Privacy Policy
It describes how Upstero actually operates, but the entity details marked
[…] below still need filling in, and it has not been reviewed by a
lawyer. Have counsel review it before you rely on it commercially or submit it
to a network or payment processor.
1. Who is responsible
[LEGAL ENTITY NAME], [REGISTERED ADDRESS], [JURISDICTION], is the controller for the data described here. Contact: [email protected].
2. Account data
For affiliates and vendors we hold: name, email address, the traffic channel you describe at signup, your payout method and payout account identifier, and your account status.
Passwords are stored only as a salted scrypt hash. We cannot read your password and cannot recover it for you.
3. Click and conversion data
When someone clicks an affiliate link we record: the offer and affiliate involved, the date, your SubID if you set one, the device type, operating system and browser derived from the user-agent string, the country supplied by our CDN, the traffic source derived from the referrer or utm tag, and whether the visit reached checkout.
We do not store visitors' IP addresses. We store a keyed hash of the IP instead. That is enough to group clicks by origin for duplicate and fraud detection, but it cannot be turned back into an address.
For sales we record the order value, the commission, the order reference and the status. Affiliates are not shown customer names, addresses or contact details for internal offers, because Upstero is the merchant of record for those sales.
4. Why we process it, and on what basis
- To run the service — attributing sales, calculating commission and paying you. Necessary for the performance of our contract with you.
- To prevent fraud — detecting automated traffic and duplicate or implausible conversions. Our legitimate interest, and that of the advertisers we work with.
- To meet legal obligations — financial records and tax reporting.
5. Cookies
We set two cookies. A session cookie keeps you signed in to the dashboard; it is HttpOnly and signed. An attribution cookie records which affiliate referred a visit, for up to 30 days.
We do not use advertising or cross-site tracking cookies on our own site.
6. Who we share it with
Payment providers, in order to pay you. Email delivery providers, for transactional email. Our hosting and CDN providers, who process traffic on our behalf.
Where you promote a network offer, the external processor for that offer receives our tracking identifier so the sale can be attributed back. We do not sell personal data.
If you configure a postback pixel, we will call the URL you supply with the parameters you choose. What that third party then does with it is outside our control and governed by their policy, not ours.
7. Retention
Click records are kept for as long as they are needed for attribution and fraud analysis. Financial records — conversions, commissions and payouts — are kept for as long as required for accounting and tax purposes.
Closing your account does not delete financial records we are required to keep.
8. Your rights
Depending on where you live you may have the right to access, correct, export or delete your personal data, and to object to processing based on legitimate interest.
To exercise any of these, email [email protected]. We will respond within the period required by applicable law.