Partner Privacy Notice
Draft, pending legal review.
1. Who is responsible
Laivisson OÜ, Karamelli tn 2, Pärnu mnt 139b, 11317 Harju maakond, Estonia, operator of Publisha AI, is the controller of the personal data described here. Contact us about privacy at [email protected].
This notice explains how we handle the data of partners and partner applicants. It supplements the Publisha AI Privacy Policy, which also applies, for example if you use Publisha AI as a customer.
2. What we collect
- Application and profile: name, email, password (stored only as a hash) or your Google sign-in, country, language, profile photo, the channels and links you give us, and the audience size you state.
- Tax and payout details: legal name, account type, tax ID, tax residence and billing address, and your payout method. Full bank account numbers are passed to our payment provider; the portal shows only the last digits.
- Referral activity: clicks on your links (time, page, device type, approximate location from the IP address), trials, payments of referred customers, commissions, bonuses and payouts.
- Security data: sign-in times, devices, IP addresses, two-factor settings, and confirmations of payout method changes.
- Communication: messages you send to the partner team and your notification preferences.
- Acceptance records: which version of the Partner Program Agreement you accepted, when, and from which IP address.
3. Why we use it and on what legal basis
- To run the Program (review your application, attribute referrals, calculate and pay commissions, send service emails): performance of our contract with you (GDPR Art. 6(1)(b)).
- To keep accounting and tax records of payouts: legal obligation (Art. 6(1)(c)).
- To prevent fraud and protect accounts (self-referral checks, sign-in alerts, the hold on payout changes): our legitimate interest in a secure, fair Program (Art. 6(1)(f)).
- To show you on the leaderboard with your first name and initial: our legitimate interest in motivating partners. You can opt out at any time in the portal.
- To send program news and, if you agree, to feature your content on our channels: your consent (Art. 6(1)(a)), which you can withdraw at any time.
4. Data about referred customers
We show you only what you need to follow your referrals: masked email addresses, plan, status and amounts. We never give partners full customer contact details.
5. Who we share it with
- Payment providers (Stripe, Wise) to pay you. They may verify your identity and keep records under their own legal obligations, as independent controllers.
- Service providers that host the portal and send email on our behalf, bound by data processing agreements.
- Google, only if you choose to sign in with Google.
- Advisers and authorities such as accountants, auditors, tax authorities or courts, where required by law or to defend legal claims.
We do not sell your data.
6. International transfers
We store partner data in the European Economic Area. Some providers, such as our payment providers, may process data outside the EEA. In that case we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses.
7. How long we keep it
- Profile and referral data: while you are a partner and for 3 years after you leave, so we can answer questions and claims about commissions.
- Payout, receipt and tax records: for 7 years after the end of the financial year, as required by Estonian accounting law.
- Detailed click data: 13 months, after which we keep only totals.
- Security logs: 12 months.
- Applications we decline: 6 months.
- Acceptance records: as long as the Agreement applies and for the limitation period afterwards.
8. Cookies and storage in the portal
The portal uses only what it needs to work: a session cookie to keep you signed in, and storage in your browser for your language and theme. We do not use advertising cookies in the portal.
9. Your rights
You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interest. Write to [email protected]; we reply within one month. Some data, such as payout records, we must keep even if you ask us to delete it.
You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority of your country. If you live in Türkiye, you can also exercise your rights under Law No. 6698 on the Protection of Personal Data (KVKK) by writing to the same address.
10. Security
We protect partner data with encryption in transit, access controls, optional two-factor authentication and email confirmation of payout changes. No system is completely secure; please use a strong password and turn on two-factor authentication.
11. Changes
We will publish any update to this notice in the portal and tell you by email about significant changes.