Data processing
Data processing terms
Last updated 30 October 2026
These terms form part of our terms of service. They apply when Affily processes personal data for you, the customer, while running Affily. You are the controller of that data and we are your processor, under the UK GDPR, the EU GDPR and other data protection laws that apply.
What we process
| Subject matter | Running Affily for you: redirecting your links, recording clicks, attributing conversions, calculating commissions and preparing payouts |
|---|---|
| Duration | While you use Affily, then until the data is deleted as described under "End of the service" |
| People the data is about | Visitors who click your links; your customers whose conversions you send us; your partners; your team |
| Personal data | Clicks: a one-way hash of the IP address (never the address), approximate location, device, browser, operating system and referring site. Conversions: the customer identifier you choose, event details and amounts. Partners: name, email, application answers, links, commissions and any payout details they give. Team: names and email addresses |
| Special category data | None. Don't send us any |
Our commitments
- We process the data only on your documented instructions, which are these terms and how you set up and use Affily. If we think an instruction breaks the law, we'll tell you.
- Everyone who can access the data is bound to keep it confidential.
- We protect it with the measures under Security, and keep them at least as strong.
- We help you answer requests from people exercising their rights (access, correction, deletion and so on), mostly through the dashboard and API, and pass on any request we receive directly.
- We help you with security, breach notifications, impact assessments and consultations with regulators, as far as our part of the processing allows.
- If we become aware of a personal data breach affecting your data, we tell you without undue delay, and within 48 hours, with what we know and what we're doing about it.
- We give you the information you need to show these terms are met, and answer reasonable audit questionnaires. On-site audits are by agreement, at your cost, no more than once a year unless a regulator requires it or there has been a breach.
Subprocessors
You allow us to use subprocessors for hosting, database and analytics infrastructure, email and payments, each only for its job and under written terms that protect the data at least as well as these. We stay responsible for them. We give you the current named list on request at hello@affily.io, and email account owners at least 14 days before adding or replacing one that handles your data. If you object on reasonable data protection grounds and we can't resolve it, you may close your account and we'll refund any prepaid fees for the unused period.
International transfers
Some subprocessors process data in the United States. Where data leaves the UK or EU we rely on an adequacy decision or on the standard contractual clauses (with the UK addendum), together with the measures in these terms.
Security
- Encryption in transit (TLS) for all traffic, and encryption at rest by our hosting providers.
- IP addresses in click data are stored only as a one-way hash.
- API keys and sign-in codes are stored as hashes; sign-in links expire within minutes.
- Each workspace's data is kept separate, and every request is checked against the workspace it belongs to.
- Access to production data is limited to the people who run the service.
- Changes to commissions and payouts are logged and can't be edited afterwards.
- Backups are kept for up to 30 days, then overwritten.
End of the service
When your account closes you have 30 days to export your data. After that we delete it, and backups are overwritten within a further 30 days, except where the law requires us to keep records (such as invoices).
General
The liability terms in our terms of service apply to these terms. If these terms conflict with the terms of service on data protection, these terms win. The law of England and Wales governs them.
Contact
Questions about data processing: hello@affily.io.