Privacy Policy
Last updated: August 1, 2026
Template — requires legal review before relying on it.
1. Scope and controller
This policy describes how AIffiliator ("we", "the Service") processes personal data when you use the application. The data controller is the legal entity identified in the final reviewed version of this document. For workspace content, the workspace owner acts as controller for their members' data and generated sites; we act as processor for that content.
2. Data we process
We process: account details (email, authentication identifiers); workspace configuration and membership; content you submit or generate (prompts, niche descriptions, brand assets, articles, affiliate links, imported sources such as uploaded PDFs and reference URLs); subscription and billing status (payment details are handled by our merchant of record and never touch our servers); technical logs (request metadata, coarse usage analytics, security and audit events); and cookie/local-storage preferences such as locale and active workspace.
3. Purposes and legal bases
We use personal data to: provide and operate the Service (contract); authenticate accounts and enforce workspace access (contract, legitimate interest); process AI generation requests you initiate (contract); manage subscriptions and billing (contract, legal obligation); secure the Service, prevent abuse, and keep audit trails (legitimate interest, legal obligation); and produce aggregated, non-identifying product analytics (legitimate interest).
4. AI processing
Prompts, source material, and site content are sent to AI models via OpenRouter to fulfill generation requests. Content submitted to AI providers is governed by their data-processing terms; do not submit sensitive personal data in prompts or imported sources. Generated output is stored in your workspace until you or your workspace owner deletes it.
5. Subprocessors
We rely on the following categories of service providers: PostgreSQL hosting (database, authentication, file storage); OpenRouter (AI model routing); Creem (merchant of record for billing); Cloudflare (hosting of generated customer sites); application hosting (compute and durable workflows); and search/scraping providers (keyword research and URL ingestion). Each provider processes data only as needed to deliver its function.
6. Cookies and local storage
We use strictly necessary cookies for authentication sessions and security, plus functional storage for preferences such as locale and selected workspace. We do not use third-party advertising or cross-site tracking cookies.
7. Retention
We retain personal data for as long as your account or workspace is active and as needed afterward for legitimate purposes: workspace content until deleted by an authorized member; billing records as required by tax and accounting law; security and audit logs for a limited period; backup copies until they cycle out of rotation. When a subscription ends, read and export access to workspace data remains available as described in the product.
8. Your rights (GDPR and similar laws)
Depending on your jurisdiction you may have the right to: access, correct, or delete your personal data; receive a portable copy; restrict or object to processing; withdraw consent where processing is consent-based; and lodge a complaint with a supervisory authority. You can review and export workspace data from within the product. To exercise rights, contact us at the address below; identity verification and workspace-ownership checks may apply.
9. International transfers
Our subprocessors may process data in countries other than yours. Where required, transfers rely on adequacy decisions, standard contractual clauses, or equivalent safeguards offered by those providers.
10. Security
We apply access controls, workspace-level isolation, encryption in transit, rate limiting, and audit logging. No system is perfectly secure; we will notify affected users and regulators of personal-data breaches where required by law.
11. Children
The Service is not directed at children under 16 and we do not knowingly collect their personal data. Contact us to request deletion of any such data.
12. Changes to this policy
We may update this policy as the Service evolves. Material changes will be announced through the Service or by email before they take effect. The "last updated" date reflects the most recent revision.
13. Contact
Privacy requests and questions: support@aiffiliator.com. This address and the controller identity are placeholders pending legal review.