Privacy Policy

Who is responsible for your data

The data controller is [Legal entity], [Address], registration number [Registration number]. For questions about data, write to [Email for data requests].

[If a DPO is appointed: the data protection officer's contact details.]

What data we process

• Store or advertiser account: name, email, password hash, company name.
• Payment details for payouts: payee and IBAN.
• Site data: store URL, site key, and the catalog snapshot used for AI analysis (categories, product titles, prices).
• Statistics: impressions, clicks, and conversions by offer, linked to the store, with no data about the shopper.
• Technical data of site and dashboard visitors: session cookies, server logs [to confirm: what is written to the logs and for how long].

Data of store shoppers

The ThanklyClub plugin does not send us shoppers' names, emails, addresses, or phone numbers. To pick gifts, the server receives the product categories in the order, product titles (unless the store turned this off in settings), an order total range, currency, country, site language, and a returning-customer flag.

When a shopper clicks a gift, we record the click, the offer, and the placement, and we pass the partner a technical click identifier. No personal data of the shopper is passed to the partner. Once on the partner's site, the partner's own data processing rules apply.

The store is responsible for its shoppers' data. We recommend that the store mention ThanklyClub in its own privacy policy as a partner-offers service.

Purposes and legal bases

• Registration and operation of the dashboard: performance of a contract (Art. 6(1)(b) GDPR).
• Choosing gifts, recording impressions, clicks, and conversions, earnings, and payouts: performance of a contract.
• Accounting and tax records: legal obligation (Art. 6(1)(c)).
• Fraud and click-inflation prevention, security of the service: legitimate interest (Art. 6(1)(f)).
• Service emails about the dashboard and earnings: performance of a contract. Marketing emails: only with consent (Art. 6(1)(a)).

Who we share data with

• Google Cloud (Vertex AI): AI analysis of the store catalog. Only the catalog snapshot is sent, with no shopper data.
• Resend: sending service emails.
• [Hosting provider]: hosting of the server and data.
• [Bank / payment provider]: SEPA payouts.
• Google Fonts: loading fonts on the website; your browser sends Google your IP address [to confirm: keep this or serve the fonts from our own server].
• Public authorities: only where the law requires it.

Transfers outside the EU

If a provider processes data outside the European Economic Area, we rely on a European Commission adequacy decision or Standard Contractual Clauses (SCCs). [To confirm for each provider: storage region and transfer mechanism.]

How long we keep data

• Account data: while the account is active and for [Period] after it is closed.
• Earnings and payout data: as long as tax law requires, [Period].
• Impression and click statistics: [Period].
• Server logs: [Period].

Your rights

You can request access to your data, correct it, delete it, restrict its processing, receive it in a machine-readable format, and object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time.

Send requests to [Email for data requests]. We respond within one month. You also have the right to lodge a complaint with a supervisory authority: [Supervisory authority, for example the AEPD in Spain].

Changes

We will update this page if our data processing changes. We will notify account owners by email of material changes. Last updated: [Date].

FAQ