Legal

Privacy policy

Last updated: 2026-05-16

Plain-English summary

We collect the minimum information needed to run an affiliate network: account details (your name + email), traffic data (clicks, conversions, sub_id), and payout info (your chosen payment method). We don't sell personal data. We retain audit-relevant records for as long as required by law, and delete on request otherwise.

1. Information we collect

• Account information — name, email, company, country, password hash.
• Traffic data — clicks, IP, user-agent, referrer, device type, the campaign clicked, sub_id you set.
• Conversion data — what an end-user did on the advertiser's site, transaction amount, attributed affiliate.
• Payout data — payment method (Stripe / PayPal / USDC wallet), payout history, tax form metadata where required.
• Security data — login attempts, 2FA enrolment, IP reputation signals.

2. How we use it

To run the network: track clicks, attribute conversions, pay affiliates, review fraud, comply with US tax obligations (W-9, 1099 reporting via Stripe), and respond to lawful requests.

3. Who we share it with

• Advertisers get aggregated performance data tied to your affiliate-id when you promote their campaigns. No PII unless required (e.g. for fraud disputes).
• Payment processors (Stripe, PayPal) for payout disbursement only.
• Email provider for transactional mail.
• Tax authorities when US law requires it (W-9 / 1099 reporting).

We do not sell personal data. We do not share data with ad networks for re-targeting on other sites.

4. Cookies

We use first-party cookies for session management and CSRF protection. We use first-party tracking cookies to attribute clicks to affiliates. We don't run third-party advertising cookies.

5. Your rights (US residents)

You can request a copy of your data, request deletion, or opt out of any non-essential processing by emailing privacy@merkletreeaffiliates.com. California residents have additional rights under CCPA — same email.

6. Retention

Account + payout records: 7 years after account closure (US tax retention). Click + conversion data: 24 months rolling. Audit logs: 36 months.

7. Security

Passwords are bcrypt-hashed. All connections are TLS. 2FA available for every account. Risk-scoring engine flags suspicious activity in real time.

8. Changes

We'll post the new version here and update the date at the top. Material changes will be announced via email.

9. Contact

Privacy questions → privacy@merkletreeaffiliates.com

Anything else → help center