1. What This Policy Covers
Rezfiliate and the Merchant storefront integrations may use cookies, local storage, session storage, and server-side requests to provide authentication, security, affiliate attribution, cart/order coordination, and related Service functions. This Policy explains the technologies used by Rezfiliate-controlled pages and by the tracking SDKs that Merchants install on their own websites.
Read this Policy together with our Privacy Policy. Whether a technology is exempt from consent depends on its purpose, the jurisdiction, and the context in which it is used. This Policy is not a determination that any particular Merchant has satisfied its cookie-consent obligations.
2. Technologies Used
2.1 Authentication and security cookies
Rezfiliate-controlled pages may use environment-dependent NextAuth cookies, including session, CSRF, OAuth state, nonce, PKCE, and callback-URL cookies. Names may include __Secure-next-auth.session-token, next-auth.session-token, __Host-csrf-token, and related OAuth state cookies. They support login, session integrity, and security. Session duration varies by authentication flow and may be up to approximately 30 days for database-backed sessions.
2.2 Affiliate attribution cookies
Merchant storefront SDKs may set first-party cookies such as rezfiliate_click_id, rezfiliate_ref_code,ref_code, and, where legacy integrations are present, aliases such as click_id, aff_click_id, aff_ref, ref, r, or via. These values help associate a referral with a later signup, cart, or order. The standard attribution period is 30 days, but the effective period can depend on the integration and Merchant configuration.
Attribution technologies are not automatically "strictly necessary" merely because they support affiliate reporting. The Merchant must determine whether consent or another lawful basis is required for its use in each jurisdiction and configure its consent management accordingly.
2.3 Local and session storage
The SDKs may copy attribution values to local storage and use local or session storage for cart synchronization, signup/order de-duplication, banners, and other short-lived state. Examples include keys beginning with rezfiliate_click_attempts_and integration-specific cart or event keys. Persistence varies by key and browser behavior. These technologies must be assessed under the same consent and disclosure rules as comparable cookies.
2.4 Server-side requests
The SDKs also send requests to Rezfiliate APIs for page visits, attribution, cart/order events, and conversion processing. A request is not itself a cookie, but it may include identifiers and request metadata such as IP address, user agent, referrer, and country. See the Privacy Policy for the applicable data practices.
3. Summary Table
| Technology | Purpose | Typical duration | Where used | Consent |
|---|---|---|---|---|
| NextAuth/session/OAuth cookies | Login, session integrity, CSRF and OAuth security | Session or up to approximately 30 days | Rezfiliate-controlled pages | Only where strictly necessary under applicable law |
| rezfiliate_click_id / ref_code and aliases | Referral attribution and conversion matching | Typically 30 days | Merchant storefront domains | Platform consent signal and Merchant's program setting; the Merchant remains responsible for applicable law |
| rezfiliate_consent (WooCommerce) | Stores the current tracking permission so WooCommerce checkout hooks apply the consent signal and program setting | Typically 30 days | Merchant storefront domains | Consent state only; it does not contain referral attribution data |
| localStorage/sessionStorage SDK keys | Attribution persistence, cart/event coordination, and de-duplication | Varies by key and browser | Merchant storefront domains | Platform consent signal and Merchant's program setting; the Merchant remains responsible for applicable law |
4. Merchant Responsibilities
Merchants are responsible for their own websites and storefront integrations. Before activating the SDK, each Merchant must assess applicable cookie, ePrivacy, data-protection, and consumer laws; give any required notice; obtain and record any required consent; and prevent non-exempt SDK code from running until the required consent or other lawful basis exists. Merchants must also explain the SDK technologies and the sharing of conversion data with Rezfiliate in their own notices.
Rezfiliate does not provide a universal consent banner. Its tracking SDKs check the program's EU/UK setting and use the platform's consent signal: Shopify's Customer Privacy API, BigCommerce's storefront cookie-consent signal, the WordPress Consent API in the WooCommerce plugin when a compatible CMP is installed, orRezfiliate.setConsent("granted"),Rezfiliate.setConsent("denied"), andRezfiliate.setConsent("unknown") for Stripe.js. When the EU/UK setting is enabled, attribution tracking waits for an allowed consent signal. When it is disabled, tracking continues unless the platform signal denies it. The setting does not configure or replace a Merchant's CMP. Merchants remain responsible for configuring their consent mechanism, determining which laws apply, and meeting their notice and consent obligations. Rezfiliate does not provide legal advice or guarantee that a Merchant's implementation is compliant.
5. Third-Party Technologies
Payment, authentication, hosting, storage, email, ecommerce, and other integration providers may process data or set technologies on their own domains when you interact with their services. Their own policies govern those technologies. Current categories include Stripe, authentication providers, Merchant ecommerce platforms, cloud storage, and email-delivery providers. The list may change; the Privacy Policy describes our principal service providers and disclosures.
The Rezfiliate SDK is designed to use API requests rather than intentionally placing advertising pixels or web beacons on Merchant storefronts. A Merchant's own code or third-party integrations may nevertheless use additional technologies outside Rezfiliate's control.
6. Managing Technologies
Browser controls can delete or block cookies and storage. Blocking authentication technologies may prevent login; blocking attribution technologies may prevent referral tracking or accurate commission attribution. Where a Merchant provides a consent-management tool, use that tool to change choices. Rezfiliate does not currently honor browser "Do Not Track" signals as a universal opt-out.
7. Changes to This Policy
We may update this Policy when technologies, laws, or the Service change. Updates will be handled under Section 14 of the Terms of Service and any consent or notice requirements imposed by applicable law. The "Last Updated" date identifies the current version.
8. Contact Us
Questions or privacy requests may be sent to us via our contact form.
- Postal Address (Canada): 271 Grey Silo Rd, Waterloo, ON N2K 0E9
- EU / UK Representative: Where required by applicable data protection law, Rezfiliate Inc. will appoint and maintain an EU and/or UK representative and provide the representative's contact details in this Privacy Policy.