Privacy Policy

Last updated: August 2, 2026

This Privacy Policy explains how AffiliateOS ("AffiliateOS", "we", "us") collects, uses, shares, and protects information when you use our websites, applications, APIs, and related services (the "Service"), and when campaign traffic is measured through the platform.

AffiliateOS serves three kinds of customers — advertisers, publishers, and networks — who use the platform to run affiliate partnerships. In much of that activity we process data on behalf of and at the direction of our customers; this policy also describes that processing so the full picture is in one place.

1. Information we collect

Information you provide

• Account information — name, email address, company name, role, password (stored as a salted hash), and profile details you add;
• Business and payout information — billing details, payout preferences, and tax-related information collected from payers and payees as required to process payments;
• Campaign content — offers, creatives, rate cards, rules, and other configuration you enter; and
• Communications — messages you send to support or through the Service.

Information collected automatically

• Usage data — log data about how you use the Service, such as pages viewed, features used, IP address, browser and device type, and timestamps;
• Tracking and attribution data — when campaign traffic is measured through the platform, we process event data such as click identifiers, referring URLs, campaign and sub-identifiers (for example pub_id/sub_id values), IP address, user-agent and device signals, approximate location derived from IP, conversion events, and postback payloads sent to us by advertisers, networks, or their systems; and
• Cookies and similar technologies — we use first-party cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and measure campaign activity. Where consent is required for non-essential cookies, we rely on the consent collected at the point the technology is set.

Information from others

We receive information from our customers and their systems (for example, an advertiser's postback reporting a conversion), and from service providers such as fraud-prevention and payment partners.

2. How we use information

• to provide, operate, and secure the Service;
• to track, attribute, and report on campaign activity between the parties to a partnership, and to calculate amounts owed under their configured terms;
• to detect and prevent fraud, invalid traffic, and abuse of the Service;
• to process payments and payouts and maintain financial records;
• to communicate with you about the Service, including transactional and security notices, and — with your consent where required — product news you can opt out of at any time;
• to comply with legal obligations and enforce our terms; and
• to create aggregated or de-identified data that does not identify you or any person, which we may use to operate and improve the Service.

3. How information is shared

We share information only as described here:

• Between the parties to a partnership. The platform exists so advertisers, publishers, and networks can transact. Campaign data is visible to the parties to that campaign according to the platform's visibility rules — for example, an advertiser sees spend, volume, and quality signals for channels running its offers, and a network sees activity across the desk it operates. We do not reveal one party's confidential economics (such as a network's margin) to another through standard product surfaces.
• Service providers — vendors who host infrastructure, process payments, provide analytics, or help with fraud prevention and support, bound by contracts limiting their use of the data;
• Legal and safety — when required by law, legal process, or to protect the rights, safety, or property of AffiliateOS, our users, or the public;
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy; and
• With your direction or consent.

We do not sell personal information.

4. Data retention

We retain personal information for as long as needed to provide the Service and for legitimate business purposes such as maintaining financial records, resolving disputes, preventing fraud, and complying with legal obligations. Tracking and attribution records are retained for as long as needed to support validation windows, reversals, audits, and payout obligations of the parties, after which they are deleted or de-identified. Account information is deleted or de-identified within a reasonable period after account closure, except where retention is required by law.

5. Security

We use administrative, technical, and physical safeguards designed to protect information — including encryption in transit, hashed credentials, scoped team permissions, and audit logging. No system is perfectly secure; please use a strong, unique password and keep API keys confidential. If we learn of a breach affecting your personal information, we will notify you as required by law.

6. Your rights and choices

Depending on where you live, you may have rights over your personal information, including the right to access, correct, delete, restrict, or receive a copy of it, to object to certain processing, and to withdraw consent where processing is based on consent.

• Account data — you can review and update most account information in the Service, or contact us for help;
• Marketing — you can opt out of non-essential email at any time via the unsubscribe link or your settings;
• Requests — to exercise any right, contact privacy@affiliateos.ai. We will verify your request and respond within the time required by applicable law. You will not be discriminated against for exercising your rights.

If you are an end user of a campaign measured through the platform (for example, you clicked a partner's link), the advertiser, publisher, or network you interacted with is typically the controller of that data, and we process it on their behalf. We will refer your request to the relevant customer where that is the case, or assist them in responding.

European Economic Area / United Kingdom. Where the GDPR or UK GDPR applies, our legal bases are performance of a contract, legitimate interests (such as securing the Service and preventing fraud), consent where required, and compliance with legal obligations. You may lodge a complaint with your local supervisory authority. Where personal data is transferred out of the EEA or UK, we use appropriate safeguards such as standard contractual clauses.

California. Where the CCPA/CPRA applies, the categories of personal information we collect and our purposes are described above. We do not sell personal information or share it for cross-context behavioral advertising as those terms are defined by the CCPA. You may exercise access, deletion, and correction rights as described above.

7. Children

The Service is for business use and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

8. International transfers

We may process and store information in the United States and other countries where we or our service providers operate. Where required, transfers are protected by appropriate safeguards.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we will provide notice — for example by posting the updated policy here with a new "Last updated" date, or by notifying you in the Service or by email. Changes take effect when posted unless a later date is stated.

10. Contact

Questions or requests about privacy can be sent to privacy@affiliateos.ai.