Privacy Policy

This policy explains what personal data EP Affiliate ("we", "us") collects when you use the EP Affiliate platform (the "Service"), why, and your choices. We process personal data in line with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023.

1. Who this covers

• Customers: people who create an account and the team members they invite.

• Affiliates: people who sign up to a customer's affiliate portal.

• Visitors who click tracking links.

For data about affiliates and link visitors, the customer running the affiliate programme decides why it is collected; we process it on their behalf.

2. What we collect

• Account details: name, email, password (stored only as a secure hash), company, business type, country and phone number.

• Billing details: plan, payment status and invoices. Card and bank details are handled by our payment partners (Razorpay, Cashfree), not stored by us.

• Usage: log-ins, devices and IP addresses used to sign in, and actions taken in the dashboard (an activity log for security).

• Tracking data: for each click on a tracking link, the IP address, country, device, browser and the parameters in the link, plus conversions reported by advertisers.

• Messages you send us.

3. Why we use it

• To provide the Service: tracking, reports, payouts, the affiliate portal and the API.

• To keep it secure: preventing fraud and abuse, and protecting accounts.

• To bill you and send service emails (receipts, password resets, alerts and reports you set up).

• To improve the Service, using aggregated information.

• To meet legal obligations, such as tax records.

We do not sell personal data, and we do not use it for advertising.

4. Who we share it with

Only service providers who help us run the Service, under contracts that protect the data: hosting and storage (including Cloudflare), email delivery, and payment processing. We may disclose data if the law requires it. Customers can see the data of their own affiliates and link visitors.

5. How long we keep it

• Account data: while the account is open, then deleted within 30 days of closing it.

• Click-level data: as long as the customer's plan keeps it, then deleted or reduced to totals.

• Billing records: as long as tax law requires.

• Backups: up to 30 days.

6. Security

Data is encrypted in transit, passwords are hashed, sensitive keys are encrypted at rest, admin access needs two-factor authentication, and the database is backed up daily.

7. Cookies

We use only cookies needed for the Service: one to keep you logged in, and, on tracking links, a cookie that lets a conversion be matched to its click. No advertising cookies.

8. Your rights

You can access and correct your details on the Account page, and delete your workspace from its settings. You can also ask us to access, correct or erase your personal data, or withdraw consent, by writing to the support email on our website. Affiliates and link visitors should first contact the network that runs the programme.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

9. Children

The Service is for businesses and is not meant for anyone under 18.

10. Changes

We will post updates here with the new date and, for significant changes, email account owners.

11. Contact

Grievance officer and privacy questions: the support email on our website.