Privacy Policy

Data Controller

The controller responsible for your personal data is:

Company

ZIBA GLOBAL CONSULTING LTD

Registered address

65 London WallLondonEC2M 5TUUnited Kingdom

Company registration number

[ TO BE COMPLETED ]

VAT number

[ TO BE COMPLETED ]

ICO registration

[ TO BE COMPLETED ]

Data Protection Officer

[ TO BE COMPLETED ]

Contact email

[ TO BE COMPLETED ]

Contact phone

[ TO BE COMPLETED ]

Personal Data We Collect

We collect the categories of data described below. The exact data depends on how you use the service — for example whether you browse anonymously, register an account, publish content or advertise.

Account Registration Data

When you create an account we store your display name, unique handle, email address and, for email/password sign-up, a securely hashed password. You may optionally add a short bio, an avatar image and a preferred interface language.

Authentication Data

We support email/password sign-in and, where configured, sign-in with Google or GitHub. We store authentication sessions and short-lived, single-use tokens for email verification and password resets. Passwords are stored only as bcrypt hashes; verification and reset tokens are stored only as hashes.

User-Generated Content

What you publish is stored with your account: partner programmes (description, terms, logo, banner, commission rules, product lists), applications to programmes including the channels and reach you state, and ratings.

Uploaded Files and Images

Images you upload (avatars, program logos and banners) are resized and converted to WebP and stored in S3-compatible object storage (AWS S3 in production). Uploaded images are publicly accessible via their URL.

Clicks and conversions

When someone clicks an affiliate link we record the click with a random reference code, the time, the programme and publisher, a coarse device type and country, and a keyed hash of the IP address and of the browser identifier. We set no cookie. The reference code travels to the shop in the link; when the shop reports a sale it sends the code, the order number and the order value back to us.

The hashes serve fraud detection only and are deleted after 7 days. Order data is reduced to what pricing and support need after 30 days; clicks without a sale are deleted after 180 days. Legal basis: our and our partners' legitimate interest in correct attribution and fraud prevention (Art. 6(1)(f) GDPR). For this processing we and the merchant are joint controllers (Art. 26 GDPR); the essence of that arrangement is available on request.

Payments, payouts and documents

Merchants top up credit through Stripe; we receive the payment status, not card details. Publishers receive payouts through Stripe Connect; Stripe verifies the identity and bank account of the connected account, and we store only its identifier and whether payouts are enabled. For credit notes and invoices we process legal name, address, VAT ID or tax number and tax status. Booking records, invoices and credit notes are kept for the statutory retention periods (up to 10 years). Legal basis: performance of the contract and legal obligations (Art. 6(1)(b) and (c) GDPR).

News by e-mail

We send news only if you opted in at sign-up or in your settings (Art. 6(1)(a) GDPR). We store when you gave consent. Every such e-mail contains an unsubscribe link, and you can switch news off in your settings at any time. Messages about your account and money are sent regardless, because they are part of the service.

Contact Information

For privacy questions or to exercise your rights, contact us at the registered address above or by email. [ Contact email: TO BE COMPLETED. ]

Communication Data

We send transactional emails (such as email verification, password reset and notification emails) and, where you opt in, informational emails. Emails are delivered through an SMTP email provider (Mailgun in the production configuration). You can control notification emails in your settings.

Technical Data

When you interact with the service we process technical data needed to deliver and secure it, including request metadata and the data described under Device, IP and Log Files below.

Device and Browser Information

Your browser sends standard information such as browser type and version, operating system and the preferred language, which we use to select your interface language.

IP Address Processing

Your IP address is processed briefly to deliver the service and to protect it (rate limits). On affiliate clicks we store only a keyed, daily rotating hash of it for fraud detection, deleted after 7 days.

Log Files

Our server and hosting infrastructure may keep log files containing technical request data for operation, debugging and security. [ TO BE COMPLETED: hosting provider and log retention period. ]

Cookies and Similar Technologies

We use a small number of cookies. Strictly necessary cookies run by default; analytics cookies load only after you consent. We do not use local storage, session storage or marketing/advertising cookies. See our Cookie Policy for the full list.

Cookie Policy

Legal Basis for Processing (GDPR)

We rely on the following legal bases:

• Performance of a contract — to provide your account and the services you request.
• Legitimate interests — to operate, secure and improve the service and to measure aggregate reach.
• Consent — for analytics cookies and optional emails; you may withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law.

How We Use Data

We use personal data to:

• create and manage your account and authenticate you;
• run partner programmes: publish them, handle applications, attribute clicks and conversions;
• book commissions, charge merchant credit, pay publishers and issue invoices and credit notes;
• detect fraud and protect the service;
• send messages about your account and money, and news if you asked for it.

Data Sharing and Service Providers

We do not sell personal data. We share data with service providers (processors) only as needed to run the service:

• Stripe — payments for credit and payouts to publishers (Stripe Connect).
• Object storage for uploaded images (S3-compatible).
• An SMTP e-mail provider — sending e-mails.
• Sentry — error reports, without request contents, headers, cookies or personal identifiers.
• Google Analytics — website analytics, only after you consent.
• Google and GitHub — only if you sign in with them.

Merchants see the publishers who apply to their programmes (display name, website, channels, stated reach) and the conversions attributed to them; publishers see the programmes they joined and their own clicks and commissions. [ TO BE COMPLETED ]

International Data Transfers

Some service providers may process data outside the UK/EEA. Where that happens, transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement/Addendum or EU Standard Contractual Clauses. [ TO BE COMPLETED: confirm provider locations and safeguards. ]

Data Retention

• Click hashes (IP, browser): 7 days.
• Order details of conversions beyond what pricing needs: 30 days.
• Clicks without a sale: 180 days; tracking error logs: 90 days.
• Account data: while the account exists; on deletion the account is pseudonymised, and only what the law requires us to keep remains.
• Booking records, invoices and credit notes: statutory retention periods (up to 10 years).
• Backups and server logs: [ TO BE COMPLETED ]

Your Rights Under the GDPR

Subject to conditions, you have the following rights over your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right of rectification — ask us to correct inaccurate or incomplete data.
• Right of erasure — ask us to delete your personal data.
• Right of restriction — ask us to limit how we process your data.
• Right of data portability — receive your data in a portable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — withdraw consent at any time, without affecting prior processing.
• Right to lodge a complaint — complain to a supervisory authority (in the UK, the Information Commissioner's Office).

Security Measures

We apply technical and organisational measures to protect personal data, including bcrypt password hashing, storing verification and reset tokens only as hashes, hashing IP-based fingerprints, transport encryption (HTTPS) and access controls. No method of transmission or storage is completely secure.

Children's Privacy

The service is not directed at children and we do not knowingly collect personal data from children. [ TO BE COMPLETED: minimum age and parental-consent approach. ]

Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date above shows when it last changed. Material changes will be communicated through the service.

Contact Information

For privacy questions or to exercise your rights, contact us at the registered address above or by email. [ Contact email: TO BE COMPLETED. ]