Privacy Policy

Last updated: October 6, 2026

Note: This is a courtesy translation. In the event of any discrepancy between language versions, the French version shall prevail.

1. Introduction and Scope

This privacy policy describes how NETILUM SARL, the company behind the Affilae platform, collects, uses, retains, and protects personal data in the course of its activities.

This policy applies to the following websites and services:

https://affilae.com — marketing website
https://app.affilae.com — affiliate management platform
The Affilae mobile apps (App Store and Google Play) — mobile access to the platform

It concerns three categories of data subjects:

Visitors of the affilae.com website
Platform users (advertisers, publishers/affiliates, administrators)
End-users browsing advertiser websites that use Affilae tracking technology

Personal data is processed in compliance with the General Data Protection Regulation (GDPR — Regulation EU 2016/679), the French Data Protection Act (Loi Informatique et Libertés of January 6, 1978, as amended), and the ePrivacy Directive (2002/58/EC).

2. Data Controller

NETILUM SARL
9 Rue André Darbon, 33300 Bordeaux, France
SIREN: 750 845 208
SIRET: 750 845 208 00024
RCS Bordeaux

Data Protection Officer (DPO):
Email: dpo@affilae.com

For affiliate tracking on advertiser websites (see Section 3.3), NETILUM (Affilae) and the relevant advertiser act as joint controllers within the meaning of Article 26 GDPR.

3. Data Collected and Purposes

3.1 Marketing Website Visitors (affilae.com)

Data collected:

Browsing data: IP address, browser type, operating system, pages visited, visit duration, traffic source (via Google Analytics 4)
Form data: name, email address, company name, message (contact and demo request forms)

Purposes:

Website traffic statistical analysis
Responding to inquiries and demo requests
Commercial prospecting (with consent)
Improving the user experience

Consent management:
Cookie consent on affilae.com is managed by Complianz, a GDPR-compliant consent management platform (CMP).

3.2 Platform Users (app.affilae.com)

Data collected:

Identification data: first name, last name, email address, phone number
Professional data: company name, EU VAT number, postal address
Banking data: IBAN (for affiliate commission payments). Credit card data is processed exclusively by Stripe (PCI DSS certified); Affilae never stores full card numbers.
Usage data: connection logs, platform actions, settings preferences
Messaging data: content of the messages exchanged between advertisers and publishers, attached files (images, documents, voice messages), reactions, read status and conversation organisation
Notification data (mobile apps): the device's notification identifier, the preference for previewing messages in notifications

Purposes:

Service contract execution (account management, affiliate campaign tracking)
Billing and payment management
Commission calculation and payment
Transactional communications (emails via MailJet, SMS via Sinch)
Messaging between advertisers and publishers, and notifications of received messages (email, push notification)
Technical support and customer service
AI-assisted features: website KPI analysis and social network data to facilitate user onboarding and profile/program setup (for affiliates, see also section 3.4)
Fraud prevention and platform security

Mandatory nature of data:
Affilae only collects data strictly necessary for service delivery, in accordance with the data minimization principle (Art. 5(1)(c) GDPR). Identification and professional data are mandatory for account creation and management. Failure to provide this data prevents access to the service. Banking data (IBAN) is only required for affiliates wishing to receive their commissions.

Messaging

Messaging lets an advertiser and a publisher exchange messages and files in the context of an affiliate program. Messages and attached files are visible to the participants in the conversation — the users of the advertiser and of the publisher concerned — and each participant can see whether their messages have been read by the other party.

When a message is received, Affilae may inform the recipient by email and, in the mobile apps, by push notification. The email contains an excerpt of the message; so does the push notification, unless the recipient has turned off the preview in their preferences. Push notifications are delivered through Expo (see section 7.2), then through Apple's or Google's notification service depending on the device. No push notification is sent while the recipient is already viewing the conversation.

When an advertiser's account is deleted, its conversations are no longer accessible to either party. When an affiliate's account is deleted, the advertiser can still view past exchanges.

Match AI usage measurement and improvement

When you use Match AI, Affilae processes information about your use of this feature in order to measure its adoption, understand difficulties encountered in user journeys, improve the relevance of recommendations, and monitor the reliability of its technical and artificial-intelligence components.

The data processed may include pseudonymized identifiers of the user, account, program or affiliate profile, your role in the service, whether an authorized Affilae staff member operated your account on your behalf, the Match AI pages and steps viewed, the searches and filter categories used, the recommendations displayed or opened and their rank, the actions taken and their success or failure status, as well as duration and technical performance measurements.

Affilae does not send to its measurement tool the content of your messages, applications or forms, your prompts or AI-generated responses, or your emails, names or phone numbers. The first version of this measurement uses no session replay, no heatmap, and no PostHog analytics cookie in your browser.

This processing is based on Affilae's legitimate interest in understanding and improving its service, detecting friction points, and ensuring the quality of Match AI. Affilae limits the data to what is necessary, pseudonymizes the identifiers transmitted, and restricts access to authorized personnel.

The data is accessible to authorized Affilae teams and to PostHog, acting as a processor for usage measurement. The PostHog project used by Affilae is configured in the European region. Detailed data remains linkable to a user or an account for a maximum of 13 months. At the end of this period, the pseudonymization key for the period concerned is permanently destroyed: the corresponding data can no longer be linked to any user or account, whether by Affilae or by its processor, and Affilae only uses it in the form of aggregated statistics.

You may exercise your rights of access, rectification, erasure, restriction and objection to this processing by contacting dpo@affilae.com. Your objection does not affect access to the essential functions of the service, subject to processing strictly necessary for its security and operation.

3.3 End-Users on Advertiser Websites (Affiliate Tracking)

For affiliate conversion tracking, Affilae and the advertiser act as joint controllers (within the meaning of Article 26 GDPR) of the data of end-users visiting the advertiser's website. Affilae determines and operates the technical means of tracking (cookies, browser fingerprint, attribution algorithm, fraud detection); the advertiser determines the commercial purpose of the affiliate program and collects end-user consent on its website.

In accordance with Article 26(2) GDPR, the essence of the allocation of responsibilities is as follows:

The advertiser informs end-users (Articles 13 and 14 GDPR) and collects consent for the setting of tracking cookies via its consent banner;
Affilae designs and secures the technical tracking system (data protection by design, retention periods, anonymization);
End-users may exercise their rights against either party (see Section 10).

This allocation is formalized in the joint controllership agreement (DPA) entered into between Affilae and each advertiser.

Cookies set on advertiser websites:

Cookie	Purpose	Duration	Attributes
`_affilae{PID}`	Stores click identifiers for conversion attribution	90 days	Secure, SameSite=Lax, first-party
`AeFirst{PID}`	Timestamps the first visit via an affiliate link	90 days	Secure, SameSite=Lax, first-party

Local storage (LocalStorage) on advertiser websites:

Key	Purpose	Duration
`aeEvents{PID}`	Backup click ID storage (fallback if cookies are blocked)	90 days
`aeSessionTime{PID}`	Current session timestamp	30 minutes
`aeSessionStart{PID}`	Session start time	30 minutes

{PID} refers to the advertiser's unique affiliate program identifier.

Data collected during tracking:

IP address
User agent and browser language
Landing page URL and referrer URL
Click identifiers and conversion data (transaction ID, amount, currency, voucher code)
Country inferred from the IP address using an IP geolocation service

Browser fingerprint:

Affilae generates a statistical browser fingerprint from general technical characteristics (such as browser type, screen resolution, or timezone). This fingerprint is a statistical identifier that cannot, on its own, identify an individual. It is used exclusively for conversion attribution and fraud detection purposes.

Data transmission:
All transmissions are made exclusively over HTTPS to lb.affilae.com, via XMLHttpRequest, image pixels, iframes, or the Beacon API.

Consent:
In accordance with the allocation of responsibilities set out in the joint controllership agreement, collecting consent for affiliate tracking cookies rests with the advertiser, who implements a compliant consent banner on their own website.

3.4 Affiliates: Match AI (partner recommendation)

Match AI recommends relevant affiliates to advertisers for their programs and, conversely, programs to affiliates. To do so, Affilae analyzes the channels (social networks, websites) that the affiliate declares in their profile.

Data sources: in addition to the information entered by the affiliate, Affilae collects publicly available data on the accounts and websites they have declared, from public-data collection providers (see section 7). When the affiliate voluntarily connects their Instagram or TikTok account, Affilae receives from these platforms the information authorized at connection (including identifier, username, picture, biography, follower count and, for Instagram, recent posts and their statistics).

Data collected: account name and identifier, biography, profile picture, number of followers, followings and posts, recent posts (text, hashtags, images, number of likes, comments and views), video transcripts, website home page, estimated website traffic.

Data inferred by artificial intelligence: from this data, an artificial intelligence model produces a description of the profile, its editorial positioning, its audience profile (age ranges, interests), content formats, main country, an engagement rate and the presumed gender of the person behind the account, inferred from their profile information. The affiliate can edit this information from their profile.

Purposes: quality and authenticity checks of profiles before they become visible, recommendation of affiliates to advertisers and of programs to affiliates, explanation of recommendations, monitoring of audience trends.

Recipients: advertisers using Match AI see, among other things, the profile name, its description, its audience, its public links, its follower count, its engagement rate, its presumed gender, its traffic and the 12-month history of these indicators. Match AI does not share the affiliate's personal contact details (email, phone, address) with them.

No automated decision-making: the scores and rankings produced by Match AI are recommendations. No decision producing legal effects or similarly significantly affecting the affiliate is based solely on them: the advertiser remains free to offer a partnership or not, and the affiliate to accept it (Art. 22 GDPR).

Legal basis and objection: this processing is based on the legitimate interest of Affilae and its advertisers in connecting the platform's advertisers and affiliates (Art. 6(1)(f) GDPR). The affiliate may at any time object to their profiles appearing in Match AI by writing to dpo@affilae.com; their profiles are then removed from recommendations.

4. Cookies and Tracking Technologies

4.1 Cookies on affilae.com

Cookie	Provider	Purpose	Duration	Type
`_ga`	Google Analytics 4	User distinction	14 months	Analytics
`_ga_*`	Google Analytics 4	Session state maintenance	14 months	Analytics
Complianz cookies	Complianz	Consent preferences storage	12 months	Functional

4.2 Cookies on Advertiser Websites

See details in Section 3.3 above.

On affilae.com: You can manage your cookie preferences at any time via the Complianz consent banner or your browser settings.

On advertiser websites: Consent management is the responsibility of the relevant advertiser. You can also configure your browser to refuse or delete cookies.

5. Legal Bases for Processing

Processing Activity	Legal Basis	GDPR Article
Analytics cookies (affilae.com)	Consent	Art. 6(1)(a)
Tracking cookies on advertiser sites	Consent (managed by the advertiser)	Art. 6(1)(a)
User account management	Contract performance	Art. 6(1)(b)
Billing and payments	Contract performance + Legal obligation	Art. 6(1)(b) + (c)
Transactional communications	Contract performance	Art. 6(1)(b)
Messaging and notifications of received messages	Contract performance	Art. 6(1)(b)
Commercial prospecting	Consent	Art. 6(1)(a)
Security and fraud prevention	Legitimate interest (protecting the platform and users from fraudulent activities)	Art. 6(1)(f)
Tax record retention	Legal obligation	Art. 6(1)(c)
AI-assisted onboarding and setup features	Contract performance	Art. 6(1)(b)
Match AI: analysis of affiliate profiles and recommendation to advertisers	Legitimate interest (connecting the platform's advertisers and affiliates), with right to object	Art. 6(1)(f)
Match AI usage measurement	Legitimate interest (understanding and improving the feature, detecting friction points, ensuring the reliability of its AI components)	Art. 6(1)(f)

6. Data Retention Periods

Data Type	Retention Period	Justification
Tracking data (clicks, conversions)	25 months, then anonymized	DPA / internal policy
Account data (active users)	Duration of contract	Contractual necessity
Account data (inactive publishers)	6 months of inactivity + 30-day notice before deletion	Internal policy
Account data (inactive advertisers)	6 years after termination	Internal policy
Messages and attached files	For as long as the participants' accounts exist, then processed under the procedure applicable to inactive accounts; deleted on request to dpo@affilae.com	Contractual necessity
Device notification identifier	Until logout from the app or deletion of the account	Contractual necessity
Billing data	10 years	French Commercial Code
Analytics data (GA4)	14 months	GA4 configuration
Tracking cookies	90 days	Compliant with CNIL recommendation (≤ 13 months)
Match AI affiliate profile data (public data collected, data received from Instagram or TikTok, inferred information)	While the affiliate uses the platform; removed from Match AI on account or profile closure, or upon objection; deleted on request to dpo@affilae.com	Legitimate interest / affiliate authorization
Raw responses from the public social network data collection provider (ScrapeCreators)	31 days maximum at the provider	Data processing agreement
AI-generated recommendation explanations	7 days	Technical necessity
Match AI usage data (pseudonymized, PostHog)	13 months, then destruction of the pseudonymization key (data permanently unlinkable, aggregated use only)	CNIL audience-measurement benchmark

Anonymization Process

When tracking data reaches the end of its retention period, the data that could identify a person (IP addresses, visited URLs and referrers, user agents, transaction and customer identifiers) is anonymized so that it can no longer be linked to a person. Only generic information, such as the originating domain or the device type, is kept.

7. Subprocessors and Third-Party Services

7.1 EU-Based Subprocessors

Subprocessor	Service	Location
Google Cloud Platform (GCP)	Hosting, compute, storage	Belgium, France
Amazon Web Services (AWS S3)	File storage	Ireland
MongoDB Cloud Manager	Database management	EU
OVH	DNS, hosting	France
MailJet	Transactional emails	France
VATLayer	VAT number validation	EU
Sinch	SMS communications	Sweden
MongoDB Atlas	Hosted database	EU
PostHog (Cloud EU)	Product usage measurement	Germany (Frankfurt)
Pennylane	Accounting (customers, suppliers, invoices)	Ireland
Trustfull	Signup fraud prevention (email and phone verification)	EU

7.2 Non-EU Subprocessors

Subprocessor	Service	Location	Transfer Mechanism
Stripe	Payment processing	United States	Standard Contractual Clauses (SCCs)
Sentry	Error monitoring	United States	SCCs
ipdata.co	IP geolocation	United States	SCCs
Abstract API	IBAN and VAT validation	United States	SCCs
OpenAI	AI processing	United States	SCCs
Anthropic	AI processing	United States	SCCs
Google Workspace	Internal communications	United States	SCCs
Google Analytics 4	Web analytics	United States	SCCs
ClickUp	Project management	United States	SCCs
HubSpot	CRM and marketing	United States	SCCs
Cerebras	AI processing (analysis of profiles and websites, including images; Match AI explanations)	United States	SCCs
ScrapeCreators (Web Scraping Guy LLC)	Collection of public social network data (Match AI)	United States	SCCs
MongoDB, Inc. (Voyage AI)	Vector embeddings and ranking of recommendations (Match AI)	United States	SCCs
Freshworks (Freshdesk)	Customer support (tickets)	United States	EU-US Data Privacy Framework, SCCs
Expo (650 Industries)	Mobile notifications	United States	EU-US Data Privacy Framework, SCCs
Tax ID Pro (Balancer Services LLC)	Tax identification number verification	United States	SCCs
SimilarWeb	Web traffic analysis	Israel	EU adequacy decision
BrightData	Data services (collection of web pages and public social network data)	Israel	EU adequacy decision

7.3 Recipients acting as controllers

These providers receive personal data for the purposes of the service but process it on their own behalf, as controllers (or joint controllers) under their own obligations. Their privacy policies apply.

Recipient	Service	Location	Transfer Mechanism
Wise Europe SA	Payment of commissions to affiliates	Belgium; processing outside the EU possible	EU adequacy decision, SCCs
Universign (Cryptolog International)	Electronic signature of contracts	EU	SCCs (verification codes sent by SMS)
Google Maps Platform (Google Ireland Limited)	Postal address verification	Ireland; processing in the United States possible	EU-US Data Privacy Framework, SCCs

Meta (Instagram) and TikTok are not Affilae subprocessors: they are data sources, used when the affiliate connects their account (see section 3.4).

8. International Data Transfers

Affilae's primary infrastructure is hosted within the European Union:

Google Cloud Platform: data centers in Belgium and France
OVH: data centers in France
Amazon Web Services: data center in Ireland

For subprocessors and recipients located in the United States, data transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission and, for certified companies, by the EU-US Data Privacy Framework (adequacy decision of 10 July 2023), in compliance with post-Schrems II requirements. Supplementary measures are implemented where necessary (encryption, pseudonymization).

For Israel, transfers are covered by the European Commission's adequacy decision (Decision 2011/61/EU).

9. Data Security

Affilae implements technical and organizational measures appropriate to the risks to protect personal data against loss, unauthorized access, disclosure or alteration, including:

Encryption: of communications (TLS) and of stored data
Access control: access to data restricted to authorized staff
Authentication: multi-factor authentication (MFA) available on the platform; passwords are never stored in plain text
Backups: regular automated backups
Monitoring: detection of errors and anomalies
Awareness: staff are made aware of their data protection obligations

For security reasons, the details of these measures are not published. They can be shared with our customers under the data processing agreement (DPA).

10. Data Subject Rights

Under the GDPR, you have the following rights:

Right	Description	GDPR Article
Access	Obtain confirmation and a copy of your personal data	Art. 15
Rectification	Correct inaccurate or incomplete data	Art. 16
Erasure	Request deletion of your data	Art. 17
Restriction	Restrict the processing of your data	Art. 18
Portability	Receive your data in a structured, machine-readable format	Art. 20
Objection	Object to the processing of your data	Art. 21
Withdrawal of consent	Withdraw your consent at any time	Art. 7(3)

How to Exercise Your Rights

Send your request by email to dpo@affilae.com, including proof of identity. We commit to responding within one month. This period may be extended by two months for complex requests or a high volume of requests, in which case you will be informed.

Match AI

The affiliate can correct at any time, from their profile, the information inferred by artificial intelligence, including their presumed gender. They may object to their profiles appearing in Match AI by writing to dpo@affilae.com.

Special Case: End-Users Tracked on Advertiser Websites

For data collected through affiliate tracking on advertiser websites, Affilae and the advertiser act as joint controllers. In accordance with Article 26(3) GDPR, you may exercise your rights against either of them: directly with Affilae (dpo@affilae.com) or with the relevant advertiser. Both parties cooperate to handle your request, in accordance with the joint controllership agreement between them.

Complaint to the Supervisory Authority

You have the right to lodge a complaint with the French Data Protection Authority (CNIL):

Website: www.cnil.fr
Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

11. Children's Privacy

Affilae's services are not intended for persons under the age of 16. We do not knowingly collect personal data from minors. If we discover that a minor has provided us with personal data, we will take the necessary steps to delete it promptly.

12. Changes to This Policy

Affilae reserves the right to modify this privacy policy at any time.

The date of the last update is indicated at the top of this document. Continued use of our services after modification constitutes acceptance of the revised policy.