affilut — Privacy notice
This notice covers data processing for affilut.com. The sico-wide privacy notice applies in addition.
1. Data we collect from merchants
- Account data — email address, hashed password (via SuperTokens).
- Stripe connection — your Stripe account ID and either an OAuth token (from Stripe's approval screen) or a read-only restricted key you paste, stored encrypted. affilut only reads charge metadata to attribute referred conversions. It does not create charges, move money or pay affiliates — you pay your affiliates directly. We do not store card numbers or bank account details.
- Programme configuration — commission rates, payout thresholds, and campaign settings you define.
- Conversion events — sale amounts, order IDs, and attributed affiliate codes, used to calculate commissions.
2. Data we collect from affiliate partners
Affiliates join a merchant's programme by invitation or by applying, and reach their portal through a private link rather than a password. We collect:
- Name and email address.
- A payout preference, if they choose to give one — a method (PayPal, bank, Wise, Revolut or other) and a reference such as a PayPal address — which is shown to the merchant so the merchant can pay them. affilut never acts on it.
- Referral link click and conversion statistics. A click record holds a one-way hash of the visitor's IP address, their browser user-agent, the referrer and the landing page.
3. Legal basis
For merchants: processing is necessary to perform the contract (UK GDPR Art. 6(1)(b)). For affiliates: processing is based on the affiliate's consent when they accept the programme invitation or apply to join.
4. How we use the data
Merchant data is used to run and administer their affiliate programme. Affiliate data is used to track conversions and calculate the commission each merchant owes, so the merchant can pay it directly. We do not sell data or share it with parties other than those listed below.
5. Data retention
Active accounts: retained for the lifetime of the subscription. On account deletion: personal data purged within 30 days. Financial records (commission payouts, invoices) retained for 7 years per UK accounting requirements, then deleted.
Affiliates may request deletion of their account by emailing privacy@sico.software. Payout records that are required for the merchant's accounting obligations will be anonymised rather than deleted.
6. Sub-processors
- Stripe — billing for your affilut subscription, and read-only access to your charge metadata for attribution. No payouts run through Stripe on affilut's side.
- Hetzner — VPS hosting; data stored in EU.
- Resend — transactional email (invite, payout confirmation).
- PostHog (EU) — product analytics.
7. Contact
Privacy queries: privacy@sico.software.