Privacy policy

Data controller

The data controller for personal data is AVLF OÜ, 5 Narva mnt, 10117 Tallinn, Estonia. Contact: team@onlyaffiliates.app.

Data collected

Identity and contact details provided at signup (name, email, phone, contact handles).

Bank details, encrypted (IBAN), to pay out commissions.

An identity document, to manually review the application.

Connection logs (IP address, timestamp).

Purposes

Managing signup and access to the affiliate program.

Attributing sales to tracking links and calculating commissions owed.

Paying out commissions and keeping the related accounting records.

Preventing fraud and keeping accounts secure.

Legal basis

Performance of the contract that binds you to the platform, for account management and commission payouts.

A legal obligation, for keeping accounting records.

The platform's legitimate interest, for fraud prevention and for matching a referral to their referrer by network fingerprint.

Recipients

Your data is shared with the following processors, strictly to the extent their role requires it: Vercel (hosting), Supabase (database, authentication, storage), Resend (email delivery), Sentry (error monitoring), Upstash (rate limiting), Cloudflare R2 (encrypted backup storage), Telegram (internal security alerts to the platform, which can include your name or email and your IP address).

No data is sold, or shared for advertising purposes.

Retention periods

Identity documents are deleted 30 days after the account is approved, or 30 days after the application is submitted, if it is rejected.

Connection logs are kept for as long as the account exists, and deleted when the account is deleted.

The network fingerprint used to match a referral to the person who referred them is kept for 30 days, then deleted automatically.

Accounting records (payments, commissions, withdrawals) are kept for seven years from the end of the financial year in which the transaction was recorded, as required by the Estonian Accounting Act (raamatupidamise seadus § 12), even after an account is deleted.

Cookies

A cookie named oa_ref keeps, for one year, the referral code of the first link clicked, to attribute a referred affiliate to the one who referred them. The same information is also kept in your browser's local storage (localStorage and sessionStorage), as a backup if the cookie is removed: under ePrivacy rules, this is the same category of storage on your device.

The tracking link to an OnlyFans account also uses a cookie of OnlyFans' own, to attribute a sale to the first link clicked. Its duration is not disclosed by OnlyFans.

Your rights

You have the right to access, correct, erase and receive a copy of your data.

These rights are exercised from your profile, in the "Danger zone" section: you can download a PDF export of your data there and request the deletion of your account.

Deleting an account anonymizes your personal data (IBAN, contact details, identity document) rather than erasing it outright, since payments already made must stay linked to an accounting record for seven years, as required by the Estonian Accounting Act.

You can also write to us directly: team@onlyaffiliates.app.

Contact

For any question about your data: team@onlyaffiliates.app.