Privacy Policy

Last Updated: June 7, 2026  ·  Effective Date: January 15, 2026

1. Who We Are

AffiliateReel, Inc. is a Delaware corporation with offices at 13428 Maxella Ave, Suite 224, Los Angeles, CA 90094. We are the "controller" of personal data processed under this Policy. For Stripe payment processing and Plaid bank verification (where applicable), the third-party service is a "processor" or independent controller under its own terms.

2. Age Restriction (COPPA)

AffiliateReel is not directed to children under 18. We do not knowingly collect personal information from anyone under the age of 18. If you are under 18, do not use the Services or submit any information to us. If we learn that we have collected personal information from a person under 18, we will delete it promptly. Parents or guardians who believe their child has provided us information may contact [email protected].

3. Information We Collect

4. How We Use Information

• Provide, maintain, and improve the Services;
• Authenticate users and prevent fraud or abuse;
• Process payments and issue refunds via Stripe and other processors;
• Send transactional emails (magic-link sign-in codes, receipts, security notices);
• Comply with legal obligations and enforce our Terms.

Legal bases (GDPR / UK GDPR): contract performance, our legitimate interests in operating the Services securely, your consent (for marketing emails), and legal obligations.

5. How We Share Information

We share personal information only with:

• Service providers acting as data processors (Stripe, Plaid, Resend, AWS, Google Cloud, etc.) under contractual confidentiality obligations;
• Brands and partners, only with creator-aggregated, masked, or pseudonymous data unless the creator explicitly opts in to share their identity for a specific campaign;
• Authorities, where required by valid legal process and in our reasonable judgment.

We do not sell personal information as that term is defined by CCPA / CPRA. We do not share personal information for cross-context behavioral advertising.

6. Data Processor Language for Integrations

Where AffiliateReel processes personal data on behalf of a brand or business customer (e.g. clicks attributed to a brand's campaign), AffiliateReel acts as a "processor" under GDPR / UK GDPR and a "service provider" under CCPA / CPRA. We process such data only on documented instructions from the controller and maintain appropriate technical and organizational security measures. A Data Processing Addendum (DPA) is available on request at [email protected].

7. International Data Transfers

AffiliateReel is based in the United States. If you access the Services from outside the U.S., your information will be transferred to and processed in the U.S. For transfers from the European Economic Area, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum.

8. Your Rights

8.1 California Residents (CCPA / CPRA)

You have the right to:

• Know what personal information we collect, use, disclose, and share;
• Request deletion of your personal information;
• Request correction of inaccurate information;
• Limit use of "sensitive" personal information;
• Opt out of "sale" or "sharing" (we do neither);
• Non-discrimination for exercising any of the above.

8.2 EU / UK / Swiss Residents (GDPR / UK GDPR)

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to lodge a complaint with your local supervisory authority.

8.3 How to Exercise Your Rights

Send a request to [email protected]. We will verify your identity through your account email and respond within 45 days (CCPA) or 30 days (GDPR). You may authorize an agent to act on your behalf with appropriate written authorization.

9. Cookies & Tracking

We use session cookies to keep you signed in. We use minimal first-party analytics cookies (no cross-site tracking). We do not use third-party advertising cookies. You can disable cookies in your browser, but some features of the Services may not function.

9.5 Browser Extension ("AffiliateReel Companion")

Our optional Chrome browser extension, AffiliateReel Companion, helps you sync your Amazon storefront, view matching brand briefs, and track earnings. It operates under the following boundaries:

• Page content access. The extension reads page content only on Amazon pages — your storefront (amazon.com/shop/*), product detail pages (amazon.com/dp/*), and the Amazon Associates / Creator Connections site (affiliate-program.amazon.com) — to identify the ASINs and videos you publish, public product details (title, category, ranking), and Creator Connections campaigns available to you. It does not read content on any other site.
• Creator Connections (Amazon Associates). Using your own logged-in Amazon Associates session in your browser, the extension checks whether a product you are viewing has an active Amazon “Creator Connections” campaign and shows its commission rate and end date. Only when you explicitly click “Accept” does it submit an enrollment request for that campaign on your behalf, via affiliate-program.amazon.com. These actions are initiated by you and run under your own Amazon login; the extension never asks for or stores your Amazon password and does not collect your Amazon account data.
• Data sent to us. When you click "Sync," the extension sends your storefront's public ASINs, video IDs, thumbnails, and durations to affiliatereel.com under your authenticated API key. When you generate an affiliate link or post captions for a product, it also sends that product's public identifier (ASIN, title, URL) to affiliatereel.com to create the tracking link and AI-generated captions. No private Amazon account data (orders, payment methods, addresses) is read or transmitted.
• Browsing history. We do not collect, log, or transmit your browsing history outside Amazon storefront pages. The extension does not track which other websites you visit.
• API key. Authentication uses a per-creator API key you generate from your AffiliateReel dashboard and paste into the extension. The key is stored locally in chrome.storage.local and can be revoked at any time from your dashboard.
• Permissions. The extension requests only the minimum Chrome permissions required: storage (to remember your API key), notifications (to alert you about new briefs), alarms (to schedule background polling), and host access to affiliatereel.com, Amazon storefront and product pages, and affiliate-program.amazon.com (for Creator Connections, as described above).
• Uninstall. Removing the extension deletes the locally-stored API key and stops all polling. Any data already synced to AffiliateReel remains under the standard terms of this policy and your account, and can be deleted via the "Your Rights" section above.

10. Security

We implement reasonable technical and organizational measures designed to protect your personal information, including TLS in transit, encrypted database backups, principle-of-least-privilege access controls, and short-lived authentication tokens. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

11. Retention

We retain account data for the life of your account and for up to 30 days after deletion. Usage logs are retained for up to 18 months. Financial records are retained for 7 years to comply with U.S. tax law. Backup copies may persist longer in encrypted, access-restricted storage.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. We will notify you of material changes by email or through the Services at least 14 days before the changes take effect.

13. Contact

Questions or requests regarding privacy? Contact us at:

AffiliateReel, Inc. — Attn: Privacy Officer
13428 Maxella Ave, Suite 224
Los Angeles, CA 90094, United States
Email: [email protected]

EU / UK data subjects who are not satisfied with our response may lodge a complaint with their local data protection authority (e.g. the UK Information Commissioner's Office at ico.org.uk, or the relevant EU member-state regulator).