Affiliate Program Privacy Policy

Last updated: 13 August 2026 · affiliates.dropcommerce.com

1. About this policy

This policy explains what personal information the DropCommerce Affiliate Program collects, why we collect it, who we share it with, and what you can do about it.

It covers the affiliate platform at affiliates.dropcommerce.com only. This is a separate system from the main DropCommerce app, with its own database. The platform is operated by DropCommerce Inc., of 7-2070 Harvey Ave. Unit 229, Kelowna, BC V1Y8P8. We are the controller of the information described here.

Who this policy is about

There are two groups of people whose information we handle, and they are handled quite differently:

• Affiliates — people who apply for and hold an affiliate account.
• People who click a referral link — visitors who click an affiliate’s link on their way to our Shopify App Store listing. We hold very little about these people, and in most cases nothing that identifies them. Section 4 explains exactly what.

We also hold information about referred merchants — the businesses that subscribe to DropCommerce. That is mostly business information rather than personal information, but we describe it in section 6 so the picture is complete.

2. What we deliberately do not do

It is easier to understand this policy if we start with what is absent from it.

We do not run advertising on this platform. We do not build profiles, we do not track anyone across other websites, and we do not sell or rent personal information to anyone. The cookies described in section 5 exist for one purpose: working out which affiliate should be credited for a referral.

We have also designed several parts of the system to hold less than we could:

• We do not store the IP addresses of people who click referral links. We store a salted SHA-256 hash of the address instead. The hash lets us spot duplicate and fraudulent clicks without keeping the address itself.
• We never receive affiliates’ bank account or tax details. Where an affiliate is paid through Stripe Connect, they give those details to Stripe directly. We hold only the Stripe account identifier.
• We do not store the contents of emails we send. We log that an email was sent, to which address, and whether it arrived.
• We do not store passwords, session tokens or two-factor recovery codes in a readable form. Only hashes are stored, so they cannot be read back out of the database — by us or by anyone else.

3. Information we collect from affiliates

When you apply for and use an affiliate account, we collect:

3.1 Account and identity

• Your name
• Your email address
• Your company name, if you choose to give one — this is optional
• Your password, stored only as a scrypt hash. We cannot see or recover your password.
• The date and time you accepted the Affiliate Program Terms, so we both have a record of what you agreed to and when

3.2 Payout information

• Which payout method you chose
• If you chose PayPal: the PayPal email address you want to be paid at
• If you chose Stripe Connect: your Stripe Connect account identifier

Stripe collects your bank details and tax information directly from you during their onboarding process. That information goes to Stripe, not to us. We never receive it, see it or store it, and we cannot retrieve it from Stripe.

3.3 Two-factor authentication, if you enable it

• A TOTP secret, stored encrypted with AES-256-GCM
• Recovery codes, stored only as SHA-256 hashes

This is optional. If you do not enable two-factor authentication, none of this is collected.

3.4 Security and activity records

• Login session records
• An audit log of actions taken on your account

These exist so that you and we can see what happened on an account — which matters when money is involved, and when an account is disputed or compromised.

4. Information we collect when someone clicks a referral link

When someone clicks an affiliate’s tracked referral link, we record the click, set the cookies described in section 5, and redirect them to our Shopify App Store listing. The click record contains:

• A salted SHA-256 hash of the IP address. We do not store the raw IP address at any point.
• The browser user-agent string — the text a browser sends identifying itself and the operating system.
• The landing URL and the date and time of the click.
• An opaque random token identifying that click, which is what allows a later install to be matched to the right affiliate.

There is no name, no email address, no account and no login involved. In almost all cases we have no way of working out who an individual click belongs to, and we do not try to.

If someone shares a direct App Store link tagged with an affiliate’s referral code rather than the tracked link, no click record is created at all.

Depending on where you are, a hashed IP address and a user-agent string may still count as personal information even though we cannot readily identify anyone from them. We have written this policy on the basis that they do.

5. Cookies

We set two cookies when someone clicks a tracked referral link. Both last 90 days, matching the attribution window in our Affiliate Program Terms. Both exist solely to work out which affiliate should be credited for a referral.

We do not set advertising cookies, analytics cookies or any cookie that follows a visitor to other websites.

You can delete or block these cookies through your browser settings. Blocking them does not stop you installing or using DropCommerce; it means the affiliate who referred you may not be credited.

6. Information about referred merchants

So that we can calculate commission correctly, we hold the following about merchants who subscribe to DropCommerce through an affiliate referral:

• Store domain
• Subscription plan and status
• Install and uninstall dates
• Subscription charge amounts, obtained from the Shopify Partner API

This is business information about a store rather than information about an individual, and we treat it that way. It can overlap with personal information — for a sole trader, a store domain may be their own name — so we handle it with the same care as everything else described here.

Affiliates see a limited view of this in their dashboard: enough to understand what they have earned and why. Under the Affiliate Program Terms, affiliates may not use information about referred merchants for anything other than participating in the Program.

7. Email

We send transactional email — account and application notices, payout confirmations, password resets, and notices about changes to the Program.

For each message we log the recipient address, which message was sent, when, and whether delivery succeeded. We do not store the message bodies. We keep these logs so we can tell whether an affiliate was actually notified about something, which matters for payouts and for changes to the Terms.

We do not send marketing email to affiliates from this platform.

8. Why we use this information, and our legal basis

We have set out below every purpose for which we use personal information, what we use for each, and the legal basis we rely on. We apply the same standard to every affiliate, wherever you live. Rather than giving different people different treatment depending on which privacy law reaches them, we have written this policy — and the rights in section 13 — to the highest standard that applies to any of our affiliates, and we extend it to all of them. Where we say we rely on legitimate interests, that means we have judged our reason for using the information against the effect on the person it concerns. We think our interest is not outweighed, largely because of how little we hold. If you disagree, you can object — section 13 explains how.

Where we rely on legitimate interests, we have considered whether our interest is outweighed by the effect on the individual. We think it is not, largely because of how little we hold — but you can object, and section 13 explains how.

8.1 Automated decisions

Affiliate applications are reviewed by a person, not decided automatically.

Our system does flag suspected self-referrals and suspicious click patterns automatically, but a flag is not a decision. A person reviews what has been flagged before any action is taken on an account or a commission balance.

9. Who we share information with

We share information with the following service providers, and only so they can perform the function described. They act on our instructions and are not permitted to use the information for their own purposes.

Beyond those providers, we will disclose information only:

• where we are required to by law, by a court, or by a regulator;
• where it is necessary to establish, exercise or defend a legal claim; or
• to a buyer or successor if our business or the Program is sold or reorganised, in which case we will tell affiliates before their information is transferred.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

10. Where information is held, and international transfers

Our application and database are hosted on Heroku infrastructure in the United States. This means that affiliate account information, click records, commission and payout records are stored in the United States, wherever in the world you live. Our other providers are also established in the United States. SendGrid, Stripe, PayPal and Shopify may each process information in the United States and in other countries where they or their own subprocessors operate.

The United States does not have a single national privacy law equivalent to those in the EU, the UK or Canada, and its authorities have powers of access to information held there that may be broader than those where you live. We think it is more useful to say that plainly than to reassure you in general terms.

Two things reduce what is actually exposed by this, and both are design decisions rather than promises:

• We do not hold raw IP addresses. Click records contain a salted hash, so the underlying addresses are not present in the US-hosted database at all — see section 4.
• We do not hold affiliates’ bank account or tax details. Those sit with Stripe under its own arrangements, and we never receive them — see section 3.2.

If you would like more detail about how a particular provider handles information, each publishes its own privacy documentation, and we are happy to point you to the relevant one.

11. How long we keep information

We keep information only for as long as we have a reason to, and the reasons differ a lot between the categories below.

• Click records — 12 months. Click records are the highest-volume and least identifying thing we hold. We keep them for 12 months from the click, which is comfortably longer than the 90-day attribution window, so that a dispute about who should have been credited for a referral can still be investigated. After 12 months they are deleted.
• Cookies — 90 days. Both cookies described in section 5 expire 90 days after they are set. You can delete them sooner through your browser.
• Affiliate accounts — 24 months after closure. If your account is closed, we keep your account record for 24 months and then delete it. We keep it for that period because commission reversals, chargebacks, tax queries and disputes about a final payout can all surface well after an account closes, and because we may need to show what a former affiliate agreed to and when. If you ask us to delete your account sooner, we will, apart from anything covered by the next paragraph.
• Financial and tax records — 6 years. Records of commission earned, payouts made and tax documentation are kept for the period the law requires, which is longer than the periods above and is not something we can shorten at request. When we keep a financial record after deleting an account, we keep only that record — the amounts, dates and the identifiers needed to make sense of them — and not the rest of the account.
• Security and audit records. Login session records and the account audit log are kept for as long as the account record they relate to. The administrative audit log described in section 12 is append-only, so entries in it are not deleted; where it references an account we have deleted, the entry retains the action and its timestamp but not the personal details.
• Email delivery logs — 12 months. We keep the record that a message was sent, to which address, and whether it arrived, for 12 months. We never store message bodies.

When a retention period ends, records are deleted or irreversibly anonymised.

12. How we protect information

These are the specific measures in place, rather than a general statement of intent:

• Passwords are hashed using scrypt. They are never stored in a readable form and cannot be recovered.
• Two-factor secrets and API credentials are encrypted at rest using AES-256-GCM.
• Session tokens and two-factor recovery codes are stored only as SHA-256 hashes.
• IP addresses of people clicking referral links are stored only as salted SHA-256 hashes. The raw address is never written to the database.
• All traffic to and from the platform is encrypted in transit over HTTPS.
• Two-factor authentication is available on every affiliate account. We recommend enabling it — your account controls where money is sent.
• Administrative actions are recorded in an append-only audit log, so that changes made by our staff — including corrections to referral attribution — can be reviewed after the fact.

No system is completely secure, and we cannot guarantee that information will never be accessed without authorisation. What we can say is that the design deliberately avoids holding the things that would be most damaging if it were: raw IP addresses, readable passwords, and affiliates’ bank details.

13. Your rights

You have rights over the information we hold about you. Which of them are legal entitlements depends on where you live, but we do not think that is a useful thing for you to have to work out. We offer the rights below to every affiliate, wherever you are. Where the law gives you something more than this, the law wins.

13.1 Rights that may apply to you

• Access — ask for a copy of the information we hold about you.
• Correction — ask us to fix information that is wrong or incomplete. You can change most of your own details in the dashboard.
• Deletion — ask us to delete your information, subject to records we must keep for financial, tax or legal reasons.
• Restriction — ask us to pause how we use your information while a dispute or objection is being resolved.
• Portability — ask for the information you gave us in a machine-readable format.
• Objection — object to processing we carry out on the basis of legitimate interests, including fraud detection. We will stop unless we have compelling grounds to continue.
• Complaint — complain to your data protection authority. We would rather you came to us first, but you do not have to.

Where the CCPA or CPRA applies, you also have the right to know what we collect, to delete it, to correct it, to opt out of sale or sharing, and not to be treated differently for exercising those rights. As set out in section 9, we do not sell or share personal information, so there is nothing to opt out of.

13.2 How to exercise them

Email partners@dropcommerce.com from the address on your affiliate account, or contact us from within your dashboard. We will respond within the time the applicable law allows, and we may need to verify who you are before acting — usually by confirming control of the account email address.

13.3 If you clicked a referral link and want your click record removed

This is the one case where we may genuinely be unable to help, and we would rather explain why than pretend otherwise.

Click records contain a hashed IP address, a user-agent string and an opaque token. There is no name and no account attached. We cannot search for “your” clicks, because we have nothing to search by, and we are not required to collect additional information about you purely in order to identify you.

If you still have the dc_aff cookie in your browser, its value identifies your click record directly, and you can send it to us and we can act on it. Otherwise, deleting the two cookies in your browser removes the link between you and any future attribution, which achieves the practical outcome in most cases.

14. Children

The affiliate platform is for people old enough to enter into a binding contract where they live, and it is not directed at children. We do not knowingly collect information from children. If you believe a child has created an affiliate account, contact us and we will remove it.

15. Who to contact about privacy

Privacy questions and requests are handled directly by our team, at the address in section 17. We have not appointed a Data Protection Officer, because the nature and scale of what we do does not require one — we do not monitor people systematically, we do not profile anyone, and we do not handle sensitive categories of information.

That is not a reason to expect a slower answer. Requests go to a person who can act on them, and the response times in section 13.2 apply.

16. Changes to this policy

We may update this policy — for example if we add a payout method, change hosting provider, or if the law changes.

When we make a material change, we will email affiliates at the address on their account and post the updated policy at affiliates.dropcommerce.com with a “last updated” date. Minor corrections take effect when posted.

We will not start using information we already hold for a materially different purpose without telling affiliates first and, where the law requires it, asking for consent.

17. Contact us

Questions about this policy, or about information we hold:

• Email: partners@dropcommerce.com
• Post: DropCommerce Inc., 7-2070 Harvey Ave. Unit 229, Kelowna, BC V1Y8P8
• Through your dashboard at affiliates.dropcommerce.com