Privacy Policy
Last updated: February 4, 2026
1. Introduction
Komissio, Inc. ("Komissio," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our affiliate tracking and payout management platform (the "Service"), including our website, applications, and related services.
This Privacy Policy applies to all users of the Service, including merchants who create affiliate programs and affiliates who participate in those programs. By accessing or using the Service, you agree to the terms of this Privacy Policy. If you do not agree with our policies and practices, please do not use the Service.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect. We encourage you to review this Privacy Policy periodically to stay informed about our information practices.
2. Information We Collect
2.1 Information You Provide Directly
When you register for an account, we collect information that you voluntarily provide to us:
- Account information: Your email address, name, company name (for merchants), display name, and password
- Profile information: Business details, company logo, website URL, and preferred communication settings
- Payment information: Bank account details for receiving payouts, cryptocurrency wallet addresses (if applicable), tax identification numbers, and billing addresses
- Business configuration: Commission structures, tracking domains, coupon codes, payout thresholds, and affiliate program settings
- Communications: Information you provide when you contact our support team, respond to surveys, or participate in promotions
2.2 Information Collected Automatically
When you access or use the Service, we automatically collect certain information:
- Usage data: Pages visited, features used, actions taken, time spent on pages, and navigation patterns within the Service
- Device information: Browser type and version, operating system, device type, screen resolution, and unique device identifiers
- Network information: IP address, internet service provider, and general geographic location (city/region level)
- Tracking data: Referral sources, conversion events, click timestamps, attribution data, and customer journey information
- Log data: Server logs that record requests made to our servers, including timestamps, URLs, and response codes
2.3 Information from Third Parties
We receive information about you from third-party services:
- Stripe: When merchants connect their Stripe accounts, we receive subscription data, payment event information, and customer identifiers necessary for commission tracking
- Google: If you use Google Sign-In, we receive your Google account email, name, and profile picture
- Merchant platforms: In enterprise mode, we may receive conversion and transaction data from integrated e-commerce platforms, CRM systems, or custom integrations
- Analytics providers: We use third-party analytics services that provide aggregated insights about Service usage
2.4 Sensitive Information
We do not intentionally collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data. If you are an affiliate, please do not include such information in your profile or communications with merchants through our platform.
3. How We Use Your Information
We use the information we collect for the following purposes:
3.1 Providing and Improving the Service
- Create and manage your account
- Track affiliate referrals and calculate commissions accurately
- Process payouts and maintain transaction records
- Enable communication between merchants and affiliates
- Provide customer support and respond to inquiries
- Analyze usage patterns to improve features and user experience
- Develop new products, services, and features
3.2 Security and Fraud Prevention
- Detect, investigate, and prevent fraudulent transactions and abuse
- Monitor for suspicious activity and unauthorized access
- Verify affiliate conversions and prevent click fraud
- Enforce our Terms of Service and other policies
- Protect the rights, property, and safety of our users and the public
3.3 Communications
- Send transactional emails about your account, payouts, and commission updates
- Deliver service announcements, updates, and security alerts
- Send marketing communications (with your consent, where required)
- Respond to your comments, questions, and support requests
3.4 Legal Compliance
- Comply with applicable laws, regulations, and legal processes
- Respond to lawful requests from public authorities
- Meet financial reporting and tax obligations
- Establish, exercise, or defend legal claims
4. Data Sharing and Disclosure
We may share your information in the following circumstances:
4.1 Between Merchants and Affiliates
The nature of our Service requires sharing certain information between merchants and affiliates in their program. Merchants can see affiliate performance data (clicks, conversions, commissions), while affiliates can see program details and their earnings. We only share information necessary for the affiliate relationship to function.
4.2 Service Providers
We work with third-party service providers who perform services on our behalf:
- Payment processors: Stripe for payment processing and connected accounts
- Cloud infrastructure: Hosting, storage, and computing services
- Analytics: Usage analytics and performance monitoring
- Email delivery: Transactional and marketing email services
- Customer support: Help desk and support ticket systems
These providers are contractually obligated to protect your information and may only use it to provide services to us.
4.3 Legal Requirements
We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas, or government agency requests). We may also disclose information when we believe disclosure is necessary to protect our rights, investigate fraud, or protect the safety of our users or others.
4.4 Business Transfers
If Komissio is involved in a merger, acquisition, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our Service of any change in ownership or uses of your personal information.
4.5 With Your Consent
We may share your information for other purposes with your explicit consent.
5. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our security measures include:
- Encryption: All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption
- Password security: User passwords are hashed using bcrypt with appropriate salt rounds; we never store plaintext passwords
- Access controls: Role-based access controls limit employee access to personal data on a need-to-know basis
- Infrastructure security: Our infrastructure is hosted on secure cloud platforms with SOC 2 Type II certification
- Monitoring: We continuously monitor our systems for security threats and vulnerabilities
- Security audits: Regular third-party security audits and penetration testing
- Incident response: We maintain an incident response plan to address potential security breaches promptly
While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to maintaining the highest practical standards.
6. Data Retention
We retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specific retention periods include:
- Active accounts: We retain your data for as long as your account is active and for a reasonable period afterward in case you decide to reactivate
- Transaction records: Commission and payout records are retained for a minimum of 7 years to comply with financial reporting and tax regulations
- Tracking data: Conversion and attribution data is retained for 3 years from the date of the conversion for audit and dispute resolution purposes
- Support communications: Customer support tickets and related communications are retained for 3 years
- Deleted accounts: When you delete your account, we will delete or anonymize your personal data within 90 days, except for data we are required to retain for legal or regulatory purposes
7. Your Privacy Rights
Depending on your location, you may have certain rights regarding your personal data. These rights may include:
7.1 General Rights
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Deletion: Request deletion of your personal data, subject to legal retention requirements
- Portability: Request a copy of your data in a structured, machine-readable format
- Objection: Object to certain processing of your data
- Restriction: Request restriction of processing in certain circumstances
- Withdraw consent: Withdraw consent at any time where we rely on consent for processing
7.2 California Residents (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to know what personal information is collected, used, shared, or sold
- Right to delete personal information held by businesses
- Right to opt-out of the sale or sharing of personal information
- Right to non-discrimination for exercising your privacy rights
- Right to correct inaccurate personal information
- Right to limit use of sensitive personal information
We do not sell personal information as defined under the CCPA/CPRA.
7.3 European Economic Area Residents (GDPR)
If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR). Our legal bases for processing include contract performance, legitimate interests, legal obligations, and consent. You also have the right to lodge a complaint with your local data protection authority.
7.4 Exercising Your Rights
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days (or sooner if required by applicable law). We may need to verify your identity before processing your request.
9. International Data Transfers
Komissio is headquartered in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.
When we transfer personal data from the EEA, UK, or Switzerland to countries that do not have adequate data protection laws, we use appropriate safeguards such as:
- Standard Contractual Clauses approved by the European Commission
- Data Processing Agreements with all service providers
- Binding Corporate Rules where applicable
- Certification under recognized frameworks (e.g., EU-U.S. Data Privacy Framework)
10. Children's Privacy
The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected]. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information as quickly as possible.
11. Third-Party Links and Services
The Service may contain links to third-party websites, services, or applications that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services before providing them with your personal information.
When you connect third-party services to your Komissio account (such as Stripe), those services' privacy policies also apply to the data they collect.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Notify you by email (to the address associated with your account)
- Display a prominent notice within the Service
Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy. If you do not agree with the changes, you should stop using the Service and delete your account.
13. Contact Us
If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:
Komissio, Inc.
Email: [email protected]
Address: 123 Business Street, Suite 100
San Francisco, CA 94105
United States
Data Protection Officer: [email protected]
We aim to respond to all privacy-related inquiries within 30 days. For EEA residents, you also have the right to lodge a complaint with your local supervisory authority.