GDPR, CCPA & PII: How Reditus Handles Data Privacy

Data privacy is a top concern for B2B SaaS companies, especially those operating in the EU or serving EU customers. Reditus is built with privacy compliance as a core requirement, not an afterthought.

GDPR Compliance

What Data Reditus Collects

Reditus collects the minimum data necessary for affiliate tracking and commission attribution. This includes:

• Click data (timestamp, referring URL, affiliate ID)
• Signup information (email address used to create the account)
• Subscription data from Stripe (plan, amount, status)
• IP addresses for fraud prevention

Lawful Basis for Processing

Reditus processes data under the legitimate interest basis for the SaaS company's business need to track affiliate referrals and calculate commissions.

For cookie-based tracking: the Reditus cookie only records whether a signup came via an affiliate. It does not build a visitor profile, so no cookie consent is required for it (see the cookie section below).

Data Processing Agreement (DPA)

Reditus provides a Data Processing Agreement that covers the relationship between your company (the data controller) and Reditus (the data processor). The DPA outlines:

• What data is processed
• How and where it is stored
• Retention periods
• Security measures
• Your rights and obligations as the controller

Data Subject Rights

Reditus supports standard GDPR data subject rights, including:

• Right of access – individuals can request a copy of the data held about them
• Right to erasure – personal data can be deleted on request, subject to legal retention requirements
• Right to rectification – incorrect or outdated data can be corrected
• Right to data portability – data can be exported in a structured, commonly used format

Requests can be initiated via your Reditus account or by contacting support.

CCPA Compliance

For companies serving California residents, Reditus supports CCPA requirements by:

• Providing notice of data collection and the categories of data processed
• Honoring “Do Not Sell My Personal Information” choices where applicable
• Allowing consumers to request access to and deletion of their personal data, subject to legal and accounting obligations

Reditus does not sell personal information in the sense defined by CCPA; data is used only to provide and improve the affiliate tracking service.

PII Protection

What PII Is Stored

Reditus stores limited personally identifiable information (PII) necessary for affiliate tracking and payouts, including:

• Email addresses (for matching referrals to signups and account communication)
• Names (from affiliate profiles and account owners)
• Payment-related information (processed via Stripe or payout providers; sensitive card data is not stored by Reditus)
• IP addresses (for fraud detection and security, stored temporarily)

How PII Is Protected

• All data is encrypted in transit (TLS 1.2+) and at rest
• Access to PII is restricted to authorized personnel and systems on a need-to-know basis
• Logging and monitoring are in place to detect suspicious access patterns
• Reditus does not sell or share PII with third parties beyond what is necessary to provide the service (e.g., infrastructure, payment processing)

PII in Affiliate Tracking

Reditus uses first-party cookies for tracking, not third-party cookies. This approach is more privacy-friendly and more resilient as browsers phase out third-party cookies.

The tracking cookie contains only an affiliate identifier and technical metadata required for attribution. It does not store names, emails, or other directly identifying information.

Privacy-Friendly UID Tracking (Zero PII)

For companies that prefer not to share any PII with Reditus at all, Reditus supports privacy-friendly UID tracking: you send unique account IDs instead of email addresses, and payments are matched via the API on those IDs. This way, zero PII ends up in Reditus.

Do You Need Cookie Consent for Reditus?

No. The Reditus tracking cookie is a first-party cookie that records one thing: whether a signup came via an affiliate, so the referral can be attributed correctly. It does not build a visitor profile and does not store names, email addresses, or browsing behavior. Because of this, no cookie consent is required for the Reditus cookie.

If you prefer, you can still list the Reditus cookie in your cookie policy for transparency, but it does not need a consent banner.

Data Retention

Reditus retains affiliate tracking data for:

• The duration of the affiliate relationship, plus
• A reasonable period for commission reconciliation, dispute handling, and tax/accounting obligations

Click and conversion data is retained in line with your program's cookie duration and commission qualification period.

You can request deletion of personal data at any time via your account settings or by contacting support. Some data may be retained in anonymized or aggregated form, or where required by law.

Sub-Processors

Reditus uses a limited number of sub-processors for infrastructure, analytics, and payment-related services. These may include hosting providers, email delivery services, and payment processors.

The current list of sub-processors is maintained in the DPA or a dedicated sub-processor page and is updated when changes occur. Where required by GDPR, you will receive advance notice of material changes so you can object or terminate if necessary.

For Affiliates: Your Data Rights

As an affiliate using Reditus:

• Your profile data, commission history, and performance metrics are stored in the platform
• You can access and update your profile information directly in your affiliate portal
• You can export relevant performance and commission data for your own records
• You can request deletion of your account and associated personal data, subject to legal and accounting retention requirements

Payment information used to receive commissions is processed securely by the payout provider (e.g., Stripe or other payment services) and is not stored by Reditus in full. Only the minimum necessary references or tokens are stored to manage payouts securely.

If you have questions about how your data is handled, you can contact Reditus support or your program owner for more details on data processing and privacy controls.