Privacy Policy

Last updated: August 2026

1. What we collect

• Account data: name, email, password (hashed), role, country, payout details (held by Stripe, not us), social profiles and audience information you provide.
• Tracking data: when a visitor clicks an affiliate link we record the click ID, affiliate/brand/offer identifiers, IP address, user agent, referrer and landing URL, and set first-party cookies (na_ref, na_aff) so purchases can be attributed.
• Order data: order ID, total, discount code, and customer email/ID as provided by the brand's store integration - used solely for attribution, commission calculation and refund reconciliation.
• Usage data: pages visited, dashboard actions, and approximate analytics.

2. How we use it

• Operate attribution, commission accounting and payouts
• Fraud detection and platform security
• Product improvement, aggregated statistics, and the public program directory (program terms only - never your personal data)
• Service communications (payout notices, account alerts, dunning)

3. What we share

We share the minimum necessary: brands see performance data for their own programs; Stripe receives payout onboarding data; we use sub-processors for hosting, email and analytics. We do not sell personal data. We may disclose data when required by law.

4. Cookies

We use session cookies (authentication, security) and first-party attribution cookies (na_ref, na_aff) with configurable lifetimes matching each program's cookie window. You can block cookies, but attribution and login will not work without them.

5. Your rights

Depending on your jurisdiction (GDPR/UK GDPR, CCPA/CPRA and others), you may have rights to access, correct, export, delete, or restrict processing of your personal data, and to object to certain processing. Contact privacy@nutriaffiliate.com to exercise them. Account deletion removes personal data while preserving anonymized financial ledger records we must retain for accounting and legal compliance.

6. Retention & security

Financial and ledger records are retained as required by tax and accounting law. Other personal data is retained while your account is active and deleted or anonymized within 12 months of closure. We use encryption in transit, hashed credentials, HMAC-verified webhooks and role-based access controls.

7. International transfers

Data may be processed in the United States and other countries where our infrastructure operates, with appropriate safeguards for cross-border transfers.

8. Children

The Service is not directed at anyone under 18.

9. Changes & contact

Material changes are announced 14 days in advance. Contact: privacy@nutriaffiliate.com