Privacy
Privacy policy
Last updated 25 October 2026
Affily is link infrastructure: branded short links, click analytics, conversion attribution and partner payouts. This policy covers the website at www.affily.io and the Affily product at app.affily.io, affily.link and our API. The dashboard is launching soon; until it opens, only the website section below applies.
The short version
- We collect what we need to run the service, and nothing for advertising.
- We never sell or share personal data, and never use it to build profiles.
- Click data is stored with a one-way hash of the IP address, never the address itself.
- The data your links collect belongs to you; we process it on your behalf.
Who is responsible
For your account, billing and the website, Affily is the controller: we decide how that data is used.
For the clicks and conversions your links and tracking script collect from your own visitors, you (the Affily customer) are the controller and Affily is your processor: we handle that data only to provide the service to you, under our data processing terms. If you are a visitor who clicked a short link, the business that shared it is your first point of contact; we will help them answer you.
The website
www.affily.io has no analytics, no advertising or tracking scripts, and sets no cookies. Fonts and images are served from our own domain. Our host, Cloudflare, receives your IP address and basic request details (such as the page and your browser's user agent) to deliver the page and protect the site, and may set a strictly necessary security cookie when it needs to block automated traffic.
What we collect in the product
Your account
Your name, email address and, if you sign in with Google or GitHub, the basic profile those services share (name, email, avatar). Your workspaces, team members and their roles, and the links, domains, programmes and settings you create. We keep a record of sign-ins and important actions (for example, who approved a payout) for security.
Clicks on short links
When someone opens one of your short links we record: the link, the time, the country and city derived from the IP address, device type, browser and operating system, the referring site, and whether the request looks like a bot. The IP address is turned into a salted one-way hash for counting unique visitors and fraud checks; the raw address is not stored.
Conversions
If you turn on conversion tracking, our script on your website stores a click identifier in a first-party cookie (afl_id) on your own domain, for 365 days by default (you can change this). Your server then tells us about sign-ups and sales, with an identifier you choose for the customer and, for sales, the amount and currency. You decide what you send; we ask that you send an internal ID rather than an email address. Where the law requires consent for this cookie, getting it is your responsibility, and the script can wait for your consent tool.
Partners in an affiliate programme
If you join a programme as a partner: your name, email, application answers, the links you share and the commissions you earn. Payouts go through Stripe Connect: Stripe collects and holds your bank details, identity checks and tax forms. Affily never sees your full bank details.
Billing
Plans are billed through Stripe. We store your plan, usage and invoice history; card details go straight to Stripe and never touch our servers.
Sign-in protection
The sign-in form uses Cloudflare Turnstile to tell people from bots. It checks your browser without tracking you across other sites.
How we use it
- To run the service: redirect links, show analytics, attribute conversions, calculate commissions, pay partners.
- To bill you and enforce plan limits.
- To keep the service secure: stop abuse, phishing links and fraud.
- To email you about your account: sign-in links, usage warnings, invoices, important changes. No marketing email without your agreement.
Under UK and EU law, our legal bases are: performing our contract with you; our legitimate interest in keeping the service secure and improving it; and legal obligations such as tax records.
Who processes it for us
We use a small number of providers, each only for the job listed:
| Provider | What for | Where |
|---|---|---|
| Cloudflare | Hosting, content delivery, short-link redirects, bot protection (Turnstile), email forwarding | Global network |
| Neon | Database for accounts, workspaces, links, conversions and the partner programme | United States |
| Tinybird | Click and conversion analytics | United States / EU |
| Stripe | Subscription billing and partner payouts (Stripe Connect) | United States |
| Resend | Sign-in links and product emails | United States |
| Google, GitHub | Sign-in, only if you choose “Continue with Google / GitHub” | United States |
Where data leaves the UK or EU, we rely on the providers' standard contractual clauses or equivalent safeguards. We will update this list before adding a new provider that handles personal data.
How long we keep it
| Account and workspace data | While your account is open, then deleted within 30 days of closing it |
|---|---|
| Raw click data | 30 days on Core, 1 year on Pro, 3 years on Business (5 years with the retention add-on); daily totals may be kept longer |
| Conversion events and commissions | While the workspace exists, so commission and payout history stays auditable |
| Invoices, payment and payout records | As long as tax and accounting law requires (typically 6–7 years) |
| Backups | Overwritten within 30 days |
| Emails you send us | As long as the conversation is useful |
You can export your data at any time, and delete links, workspaces or your whole account from the dashboard.
Security
All traffic is encrypted in transit and data is encrypted at rest by our providers. API keys are stored as hashes. Access to production data is limited to the people who run the service, and money-related changes are logged.
Your rights
You can ask to access, correct, export or delete your personal data, to restrict or object to how we use it, and to withdraw any consent you gave. Email hello@affily.io and we will respond within 30 days. You can also complain to your data protection authority (in the UK, the ICO). If you live in California, you have equivalent rights under the CCPA; we do not sell or share personal information.
Children
Affily is a business tool and is not meant for anyone under 16.
Changes
If we change this policy we will update the date at the top, and tell account holders by email before any change that affects them takes effect.
Contact
Questions about privacy: hello@affily.io.