affilut — Privacy notice
This notice covers data processing for affilut.com. The sico-wide privacy notice applies in addition.
1. Data we collect from merchants
- Account data — email address, hashed password (via SuperTokens).
- Stripe Connect — Stripe account ID and OAuth tokens used to create and pay out affiliate commissions on your behalf. We do not store card numbers or bank account details.
- Programme configuration — commission rates, payout schedules, and campaign settings you define.
- Conversion events — sale amounts, order IDs, and attributed affiliate codes, used to calculate commissions.
2. Data we collect from affiliate partners
Affiliates are invited by merchants and create their own accounts. We collect:
- Name and email address.
- Stripe account ID (if they connect Stripe for direct payouts) or PayPal email address.
- Referral link click and conversion statistics.
3. Legal basis
For merchants: processing is necessary to perform the contract (UK GDPR Art. 6(1)(b)). For affiliates: processing is based on the affiliate's consent when they accept the programme invitation and create an account.
4. How we use the data
Merchant data is used to run and administer their affiliate programme. Affiliate data is used to track conversions, calculate commissions, and facilitate payouts. We do not sell data or share it with parties other than those listed below.
5. Data retention
Active accounts: retained for the lifetime of the subscription. On account deletion: personal data purged within 30 days. Financial records (commission payouts, invoices) retained for 7 years per UK accounting requirements, then deleted.
Affiliates may request deletion of their account by emailing privacy@sico.software. Payout records that are required for the merchant's accounting obligations will be anonymised rather than deleted.
6. Sub-processors
- Stripe — payment processing, subscription billing, and Connect payouts.
- Hetzner — VPS hosting; data stored in EU.
- Resend — transactional email (invite, payout confirmation).
- PostHog (EU) — product analytics.
7. Contact
Privacy queries: privacy@sico.software.