourage you to review them.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date.

12. Contact Us

If you have questions about this Privacy Policy, contact us at:

AffiliateBase
Email: support@affiliatebase.io

For California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected
• Right to know whether personal information is sold or disclosed
• Right to opt-out of the sale of personal information
• Right to equal service and price

We do not sell personal information. To exercise your rights, contact support@affiliatebase.io.

For European Residents (GDPR)

If you are in the European Economic Area, our legal bases for processing are:

• Contract: Processing necessary to provide our services
• Legitimate Interest: Fraud prevention, service improvement, analytics
• Consent: Marketing communications (where applicable)
• Legal Obligation: Tax records, legal compliance

You may contact your local data protection authority if you have concerns about our data practices.