Privacy policy

Kickrail runs affiliate programs for software companies that bill through Stripe. This policy covers the hosted service at kickrail.com, the affiliate portals it serves (including portals on a merchant's own domain), and the kr.js tracking script. Kickrail's source code is public; if you run your own copy, you are responsible for it and this policy does not apply.

Who is responsible for what#

• Merchants (the companies that run a program) and their teammates: Kickrail decides how this account data is used and is responsible for it.
• Affiliates and referred customers: Kickrail processes their data on the merchant's behalf, to run that merchant's program. The merchant decides what is collected and is responsible for telling affiliates and customers about it, including any cookie notice their own site needs. Questions about a specific program are best sent to that merchant first; we will help them answer.

What we collect#

Merchant accounts.

• Name, email address and a hashed password.
• Hashed IP addresses of your last ten sign-ins, to spot account takeover. We do not keep the raw address.
• Program settings, campaigns, commission rules, teammates and API keys.
• Your Stripe connection: a restricted key or a Stripe Connect account id. Keys, webhook secrets and PayPal credentials are encrypted at rest.
• If you subscribe to a paid plan: your Stripe customer and subscription ids. Card details are handled by Stripe and never reach us.

Affiliates (entered through a portal, or added or imported by the merchant).

• Name, email address, hashed password and referral links or codes.
• Payout details you choose to give: the payout method and the address or account you enter for it.
• Tax forms (W-9 or W-8), if the merchant asks for them: legal name, business name, address, country, date of birth and tax id. The tax id is encrypted at rest and only its last four digits are shown.
• Clicks, referrals, commissions and payouts credited to you.

Visitors and referred customers (collected by kr.js on the merchant's site and from the merchant's Stripe account).

• When someone opens a referral link: the page URL, the referring URL, the browser's user agent, a hashed IP address and a random click id.
• When they sign up or pay: the email address or user id the merchant reports, their Stripe customer id, and the amounts and ids of invoices and refunds that earn or reverse commissions.

Cookies and local storage#

• On kickrail.com: kr_session keeps you signed in and kr_program remembers which program you are working in. Both are needed for the dashboard to work.
• On a merchant's site, kr.js stores kr_ref (the click id) and kr_via (the affiliate) as first-party cookies and in local storage, for the number of days the merchant sets for their program, so a later purchase is credited to the right affiliate.
• Kickrail sets no advertising cookies and runs no third-party analytics on kickrail.com.

How we use it#

• To credit referrals and calculate commissions, and to show merchants and affiliates their own numbers.
• To send account and program email: email verification, password resets, approvals, commission and payout notices. Merchants can switch most program emails off.
• To flag likely self-referrals and fraud, for example when a buyer and affiliate share an email domain.
• To bill paid plans and enforce plan limits.
• To keep the service secure and fix problems.

We do not sell personal data, use it for advertising, or use one merchant's data for another merchant.

Who we share it with#

• DigitalOcean hosts the application and database, in the United States.
• Stripe handles billing for paid plans. Kickrail also reads from and writes to the merchant's own Stripe account (for example, the referring affiliate on a customer's metadata) when the merchant connects it.
• Brevo delivers our email.
• PayPal and Rewardful only when a merchant connects them, to send payouts or import an existing program.
• The merchant whose program you joined, or who you were referred to, sees your data for that program.
• Authorities, when the law requires it.

How long we keep it#

Account and program data is kept while the account is open. Raw Stripe event logs are deleted after 90 days. When a merchant or affiliate asks us to delete their account, we delete it within 30 days, except records we must keep for tax or legal reasons. Database backups roll off within a few weeks after that.

Your rights#

You can ask to see, correct, export or delete your data, or object to how it is used. Merchants can export affiliates, referrals and commissions as CSV from the dashboard at any time. Email [email protected] for anything else; we answer within 30 days. If you are in the EU, UK or another place with data protection law, you can also complain to your local regulator.

Security#

Traffic is encrypted in transit. Passwords are hashed, IP addresses are stored only as hashes, and secrets and tax ids are encrypted at rest. Access to production data is limited to the people who run the service.

Children#

Kickrail is a business tool and is not meant for anyone under 16.

Changes#

If we change this policy in a way that matters, we will email merchants before it takes effect. The date at the top shows the latest version. See also the terms of service.

Contact#

Questions about these terms or your data: [email protected]. Help with your account: [email protected].