Privacy Policy

Affily (“we”, “us”) runs Affily and decides how personal data on it is used (the “controller” in data-protection terms). Contact: hello@affily.me. This policy sits alongside our Terms of Service.

One role worth knowing about: a brand that reports conversions to us is responsible for the data it sends us about its own customers. We recommend brands send only an order or subscription identifier, never a customer’s name or email address.

Account data. Email address, name, your roles (creator, brand or both), whether the email is confirmed, when you last signed in, and an avatar URL if you set one. A password is stored only as a bcrypt hash; we cannot read it. If you sign in with Google, Facebook or Instagram we store that account’s identifier, and the name, picture and (Google and Facebook only) confirmed email it gives us. We keep none of their access tokens: each is used once, to ask who you are. Instagram never shares an email, so you give us one and confirm it.

Profile data you publish. For creators: display name, headline, bio, avatar, niches, social platform handles and links, follower counts, average views, engagement rate, audience demographics and starting rates. For brands: company name, website, logo, description, categories and location. Programs, applications (including the message you write), partnerships and reviews are also stored. Once you publish, a profile and its contents are public to anyone, including search engines. Audience figures are labelled as self-reported.

Uploads. Images and video you upload are stored on our server under a name derived from the file’s contents, and are served from a public address. Anyone who has that address can open the file, whether or not your profile is published. We do not remove metadata such as camera location from files you upload, so strip it first if it matters.

Click and conversion data. When someone opens a tracked link (affily.me/go/…), we record a click row containing: a hashed version of their IP address and of their browser’s user-agent string, the page that referred them (up to 500 characters of the referring URL), a two-letter country code when our network provider supplies one, which link and program it was, and the time. We do not store the raw IP address or user-agent in the click record. The hashes are created with a secret key held on our server, so they cannot be reversed by guessing, but they stay consistent so we can tell repeat visits apart and match a later sale to a click. A short separate record of those hashes drives a 24-hour repeat-click check and expires automatically after about 48 hours. Because the referring URL is stored as sent, it can contain whatever the referring site put in it.

Conversions reported by a brand (through Stripe or Shopify webhooks, signed server-to-server callbacks or the browser tag) store the brand’s order identifier, the order amount and currency, a subscription identifier for recurring programs, the click it was matched to, and how it was matched.

Gift delivery details. When you request a gift that needs them, we collect a postal address (your name, address lines, city, region, postal code, country and, optionally, a phone number) or, for a booking, a note with dates and names. We collect these only for that request, never for a gift that needs nothing. The country alone is visible to the brand while it decides. The rest is visible only to the brand that runs that program, and only from the moment it approves the request. It is never shown on your public profile, to other brands, or in any email. It is stored separately from the request itself.

Free-tool emails. The media kit generator asks for an email before you download your PDF. We store the address, the name if you gave one, which tool it came from, and a small summary of what you built (your total followers and which platforms). The kit itself is built in your browser and is not uploaded. The engagement rate calculator does not collect an email.

Payments data. We store Stripe identifiers (a connected-account ID for creators; a customer ID, a payment-method ID and a display label such as card type and last four digits for brands), and our own records of commissions, payouts and fees. Card numbers, bank details and identity documents are collected and held by Stripe, not by us.

API keys and integration secrets. For an API key we store its name, a visible prefix, a SHA-256 hash of the key, its scopes, and when it was last used. If a brand connects Stripe or Shopify for conversion tracking, we store the webhook signing secret it gives us, and each program’s own signing secret.

Technical data. Our web server writes standard access logs in production that include IP address, browser user-agent, requested address, referrer and status code. Our host and any network provider in front of us can keep similar logs. Unlike the click record, these logs can contain raw IP addresses.

• To provide Affily (contract): accounts, profiles, programs, tracking links, attribution, commissions, settling and payouts.
• To send service emails (contract): a draft is ready to review, someone applied to your program, an application was accepted or declined, a payout is on its way. We do not send advertising from the platform itself.
• To keep Affily safe and fair (legitimate interests): spotting fake or repeated clicks, forged conversions and abuse, rate limiting, security and debugging.
• To contact people who used a free tool (legitimate interests or your consent, depending on where you are): to tell you when something relevant ships.
• To meet legal obligations, such as tax, accounting, sanctions and responding to lawful requests.

We do not sell personal data, and we do not use it for advertising profiles.

These companies process data for us or because you asked us to use them.

• Stripe: payment processing, creator payouts (Stripe Connect) and saving a brand’s card for later charges. Stripe is also an independent controller of the data it collects to verify you and prevent fraud, and its own privacy policy applies. Stripe.js loads in your browser on the billing screen and may set its own cookies.
• Cloudflare: R2 object storage for the images and videos you upload (avatars, logos, portfolio files). Uploaded files are served publicly from a Cloudflare-hosted address, so anyone with the link can see them.
• An SMTP email provider: sends our service emails, so it sees recipient addresses and message contents. The provider is whichever one is configured for the deployment (to be named here before launch).
• Google, only if Google sign-in is switched on: the sign-in button loads Google’s script from Google, which means Google sees your visit to the sign-in and sign-up pages.
• Meta (Facebook and Instagram), only if you choose to sign in with either: you approve Affily on their site, and they tell us who you are. They learn that you signed in to Affily.
• Hosting and database providers: our server, MongoDB database and file storage run on infrastructure we rent (to be named here before launch). They store everything described above on our behalf.
• The other side of a deal. A brand sees an applying creator’s profile, application message and tracked performance. A creator sees a brand’s program, terms and payment record with them. Click and conversion statistics are shown in aggregate and per link; individual visitors’ hashed identifiers are not shown. If you request a gift, the brand running that program also sees the delivery details for it, once it approves the request (section 2).
• The public, for anything you publish (section 2), and for reviews.
• Authorities and advisers where the law requires it, to protect our rights, or in a sale or restructuring of the business.

Some of these providers are outside your country, including in the United States. Where required, we rely on safeguards such as standard contractual clauses or an adequacy decision. Details of the transfer mechanism for each provider will be confirmed before launch.

We set two cookies and use no advertising or analytics cookies.

• affily_token: keeps you signed in. It is HTTP-only (scripts on the page cannot read it), SameSite=Lax, marked Secure in production, and lasts 7 days. Strictly necessary.
• aff_click: set when you follow a creator’s tracked link. It holds the identifier of that click and lasts as long as the program’s cookie window (set by the brand, between 1 and 365 days), and exists so a later purchase can be matched to the click that led to it. This one is readable by scripts and is SameSite=Lax. You can delete it in your browser; the link’s click identifier is also added to the address of the page you land on.

Our own site code does not use localStorage or sessionStorage. Brands that follow our integration guides may store the click identifier on their own site, under their own privacy policy. Third parties we load (Google sign-in, Stripe.js) may set cookies of their own, which are covered by their policies.

We would rather say plainly what we do than promise automated deletion we have not built.

• The repeat-click check records expire automatically after about 48 hours.
• Gift delivery details (postal addresses and booking notes) are deleted automatically and straight away when a gift is marked received, or the request is declined or cancelled. Otherwise they are deleted 30 days after the brand marks the gift as shipped, and in any case no later than 120 days after the request. The record that a request happened (the gift, its status and dates) stays, without the address.
• Everything else (account, profile, click and conversion records, commissions, payouts, reviews, leads, uploads) is kept while your account is active and is not currently deleted on a timer. We delete or anonymise it on request (section 7), except what we must keep: payment, payout and tax records, and records needed to resolve disputes or prevent fraud.
• Commission, payout and partnership records are shared between a creator and a brand and may need to be kept for both sides’ accounting even after one of them leaves.
• Server logs and backups are kept by us and our providers for the periods they operate. These periods are to be confirmed before launch.
• Email addresses from free tools are kept until you ask us to delete them, or until the address becomes an account.

Depending on where you live (for example under the EU GDPR, the UK GDPR, or California and other US state privacy laws), you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong (you can edit your profile yourself at any time);
• delete your data;
• restrict or object to some uses, including contact from a free-tool signup;
• give you your data in a portable format;
• withdraw consent where we rely on it. Withdrawing does not affect what we did before.

To use any of these, email hello@affily.me from the address on your account. We will check it is you, and we aim to answer within one month. At the moment there is no self-service delete button or data export in the product, so these requests are handled by hand. We do not discriminate against anyone for using these rights. If you are in California, we do not sell or “share” personal information as those terms are defined in the CCPA.

To remove a visitor’s click data (for example, you clicked a tracked link), the records hold only hashed identifiers, so we may need you to tell us roughly when and which link, and we may not be able to find it. If you think we have handled your data unlawfully, you can complain to your local data-protection authority (in the UK, the ICO). We would appreciate the chance to put it right first.

Passwords are hashed with bcrypt. API keys are stored only as hashes and are shown once. Visitor identifiers in click records are keyed hashes. Sign-in cookies are HTTP-only and Secure in production, and card and bank data stay with Stripe. No system is perfectly secure. If a breach affects your personal data, we will tell you and the regulators as the law requires.

Affily is for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us data, email hello@affily.me and we will delete it.

If we change this policy, the “last updated” date above will change, and for material changes we will email account holders or show a notice on the site.

Questions or requests about your data: hello@affily.me. Affily.