Try free

Privacy policy

Effective 7 November 2026

Controller

Markus Schwed, Tempelstraße 7, 66773 Schwalbach, Deutschland – info@affliq.com

Website and web portal

This website (www.affliq.com), the app's API (api.affliq.com) and the web portal (app.affliq.com) are hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) on a server in Germany; files (evidence, invoices, exports, images) and database backups are kept in Hetzner's Object Storage, also in Germany. Technically necessary data (IP address, time, requested address, user agent) is processed in server logs; the legal basis is our legitimate interest in secure operation (Art. 6 (1) (f) GDPR). Logs are deleted automatically after a short time.

The website sets no cookies and embeds no advertising or font services; we count page views ourselves without cookies (see audience measurement). The web portal sets one technically necessary session cookie after sign-in; if you reach the sign-up through a link from our website, a cookie records for one hour which page (and which campaign parameters of the link) you came from, so that the new account shows us which pages bring customers.

When a technical error occurs, an error report goes to Sentry (Functional Software, Inc., USA; stored in the EU) with technical details such as the error message, the affected function and the time, without IP address. The legal basis is our legitimate interest in stable operation (Art. 6 (1) (f) GDPR); access from the USA relies on standard contractual clauses (Art. 46 GDPR).

Audience measurement

To understand how visitors find our website, whether they create an account and which features of the web portal (app.affliq.com) are used, we count page views on the website and in the web portal with Umami, open-source software we run ourselves on our server at Hetzner in Germany (insights.schwed.online); no data goes to any other service. We process the page visited, the referring page, browser, operating system, device type, screen size, language and the country, region and city derived from the IP address; the IP address itself is not stored; parameters after the question mark of an address (such as figures entered in the calculator) are not transmitted, and pages opened through an access link from an email are not counted. A hash is formed from IP address and browser identifier with a key that changes every month, so visits can be attributed to the same visitor only within one month; in the web portal, page views are not linked to your account. The count sets no cookies and stores nothing on your device. If your browser sends "Do Not Track", you are not counted. The legal basis is our legitimate interest in designing the website and the web portal to meet their users' needs (Art. 6 (1) (f) GDPR). We delete the data after 24 months. You can object to the processing at any time (Art. 21 GDPR), for example by email to info@affliq.com.

Waitlist

If you joined the waitlist before the launch, we store your email address, your language and the time of signup, and we send one confirmation email (double opt-in) and later the notice that Affliq is available, plus an invitation to the beta if you asked for one; the invitation also contains a link to our WhatsApp community (see below). The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time by writing to info@affliq.com; we then delete the address. Unconfirmed addresses are deleted after 30 days, the list itself after launch. Mail is sent through Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin), which processes your email address for that purpose.

WhatsApp community

We run a community on WhatsApp for testers, help and exchange. Taking part is voluntary and only happens through your own action: we pass neither your email address nor any other data from the waitlist, the app or the web portal to WhatsApp, and we add nobody ourselves. Only when you tap an invite link we give you, for example in our invitation email or in the web portal, and join the community are you in. WhatsApp (WhatsApp Ireland Limited, Ireland) then processes your phone number, profile name, profile picture and messages under WhatsApp's own terms and privacy policy, which may include transfers to the USA. As the community's operator we see your phone number and profile name; the members of a group you join see them too, the announcement group does not show them. We use this only to run the community and do not link it to your Affliq account. The legal basis is the consent you give by joining (Art. 6 (1) (a) GDPR); you can leave the community at any time. For questions about your account or your data, please write to info@affliq.com rather than in the community.

Privacy in Affliq (web portal and app)

Affliq is your back office: deals, invoices, benefits, payouts, expenses and the evidence behind them. We process only what you enter, forward or import for that.

Sign-in

You sign in with Apple, Google or email and password. From Apple or Google we receive a technical identifier, your name and your email address (Apple may give us a relay address); with email sign-up we store the address, a hashed password and the time of verification. Connecting a platform account (TikTok today) is optional: we then store a technical identifier, display name, profile picture address and access tokens, encrypted, and never post or act on your behalf. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).

Your records

In Affliq you store deals and deliverables, partners, invoices, benefits (samples, test samples, kept products, services) with their log, payouts and the imported reports, affiliate orders and commissions, expenses with receipts, notes, and your legal profile (name, address, contact, tax details) for imprints and invoices. We process this data solely to provide you with your own records (Art. 6 (1) (b) GDPR). Tax numbers and tokens are stored encrypted. Your records also contain third-party data, such as your partners' contact persons and the recipients of your invoices; you are the controller for that data, and we process it on your behalf (Art. 28 GDPR, section 7 of the terms of use).

Evidence: screenshots, photos, documents and forwarded emails

Screenshots, photos and documents you share with Affliq and emails you forward to your personal Affliq address are stored unchanged as evidence for your records, including the original message. Such evidence may contain third-party data (for example names and addresses of partners or senders); you decide what you file. Evidence is never deleted, at most set aside, because it forms your business records.

Reading evidence (Anthropic)

So that you do not have to type up your evidence, we transmit the image, the PDF document or the text of a forwarded email to Anthropic PBC (USA) as a processor; the model reads details such as partner, product, date, amounts and status from it, which you then confirm. Anthropic does not use API data to train its models. Transfers to the USA are based on standard contractual clauses (Art. 46 GDPR).

Emails

Emails to your forwarding address (…@in.affliq.com) are received by our own mail server at Hetzner in Germany; no external service is involved. Mail to unknown addresses is rejected and not stored. Emails from us to you (confirming your address, resetting your password, notices about your account and subscription) are sent through Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin) as a processor. The legal basis in both cases is performance of the contract (Art. 6 (1) (b) GDPR).

Subscription

Every new account has a 30-day trial without payment details. After that you take out your subscription in the web portal or in the app. On the web, Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland) handles the payment: you enter your payment details directly with Stripe, and we do not receive them. We pass Stripe the name, address, email address and, where given, VAT ID from your legal profile and receive from Stripe the status, term, payments, failed payments and refunds of your subscription. Stripe also processes data in the USA; the transfer relies on standard contractual clauses (Art. 46 GDPR). We check the VAT ID of a business in another EU member state with the European Commission’s confirmation service (VIES) and keep the result as evidence. In the app, Apple handles purchase and payment in the App Store; we ask Apple about your purchase, and Apple sends us its later changes: transaction identifier, product, term, status, renewal, cancellation, refund, and the price, currency and country of the purchase. We use these details to unlock your account’s features, to tell you by notification and email before your trial or subscription ends, and to issue our invoices for web subscriptions. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR), and for invoices and the VAT ID check our tax obligations (Art. 6 (1) (c) GDPR).

Notifications

If you switch reminders on, we store your device token and your device's time zone and send at most one notification a day through the Apple Push Notification service (deadlines, commission rate changes). You switch both off in your profile or in iOS Settings; the token is then deleted.

Recipients at a glance

Retention, export and deletion

Your data stays stored as long as your account exists, also after your subscription ends: you can still view and export it then. You build a year's tax package (invoices, payouts, benefits, expenses, evidence) and the accounting exports yourself and hand them to whom you choose. Database backups are overwritten after 14 days. You delete your account in the app under Profile → Delete account, in the web portal under Account, or on request to info@affliq.com. We then remove your account with all records, evidence and files immediately and for good and revoke a sign-in with Apple; backups are overwritten after 14 days at the latest. Because your records and evidence are business records with retention duties of your own, download the tax packages first; Affliq points you to them. We keep the invoices we issued to you for a web subscription for ten years under section 147 of the German Fiscal Code (AO), also after your account is deleted.

Your rights