Organically Affiliated is operated by Ascending Humans. This policy describes what data we collect, how we use it, and your rights regarding that data.

1. Data we collect

Account data. When you create an account, we collect your name, email address, and password (stored as a hash, never in plain text). Business owners also provide a business name, website, category, and location.

Partner data. Partners who join a brand's program provide their name, email address, PayPal email for payouts, city, promotional channels, social media handle, audience size, and a phone number if they choose to give one. They also provide whatever they write in answer to the brand's own application questions, including anything they say about themselves. Where a brand has written partner guidelines, we record the date the partner confirmed they had read them.

Referral and sales data. The service tracks referral link clicks, referred customer email addresses, sale amounts, and commission calculations. This data is provided by the business owner through the platform.

Payment data. Brands subscribe through the Shopify App Store, and Shopify handles their payment details. Charges appear on the brand's own Shopify bill. We never receive or store card numbers, bank account details or any other payment credentials, and we hold no payment identifier of our own. We do store whether a subscription is active, which is what decides access to the service. Joining as a partner is free, so a partner makes no payment to us at all.

Data from connected stores. If a brand connects its Shopify store, we receive a notification from that store when an order is paid, cancelled or refunded. From an order we keep seven things and nothing else: the order's Shopify identifier, the customer's email address, the order subtotal after any discount, the currency, the date the order was created, the discount codes used on it, and whether it is paid. From a refund we keep the refund's identifier, the order's identifier, the amount refunded and the date.

The only personal information in that list is the email address, which is what lets us match a returning customer to the partner who referred them. The notification Shopify sends also carries the customer's name, phone number, shipping and billing addresses, line items and payment details. None of it is stored: the fields above are a fixed list of what to keep, so anything else in the notification, including anything Shopify adds to it in future, is discarded before we write anything down. This data belongs to the merchant. We process it on their behalf and only to attribute sales and calculate commissions.

Access logs. We record an audit entry each time protected customer data is read, created, or deleted through the application, including who accessed it and when. These entries reference internal record identifiers and do not contain email addresses.

Usage data. We collect standard server logs including IP addresses, browser type, and pages visited. We do not use third party analytics or tracking scripts.

2. How we use your data

• To operate the service: authenticating accounts, tracking referrals, calculating commissions, generating payout statements
• To communicate with you about your account, partner application status, or service changes
• To enforce our standards
• To maintain security and prevent abuse

3. Data sharing

We do not sell your data, and we do not use it for advertising, profiling, or any purpose other than operating the service. We share data only in these circumstances:

• With the subprocessors listed in section 4, each limited to what it needs to perform its function
• Between brands and their partners as necessary for the program to function. A brand can see, for each of its own partners: their name, the email address on their account, the PayPal address their commissions are sent to, their referral code, and their performance, meaning the sales they brought in, the commissions they earned and what is still owed to them. A brand can also see the answers that partner gave to the brand's own application questions, and, where the brand has written partner guidelines, the date the partner confirmed they had read them. When a brand pauses a partner, removes them from its program, or voids one of their commissions, any reason the brand gives is shown to that partner. A brand can see the full email address of a customer referred to its own store, because that customer is the brand's own. Partners can see only a masked form of the same address (for example j***@example.com), never the full one.
• When required by law in response to a valid legal process

Customer data received from a connected store is never shared with any other merchant, never used to contact the customer, and never sold or transferred to anybody else for their own purposes.

4. Subprocessors

We use the following third party services to operate Organically Affiliated. Each is bound by its own data protection terms, and each receives only what it needs to perform its function.

Shopify is not in this table, because it is not a subprocessor of ours. A brand's Shopify store is the brand's own system and the source of the order data we receive, and Shopify bills the brand for this app directly. Shopify's handling of that relationship is governed by its own terms with the merchant.

We will update this list before adding any new subprocessor that can access personal data.

5. Data retention

We retain your account data for as long as your account exists. Uninstalling the app ends your subscription and deletes nothing, so if you install again your brand, your partners and your history are all still there. We may retain aggregated, anonymized data indefinitely for internal analysis.

For data received from connected stores, these are the limits we retain within:

• Customer email addresses: removed when Shopify sends us its shop redaction request, which Shopify does about 48 hours after a merchant uninstalls the app. On a deletion request from the merchant or the customer, we remove the address within 30 days.
• Order notification payloads: deleted after 90 days by an automated daily job, retained until then for dispute resolution and debugging.
• Access log entries: deleted after 12 months by the same automated job. These contain no email addresses, only internal record identifiers, and are kept longer than the data they describe so that an audit trail survives the deletion of its subject.
• Commission and sales records: retained as financial records. The customer identifier is anonymized when the customer's record is removed; the transaction amounts remain.

Order notification payloads and access log entries are removed automatically by a job that runs daily. Customer email addresses are removed on Shopify's redaction request rather than by that job, which is why they go sooner than the limits above rather than later. For a small number of accounts that became inactive before any of this automation existed, removal is handled manually on request. Deletion requests are always handled individually and within the timeframes above.

6. Your rights

You may:

• Access the personal data we hold about you
• Correct inaccurate data through your dashboard or by contacting us
• Request deletion of your account and associated data
• Request an export of your data

To exercise any of these rights, contact support@organicallyaffiliated.com. We respond within 30 days.

If you are a customer of a store that uses Organically Affiliated, we hold your email address only because the store you purchased from connected their account to our service. You can request access to or deletion of that data either by contacting the store directly, or by emailing us at the address above. Requests forwarded to us by the store, including automated deletion requests sent through Shopify, are honoured within 30 days.

7. Security

We use industry standard measures to protect your data, including encrypted connections (HTTPS), hashed passwords, and role based access controls. Our database is hosted on Supabase with encryption at rest. No system is perfectly secure, and we cannot guarantee absolute security.

8. Cookies

We use local storage to maintain your login session. We do not use third party cookies or tracking technologies.

9. Children

The service is not intended for anyone under 18. We do not knowingly collect data from minors.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through the service.

11. Contact

Questions about this policy can be sent to support@organicallyaffiliated.com.