Privacy Policy

Information you give us directly: name and email when you submit the contact form or request access to the Service; company name, timezone, branding, and similar settings once you have an Account.

Information collected through ad serving: when a link served through a tenant's Affset zone is clicked, we process the destination zone and campaign, a country derived from the request (via Cloudflare's edge network, which also processes the underlying IP address to route and secure the request), device type, operating system, and browser (parsed from the user-agent string), and any click-identifier parameters the tenant's tracking link carries — such as a source click ID or sub-tracking labels passed in the URL by the traffic source. This tracking is cookieless: we do not set browser cookies to attribute clicks or conversions.

Information collected automatically in the dashboard: standard operational data such as API request metadata, used for security, rate limiting, and diagnosing issues.

affset.com uses a cookie-consent banner. If you accept, we load Google Analytics to understand site usage; if you decline or don't respond, no analytics script loads and no analytics cookies are set. You can change your choice at any time by clearing thecookie-consentvalue in your browser's site data, which will show the banner again on your next visit.

The dashboard itself does not use cookies for sign-in; it stores authentication state in your browser's local storage. Ad serving, as noted above, does not use cookies at all.

• To operate ad serving, targeting, tracking, and postback delivery for our tenants;
• To provide the dashboard, reporting, and account management;
• To process billing and send account, security, and service notices;
• To respond to support and contact requests;
• To detect and prevent fraud, abuse, and security incidents;
• To measure and improve affset.com (only with analytics consent, see Section 2);
• To comply with legal obligations.

We share data with the service providers that run Affset's infrastructure, each acting under contract and only for the purposes below:

• Cloudflare — hosting, CDN, DNS, and edge network for the entire Service;
• Stripe — payment processing for paid plans;
• Postmark — delivery of transactional email (magic-link sign-in, billing, and account notices);
• Google Analytics — usage analytics on affset.com only, and only if you accept cookies.

Click, impression, conversion, and postback data generated on a tenant's zones is shared with that tenant and, through the postback URLs and macros the tenant configures, with the publishers, advertisers, and traffic sources the tenant works with — this is the core function of the Service. We do not sell personal data, and we do not share data across tenants: every tenant's data is isolated to their own account.

We may also disclose information if required by law, or to protect the rights, property, or safety of Affset, our tenants, or others.

Account and billing data is retained for as long as the Account is active, and for a limited period after closure as needed for legal, tax, and dispute-resolution purposes. Ad-serving event data (clicks, impressions, conversions) is retained according to the tenant's plan — retention windows are published on our pricing page and vary by plan tier.

If you are an Affset account holder, you can access, update, export, or request deletion of your account data by signing in to the dashboard or contacting support@affset.com.

If you are an end user who clicked a tracking link served through a tenant's Affset zone, Affset processes limited, cookieless click/conversion data on that tenant's behalf. The tenant who owns the campaign is best placed to handle requests about that data; you can also contact us and we will route your request to the relevant tenant where we are able to identify them.

Depending on where you're located, you may have additional rights under laws such as the GDPR or CCPA/CPRA, including the right to object to or restrict certain processing. We will honor valid requests under applicable law.

The Service is not directed at children, and we do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction). If you believe a child has provided us with personal information, contact us and we will delete it.

Affset runs on Cloudflare's global network, which means data may be processed in countries other than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

We use reasonable technical and organizational measures to protect data — including namespace-level tenant isolation and API-key-based authentication — but no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. For material changes, we will provide notice (such as an email to your Account's contact address or a notice in the dashboard) before the change takes effect.

Questions about this Privacy Policy can be sent to support@affset.com or via our contact page. See also our Terms of Service.