1. What we collect
Account data: name, email, organization details. Billing data: payment method (managed by Stripe; we do not see card numbers). Affiliate program data: affiliate names, emails, payout history. Tracking data: clicks, conversions, IPs (hashed for fraud detection). Imported data: when a Brand migrates from another affiliate platform, the historical affiliate, conversion, commission, and customer-attribution records they upload (which can include customer emails and Stripe customer/subscription identifiers). Usage data: which features you use, error reports.
2. How we use it
To provide the Service. To send transactional email (account, payouts, billing). To improve the product (aggregate analytics only). To detect fraud and abuse. To comply with legal obligations. We do not sell your data. We do not use your data to train AI models without your explicit consent.
3. Sub-processors and international transfers
We share personal data with vetted sub-processors that help us run the platform, including Stripe (billing and payouts), Paddle and Braintree (conversion tracking for brands who connect those accounts), Lemon Squeezy (conversion tracking for brands who connect their stores), Chargebee (conversion tracking for brands who connect their Chargebee sites), Polar (conversion tracking for brands who connect their Polar organizations), Recurly (conversion tracking for brands who connect their Recurly sites), Gumroad (conversion tracking for brands who connect their Gumroad seller accounts), Creem (conversion tracking for brands who connect their Creem stores), Dodo Payments (conversion tracking for brands who connect their Dodo Payments accounts), Shopify (conversion tracking and, for merchants who install our Shopify app, billing of their Rekomi subscription and commission fee; rolling out), Wix (conversion tracking and, for brands who install our app from the Wix App Market, billing of their Rekomi subscription through Wix), PayPal (affiliate payouts in some regions), Clerk (authentication), Cloudflare (DNS, CDN, and edge), Resend (email), DigitalOcean (hosting and private file storage), our managed PostgreSQL and Redis providers, Sentry (error monitoring), and, on an opt-in basis, PostHog and Google Analytics (analytics), Intercom (support chat), and Anthropic (AI). The full, dated list is at /legal/subprocessors.
Our default processing region is the United States. Where we transfer personal data out of the EEA or UK, we rely on Standard Contractual Clauses and the UK International Data Transfer Addendum, as described in our DPA.
Shopify Protected Customer Data.When a merchant installs our Shopify app, we receive order and customer data from their store through Shopify’s Admin API and webhooks. We process the minimum we need to attribute affiliate sales, calculate commissions, bill the merchant, and report program performance. We do not sell this data, we limit its use to those purposes, we encrypt it in transit and at rest, and we honor Shopify’s mandatory data-subject requests (customer data-request, customer redaction, and shop redaction) by returning or deleting the data we hold, in line with Shopify’s Protected Customer Data requirements.
4. Connected social accounts
Creators can link social accounts (YouTube, Instagram, Facebook, TikTok, X, Twitch, Pinterest, Threads, Discord, Bluesky, LinkedIn) to their Rekomi profile to prove they own them and to show verified audience stats. Linking uses each platform’s official sign-in (OAuth); Rekomi never sees your password. The access credentials each platform issues are stored encrypted and used only to read your public profile identity (name, handle, avatar) and audience statistics (for example, follower or subscriber counts and aggregate view metrics), refreshed about once a day. Disconnecting a platform in your dashboard immediately deletes our stored credentials and, where the platform supports it, revokes them at the platform too; removing the connection also deletes the stored stats history. We never post on your behalf, and we do not use social account data to train AI or machine-learning models.
Google user data (YouTube). If you connect a YouTube channel, Rekomi uses YouTube API Services. With your consent, we access (via read-only scopes) your channel’s identity (channel id, title, thumbnail) and its statistics (subscriber count, video count, and aggregate 28-day view metrics). We use this data for exactly one purpose: verifying that you own the channel and displaying those stats on your Rekomi creator profile. These stats are informational only. Rekomi never pays, rewards, or otherwise compensates anyone for viewing, liking, commenting on, sharing, or subscribing to YouTube content, and no payout on Rekomi is based on YouTube views or engagement; commissions are earned only for referred sales and sign-ups completed on a brand’s own website. We do not sell it, do not use it for advertising, do not use it to train AI or machine-learning models, and do not share it with anyone except the infrastructure sub-processors that host Rekomi (section 3), which process it only on our instructions. It is encrypted in transit and at rest. We keep only recent stat snapshots; disconnecting YouTube immediately deletes our Google credentials and revokes Rekomi’s access at Google, and removing the connection deletes the stored stats as well. You can also revoke Rekomi’s access at any time in your Google security settings. Rekomi’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting YouTube you also agree to the YouTube Terms of Service; Google’s own handling of your data is described in the Google Privacy Policy.
5. Cookies
We use first-party cookies for authentication and consent tracking. We use first-party tracking cookies on customer domains only when their affiliate program activates Rekomi tracking. Full cookie policy at /legal/cookies.
6. Data retention
Account and program data: kept while the account is active, plus 30 days after cancellation for export, then purged. Tracking data: kept for the lifetime of the account; aggregated indefinitely. Audit logs: retained per our standard 7-year SaaS schedule for compliance. Shopify protected customer data: kept only as long as needed to provide the service, deleted or anonymized within 30 days of an account closing or a shop-redaction request, and removed on a customer-redaction request as required by Shopify.
7. Data subject rights (GDPR + CCPA)
You can request access, correction, deletion, or portability of your personal data at support@rekomi.com. We respond within 30 days. California residents can also opt out of data sale (we do not sell data).
8. Security
Multi-tenant RLS, encryption at rest and in transit, signed webhooks. Full security model at /security.
9. Children
Rekomi is not directed at children under 16. We do not knowingly collect data from children.
10. Changes
We notify customers of material changes via email at least 30 days in advance. Continued use after a change constitutes acceptance.
We keep this policy current as the product evolves. Questions about your data: support@rekomi.com.