Rezfiliate Inc. (the "Company," "we," "us," or "our"), a corporation registered in Canada with its principal place of business at 271 Grey Silo Rd, Waterloo, ON N2K 0E9, provides an affiliate program management platform for online businesses and software-as-a-service (SaaS) providers ("Merchants") and their affiliate partners ("Affiliates"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our website, dashboard, and related services (collectively, the "Service"). It also clarifies our distinct roles as a Data Controller and Data Processor under applicable privacy laws, including the EU General Data Protection Regulation (GDPR) and the UK GDPR.

For Processor Data (Affiliates & Customers):

The Merchant, as Controller, determines the lawful basis and purposes for this processing. Rezfiliate processes this data under the Merchant's documented instructions to provide attribution, commission, payout, reporting, security, and related Service functions.

• To attribute referrals, calculate commissions, and route payouts ( as instructed by the Merchant).
• To generate analytics dashboards for Merchants ( as instructed by the Merchant).

For Controller Data (Merchant Accounts & Corporate Data):

• To operate, maintain, and secure our platform (Legitimate Interest) - specifically, to prevent fraud, abuse, and unauthorised access, and to improve the reliability and performance of our Service.
• To send service announcements and support communications ( Contractual Necessity).
• To comply with tax, anti-fraud, and regulatory obligations ( Legal Obligation).
• To obtain, use, or withdraw consent where applicable law requires consent for a particular processing activity.

We may use automated signals, including fraud scores or flags, to help protect the Service and review conversions. We do not intend to make solely automated decisions that produce legal or similarly significant effects on you without the safeguards required by applicable law.

We do not sell personal information. We may share information with:

• Merchants: Affiliate and conversion data is made available to the respective Merchant via their dashboard. Payout transaction details are also visible to both the Merchant and the Affiliate.
• Service providers and sub-processors: Stripe facilitates subscription billing, payment processing, connected accounts, transfers, and payouts. Hosting and database providers, object-storage providers, email-delivery providers, authentication providers, and Merchant integration providers may process information as needed to provide the Service. Current implementations include Hetzner, Backblaze B2, an SMTP/email provider, Google, Facebook, GitHub, Shopify, BigCommerce, WooCommerce, and Stripe, where a Merchant or user enables the applicable integration. The applicable DPA and subprocessor list govern processor relationships.
• Law Enforcement: Where required by applicable law or to protect our legal rights.

International Transfers: Rezfiliate and its providers may process information in Canada, the European Economic Area, the United Kingdom, the United States, and other countries where providers operate. Canada may benefit from an adequacy decision for certain commercial-organisation transfers under EU law, while UK coverage and any adequacy decision depend on the transfer and recipient. Where an adequacy decision does not apply, we will use an approved transfer mechanism, such as Standard Contractual Clauses or the UK International Data Transfer Addendum, together with any required transfer assessment and supplementary measures.

We maintain technical and organisational measures appropriate to the nature, scope, context, and risk of processing, including access controls, authentication, logging, backups, monitoring, and incident response processes as appropriate to the Service. No method of storage or transmission is completely secure, and our security practices may change as the Service and risks evolve. Access is limited to personnel and providers who need it for authorized purposes.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and processed, including providing and securing the Service, maintaining transaction and commission records, preventing fraud and abuse, resolving disputes, complying with legal and regulatory obligations, and establishing, exercising, or defending legal claims.

We maintain data-retention practices that distinguish between personal data and business, transaction, financial, and security records. Retention periods are determined based on the purpose of processing, applicable legal and regulatory requirements, contractual obligations, and legitimate operational needs. When personal data is no longer required, we will delete or anonymize it, subject to any legal or regulatory obligation requiring continued retention. Where a specific retention period cannot reasonably be stated, we identify the criteria used to determine how long the information will be retained.

• Processor Data: Retained for as long as the Merchant maintains an active account or as required for the purposes collected. Upon termination, deleted or anonymized unless retention is required by law or legitimate business/transaction record needs.
• Operational event data: Click records and webhook delivery records are currently subject to automated cleanup processes targeting approximately 30 days, while some notification records are targeted for shorter retention. Cleanup may not remove backups, aggregated data, dispute records, or information that must be retained for legal, security, payment, or accounting reasons.
• Controller Data: Merchant account and billing records are retained for up to seven (7) years after the end of the contractual relationship to comply with tax and financial reporting obligations.

Depending on your jurisdiction (including EU/UK and California), you may have the following rights regarding your personal data:

• Right to access and obtain a copy of your data.
• Right to rectify inaccurate data.
• Right to erasure ("right to be forgotten").
• Right to restrict or object to processing.
• Right to data portability (receive your data in a structured, machine-readable format).
• Right to opt-out of the "sale" or "sharing" of your personal information (California Consumer Privacy Act). We do not sell your personal data.
• Right to withdraw consent at any time, where we rely on consent as the lawful basis (e.g., for optional analytics cookies).
• Right to lodge a complaint with a supervisory authority in your country of residence (e.g., the ICO in the UK or your local EU data protection authority).
• If Canadian privacy law applies, you may also complain to the applicable provincial privacy commissioner or the Office of the Privacy Commissioner of Canada after giving us a reasonable opportunity to address your concern.

To exercise these rights, please contact us via our contact form. If you are a customer of a Merchant and your data was processed via our platform, please direct your request to the respective Merchant first, as they are the Data Controller for your information. We will respond to all valid requests within the timeframes required by applicable law (generally 30 days).

If you are a California resident and the CCPA/CPRA applies to our business or the relevant processing, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) may grant you additional rights:

• Right to know what personal information we collect, use, disclose, and sell.
• Right to delete your personal information (subject to exceptions).
• Right to correct inaccurate personal information.
• Right to opt-out of the sale or sharing of your personal information for cross-context behavioural advertising.
• Right to limit the use of sensitive personal information where that right applies.
• Right to non-discrimination for exercising your rights.

We do not sell or share your personal information with third parties for their own direct marketing purposes. Where required, we provide a notice at collection and maintain any required disclosures for the applicable twelve-month period. To exercise your California rights, please contact us via our contact form. We will respond within 45 days as required by law.

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us via our contact form, or at:

• Postal Address (Canada): 271 Grey Silo Rd, Waterloo, ON N2K 0E9
• EU / UK Representative: Where required by applicable data protection law, Rezfiliate Inc. will appoint and maintain an EU and/or UK representative and provide the representative's contact details in this Privacy Policy.