Privacy Policy

1. Who we are

AffiliateTrack is operated by StatsDrone Inc., 4035 Rue Saint-Ambroise, Suite 216, Montreal, Quebec, H4C 2E1, Canada. We are the organisation responsible for the personal information described in this policy (the “controller” under the GDPR, and the organisation responsible under Quebec's Law 25 and Canada's PIPEDA).

For any privacy question, request or complaint — including a request to be removed from our index — contact our Privacy Officer at hello@affiliatetrack.io, or write to us at the address above.

2. This policy covers two very different groups

Being clear about this is the most important thing in this document.

• Customers — people who create an AffiliateTrack account. We collect their information directly from them, to provide the Service. Sections 3 to 6.
• People behind affiliate sites — whose business contact details appear in our index. We did not collect that information from them, and most of them have never heard of us. They have specific rights, and we explain exactly how to exercise them. Section 7.

3. Customer information we collect

• Account data — name, work email address, company, password (stored hashed, never in plain text), and your account settings.
• Billing data — if you subscribe to a paid plan, your payment is processed by Stripe. We receive the fact of payment, the plan, and limited card metadata such as brand and last four digits. We never receive or store your full card number.
• Usage data — the searches you run, shortlists you build, features you use, and exports you take. We use this to operate the Service, to enforce plan and export limits, and to detect abuse (see Section 9).
• Technical data — IP address, browser and device information, and server logs, collected automatically when you use the app.
• Communications — what you send us by email or support request.

4. Sharing data and insights with us (opt-in)

When you sign up, we ask whether you would like to share certain data and insights with us — for example, how your affiliate recruitment performed, or signals that help us improve our scoring and build aggregate industry benchmarks.

• It is off by default. We only collect this if you switch it on.
• Our lawful basis is your consent, and you can withdraw it at any time in your account settings, without giving a reason.
• Declining changes nothing else. The Service works the same, at the same price, whether you opt in or not.
• We do not sell it, and we do not publish it in identifiable form. Where we use it to produce benchmarks or improve scoring, it is aggregated or de-identified so that you and your brands cannot be picked out.
• If you withdraw consent, we stop using newly shared data. Aggregate statistics already derived cannot always be unwound, because you can no longer be identified within them.

5. How we use customer information, and our lawful bases

• To provide the Service — create your account, authenticate you, deliver search, scoring and export. Basis: performance of our contract with you.
• To bill you for paid plans. Basis: contract, and legal obligation for tax and accounting records.
• To support you and respond to what you send us. Basis: contract and our legitimate interest in supporting our customers.
• To secure the Service — detect fraud, abuse, credential sharing and unauthorised extraction of the index. Basis: our legitimate interest in protecting our product and our customers.
• To improve the Service — understand which features are used. Basis: legitimate interests.
• To send product email about your account, security and material changes. Basis: contract. Marketing email is sent only with your consent, and every marketing message has a working unsubscribe link.
• Optional data and insights sharing. Basis: your consent (Section 4).

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

6. Who we share customer information with

We use a small number of service providers, who process data only on our instructions and only for these purposes:

• DigitalOcean — cloud hosting and databases.
• Stripe — payment processing for paid plans.
• Mailgun and Google Workspace — transactional email and correspondence.

We may also disclose information where we are legally required to, or to establish or defend legal claims. If our business is sold or reorganised, information may transfer to the acquirer, who would remain bound by this policy.

7. The affiliate index — information about people we did not collect from them

This section is for people who find themselves in our index. It is our notice to you under Article 14 of the GDPR.

What we hold. Information about affiliate websites and the businesses behind them: the site and its content, the brands it promotes, estimated traffic and keyword rankings, and business contact details — typically a work email address, a contact form, or a public social handle. Where an affiliate site is run by an individual, a work email address is still personal information, and we treat it as such.

Where we got it. From publicly available web pages that we crawl, and from third-party data providers. We did not collect it from you.

Why we process it. To operate a business-to-business partner-discovery service: helping brands identify affiliate sites relevant to their vertical and contact the businesses behind them.

Our lawful basis is legitimate interests (GDPR Article 6(1)(f)) — ours and our customers' interest in identifying potential commercial partners, balanced against your rights. We have carried out a legitimate interests assessment; you can request a summary of it at the address below. We limit ourselves to business contact information and information about a site's public commercial activity. We do not knowingly collect special category data, and we do not process personal information about consumers or site visitors.

Automated scoring. We score sites automatically on signals such as traffic, rankings and brand overlap. These are commercial assessments of a website, not of a person, and they do not produce legal effects concerning you or similarly significantly affect you. You can ask us how a score was reached.

Your rights, and how to use them. You can ask us to give you a copy of what we hold, correct it, delete it, restrict it, or object to it entirely — and because we rely on legitimate interests, you can object at any time and we will stop, unless we have compelling grounds that override your rights. In practice, if you ask to be removed, we remove you.

Email hello@affiliatetrack.io with the domain concerned. We will respond within 30 days. When we remove a site, we also add it to a suppression list so that later crawls do not re-index it.

Removal from our index does not delete copies that customers exported before you asked. Under our Terms & Conditions, those customers are independently responsible for honouring your request, and we will tell you if you ask.

8. Cookies and tracking

This marketing site sets no cookies and loads no third-party scripts. There is no advertising network, no analytics tag, and no social pixel on these pages. Fonts are served from our own domain, not from a font CDN.

The AffiliateTrack application itself sets a small number of strictly necessary cookies, to keep you signed in and to keep your session secure. These are required for the app to work and cannot be switched off.

9. Security

We protect personal information with measures appropriate to its sensitivity: encryption in transit (HTTPS/TLS), hashed passwords, access controls on a least-privilege basis, and logging of access to production systems.

No system is perfectly secure. If a confidentiality incident occurs that presents a risk of serious injury, we will notify the Commission d'accès à l'information du Québec, any other regulator we are required to notify, and affected individuals, as the law requires, and we keep a register of such incidents.

10. Where your information is held

We are based in Canada, and our infrastructure is hosted with DigitalOcean. Personal information may therefore be processed in Canada, the United States and the European Union, and may be accessible to the courts and authorities of those countries.

Where we transfer personal information out of the EEA or the UK, we rely on appropriate safeguards — for Canada, the European Commission's adequacy decision, and otherwise the Standard Contractual Clauses. We assess the destination before transferring, as Quebec's Law 25 requires.

11. How long we keep it

• Account data — while your account is open, and for 12 months after you close it, so that you can reopen it and so we can resolve disputes.
• Billing records — for as long as tax and accounting law requires, which in Canada is generally six years.
• Index records — refreshed continuously while a site remains active. When a site disappears or we are asked to remove it, we delete the record and keep only the minimum needed to honour a suppression request.
• Logs — typically 90 days, longer where needed to investigate abuse.

12. Your rights

Wherever you are, you can ask us to access, correct, delete, or export your personal information, to restrict or object to how we use it, and to withdraw consent you previously gave. Under Quebec's Law 25 you may also ask us to de-index information about you, and to explain the reasoning behind an automated decision.

Email hello@affiliatetrack.io. We respond within 30 days, and we do not charge for this. We will not treat you differently for exercising a right.

If you are unhappy with our response, you may complain to the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada, or — if you are in the EEA or the UK — your local supervisory authority.

13. Children

AffiliateTrack is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

14. Changes to this policy

We may update this policy. If a change materially affects how we use your personal information, we will notify account holders by email or in-product before it takes effect, and where the law requires consent, we will ask for it.

This policy was last updated on 14 July 2026.

Questions: hello@affiliatetrack.io, or StatsDrone Inc., 4035 Rue Saint-Ambroise, Suite 216, Montreal, Quebec, H4C 2E1, Canada.