Privacy policy
Affiliate Discovery is a business-data product. The corpus describes websites and the commercial relationships between them, not people's private lives. This page says exactly what we hold, why we are allowed to hold it, and how to get something removed.
1. Two kinds of data
It matters which one you are asking about, because they are governed differently and stored separately.
The corpus. Publisher domains, what they rank for, which merchants they promote, which affiliate networks pay them, their account identifiers inside those networks, traffic estimates and audience geography. This is observed on the open web and in publicly reachable affiliate infrastructure. It describes businesses and publications.
Your account. Your name, email address, hashed password, the searches you run, the plans you generate, the contacts you reveal, your credit balance and your API keys. This is about you, and it is used to run your account and nothing else.
2. Contact details in the corpus
Some records carry a business contact address published by the site itself, typically a role address such as partnerships@ or an address on a public contact page. We do not collect personal contact details from private individuals, we do not buy consumer lists, and we do not hold special-category data.
Where a business contact address identifies a person, it is personal data under the GDPR and comparable laws. We process it on the basis of legitimate interest in business-to-business partner discovery, and the objection and erasure rights in section 7 apply to it in full.
3. We are not a consumer reporting agency
Nothing here may be used to make decisions about a person's eligibility for credit, insurance, employment, housing or any other consumer purpose. The corpus is not assembled, verified or maintained for those purposes and must not be used for them.
4. What we collect when you use the site
The prompt box on the home page sends the sentence you typed to our server and to the AI provider that turns it into search terms. We keep the sentence, the terms and the result count so that plans and searches can be shown back to you. If you generate an outreach plan before making an account, we keep it against a random token so you can claim it when you sign up, and we delete it if nobody does within seven days.
We log the IP address a request came from for rate limiting and abuse investigation. We do not run advertising trackers, we do not sell or share your usage data, and the only cookies we set are the ones that keep you signed in and protect forms against cross-site request forgery.
5. Who else processes it
- Our hosting and database provider, which runs the application and stores every table described above.
- Our object storage provider, which holds cached brand marks and page screenshots.
- An AI provider, which receives the sentence you type into the prompt box and the answers you give the plan questions. It does not receive your account details.
- Our email provider, for account and transactional mail.
Each is a processor acting on our instructions under a data processing agreement. We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. How long we keep it
Account data lives as long as the account, and is deleted within 30 days of you closing it. Unclaimed outreach plans expire after 7 days. Request logs are kept for 90 days. Corpus records are refreshed on an ongoing basis; a record removed under section 7 is suppressed permanently so that a later crawl cannot reintroduce it.
7. Removal, objection and your rights
If you run a site in the corpus and want it out, email team@affiliatediscovery.ai from an address on that domain, or from the address published on the site, naming the domain. We will confirm control, suppress the record and tell you when it is done. We do not require a reason.
If you have an account, you can see and correct your details in Preferences, export what you have saved, and ask us to delete the account. Depending on where you live you may also have the right to object to processing, to restrict it, to receive your data in a portable form, and to complain to your data protection authority.
We answer every request within 30 days and do not charge for the first one in any 12-month period.
8. Where data is processed
Our infrastructure runs in the United States and the European Union. Transfers out of the UK and EEA rely on the European Commission's standard contractual clauses and the UK addendum.
9. Security
Traffic is encrypted in transit. Passwords are stored as salted hashes and never in plain text. API keys are shown once and stored hashed. Access to production data is limited to the people who operate the service. No system is perfect, and if a breach affects you we will tell you and the relevant authority within the time the law requires.
10. Changes, and how to reach us
If we change this policy in a way that affects how we handle your data, we will say so on this page and, for account holders, by email before it takes effect.
Affiliate Discovery (affiliatediscovery.ai) operates this service. Write to team@affiliatediscovery.ai for anything on this page.