Affiliate privacy & cookies

Your affiliate identity is independent of customer and website membership accounts. The central affiliate system stores your email, name, optional website, site memberships, consent time, assigned codes and accounting activity. Each public site displays only your own activity for that site.

One-time verification links expire after 20 minutes and are stored only as keyed hashes. Sign-in requires explicit confirmation. An essential Secure, HttpOnly cookie scoped to /affiliates/ keeps your affiliate session for at most seven days. A separate short-lived cookie protects forms from cross-site requests. Sign out to revoke your current session.

When referral tracking is enabled at checkout, a pseudonymous referral cookie can persist for up to 30 days. Visits are deduplicated by code, day and pseudonymous visitor identifier. Codes entered explicitly at checkout take precedence. IP identifiers used for rate limits are keyed hashes rather than raw IP addresses.

The accounting system keeps opaque order references and verified order amounts, not payment card details. Buyer emails, when supplied for self-referral checking, are discarded after keyed hashing. Affiliates do not see customer email addresses or names. Administrators can review affiliate identity and accounting records.

Affiliate authentication uses a self-hosted browser calculation, short-lived one-time challenges and rolling mail limits to reduce automated abuse, not to prove humanity. Private abuse telemetry is retained for 30 days: UTC time, site, action, outcome, reason, random correlation identifier, keyed email/IP identifiers and SMTP Message-ID. SMTP acceptance does not establish inbox delivery. Message bodies, raw IPs, cookies and secret links are not stored in this telemetry. Exact complaint suppressions remain in place separately. Accounting and audit history is not subject to this telemetry cleanup.

Accounting and audit records are retained for reconciliation, including corrections and recorded payouts. Contact support@fractalseven.com about access, account closure or privacy requests. Some records may need to be retained for accounting obligations.