DRAFT SKELETON. Headings and topics only. Every bracketed item is a placeholder for the legal team. Nothing in this draft is a legal statement until legal has reviewed it and the file says
status: published.
1. Who we are
[COMPANY LEGAL NAME], [REGISTERED ADDRESS] ("we", "us", "the Company") operates affy.ink and bffy.link (together, "the Services"). This policy applies to both Services.
[LEGAL: controller / processor roles, e.g. when a merchant or client app sends us data about its own users.]
2. Data we collect
- Account data: [LEGAL: e.g. name, email, organization, role]
- Sign-in data: [LEGAL]
- Payout and tax data: [LEGAL: e.g. payout account details, tax forms, identity verification files]
- Tracking data: [LEGAL: e.g. link clicks, referral codes, sub-IDs, IP address, user agent]
- Sale and commission data reported by merchants and client apps: [LEGAL]
- Support and contact messages: [LEGAL]
3. Purposes and legal bases
[LEGAL: purpose for each category above and the legal basis where required.]
4. Cookies and tracking
[LEGAL: which cookies, attribution windows, how to opt out.]
5. Service providers (processors)
The Services can use the following providers. [LEGAL: confirm which are enabled in production, their locations and the data each receives.]
- WorkOS: sign-in and user management
- Email delivery: NHN Cloud or Resend
- Vercel: hosting, and Vercel Blob for uploaded verification files
- Neon: hosted PostgreSQL database
- Payout providers, depending on the payout method chosen: Stripe Connect, PayPal, Wise, Tipalti, Trolley
- AI providers, only where the feature is enabled: Anthropic, OpenAI
6. Sharing
[LEGAL: sharing between merchants, affiliates, agencies and client apps; legal requests; business transfers.]
7. International transfers
[LEGAL]
8. Retention
[LEGAL: retention period per data category. Do not fill in periods without legal review.]
9. Your rights
[LEGAL: access, correction, deletion, objection, portability, how to make a request.]
10. Security
[LEGAL: summary of measures, without promises the product does not keep.]
11. Children
[LEGAL]
12. Changes to this policy
[LEGAL]
13. Contact
[COMPANY LEGAL NAME], [REGISTERED ADDRESS], [CONTACT EMAIL]