Privacy Policy

Last updated: July 28, 2026

This policy explains how Rebase Reality processes personal data when you visit the AffiHQ website, contact us or use the AffiHQ service.

AffiHQ is designed to minimise the personal data copied from a merchant's product. A commission normally needs a pseudonymous customer reference and financial events, not the customer's full profile.

Who controls your data

For the AffiHQ website, accounts, billing, security and direct communications, the data controller is:

Rebase Reality
6 rue d'Armaillé
75017 Paris, France
[email protected]

When a merchant uses AffiHQ to operate its own affiliate programme, responsibilities depend on the processing involved:

the merchant generally determines the programme rules, selects affiliates and decides how referred-customer data is used;
Rebase Reality processes relevant programme data to provide AffiHQ and may act as a processor for the merchant;
Rebase Reality remains a controller for its own account administration, security, fraud prevention, billing and legal obligations.

Data we may process

Website visitors and contacts

We may process:

the email address and information you include in a message;
your preferred language and communication history;
technical request data such as date, browser family, requested URL, truncated or security-relevant network information and server logs;
consent choices when optional audience measurement is enabled.

Merchant users

For merchant accounts, we may process:

name, professional email address and authentication data;
organisation, team role and product configuration;
subscription, invoices and payment-provider references;
campaigns, commission rules, affiliate invitations and internal notes;
audit logs, support messages and security events.

Affiliates

Depending on the merchant's programme, we may process:

name or business name, professional contact details and account data;
campaign membership, level, rate and agreement acceptance;
affiliate links, public identifiers and personal codes;
clicks recorded after the required consent, attributed signups and conversion states;
commission entries, corrections, payout statements and payment references;
invoices or supporting documents submitted for a payout;
fraud, dispute and support records.

Referred customers

AffiHQ should receive only the information needed to attribute and explain a commission, such as:

a stable pseudonymous merchant reference;
the relevant product, plan and billing cycle;
attribution dates and source;
eligible payment, refund, dispute or subscription events;
amounts, currency, discounts and commission status.

AffiHQ does not need a referred customer's full name, postal address, complete account profile or card details for ordinary commission processing. Merchants must not send unnecessary customer data.

Why we use the data

We process data to:

answer sales, onboarding and product enquiries;
create and secure accounts;
operate affiliate links, codes, attribution and campaign rules;
reconcile eligible billing events and calculate commissions;
prepare payout batches, exports and statements;
show merchants and affiliates an understandable history;
detect duplicate events, abuse, self-referrals and fraud;
provide support, monitor reliability and protect the service;
invoice subscriptions and meet accounting or legal duties;
improve AffiHQ using aggregated or minimised usage information.

Our legal bases may include performance of a contract, steps requested before a contract, legitimate interests in operating and securing a B2B service, compliance with legal duties, and consent where the law requires it.

An affiliate click may happen days or weeks before an account is created. Remembering that source on a device generally requires a cookie or comparable storage.

The merchant controls the website on which attribution is collected and must implement the consent mechanism required by applicable law. In France, affiliate tracers used to charge or remunerate affiliate operations are not automatically exempt from consent.

AffiHQ is intended to support a clear choice:

when the visitor accepts, attribution may be stored for the period announced by the merchant;
when the visitor refuses, no affiliate tracer should be stored and access to the merchant's product must continue;
a code entered voluntarily during signup may provide attribution without persistent browser tracking.

Cookies and audience measurement

The AffiHQ website may use strictly necessary technologies for security, traffic routing, language continuity and, once accounts are available, authentication.

Optional analytics or audience-measurement tools will only be enabled in accordance with the applicable consent rules. Refusing optional measurement does not prevent access to the public website.

Payments and billing providers

Subscription payments may be processed by a specialist provider such as Stripe. AffiHQ does not store complete payment-card numbers. The provider processes payment data under its own terms and privacy policy.

In the initial service, AffiHQ does not hold affiliate funds and does not make transfers on behalf of merchants. It records calculated amounts and the payment references supplied by the merchant.

Recipients and service providers

Data is accessible only to authorised Rebase Reality personnel and service providers that need it to perform their role, such as hosting, email, monitoring, support and payment services. We require providers to protect the data and use it only for the agreed service.

The service is hosted in Germany by Hetzner Online GmbH. If a provider processes data outside the European Economic Area, we use an appropriate legal transfer mechanism where required.

We do not sell personal data.

Retention

We keep data only as long as necessary for the relevant purpose:

contact messages are retained while the request is active and for a reasonable follow-up period;
account and campaign data is retained for the duration of the service relationship and the time needed for support, proof and legal obligations;
financial entries, payout records and invoices may be retained for the periods required by accounting and tax law;
security logs are retained for a limited period proportionate to incident prevention and investigation;
data may be anonymised when an identifiable record is no longer necessary.

Commission history is designed to be append-only. This does not prevent the deletion or anonymisation of personal data that is no longer required; financial records can retain pseudonymous references where necessary for proof and reconciliation.

Security

We use technical and organisational measures suited to the data and risks involved, including access controls, minimisation, separation between merchants, event idempotency, audit records, encryption in transit and protected backups where appropriate.

No online service can guarantee absolute security. Please report a suspected vulnerability or unauthorised access promptly to [email protected].

Your rights

Subject to the conditions in the GDPR and French Data Protection Act, you may request:

access to your personal data;
correction of inaccurate data;
deletion or restriction of processing;
objection to processing based on legitimate interests;
portability of data you provided where applicable;
withdrawal of consent at any time, without affecting earlier lawful processing.

We may need to verify your identity before answering. If your request concerns data managed for a merchant's affiliate programme, we may forward or coordinate the request with that merchant.

You may also lodge a complaint with the CNIL, the French data-protection authority.

Changes to this policy

We may update this policy as AffiHQ adds providers or changes its processing. The date at the top identifies the current version. Material changes will be communicated through an appropriate channel.

Contact

For a privacy request or question, write to [email protected].