GDPR, CCPA & PII: How Reditus Handles Data Privacy

When you run an affiliate or in-app referral program on Reditus, some data about your visitors, customers and affiliates passes through us. This page explains what we process, where it lives and which measures we have in place, with links to the documents your privacy or procurement team will ask for.

The short version

• Roles: for your program data (your affiliates, your referred leads and customers, and your team's users) you are the controller and Reditus is the processor. For affiliates who register in the Reditus network and marketplace, Reditus is an independent controller.
• Data Processing Agreement: our DPA applies automatically to every customer through our Terms of Service, so there's nothing to sign. A pre-signed PDF is on the page. Need a countersigned copy? Email privacy@getreditus.com.
• Hosting: the production database and the application are hosted in the EU (Frankfurt and Nuremberg, Germany).
• Sub-processors: every vendor that processes customer data is on our sub-processor list. We give at least 30 days' notice before we add a new sub-processor of customer data.
• More detail: our security overview and the Trust Center, which covers the GDPR details.

What data Reditus processes

• Clicks: when a visitor arrives through an affiliate or referral link, our tracking script sets a first-party cookie that records that the visit came via an affiliate. It builds no visitor profile.
• Signups: the signup snippet tells Reditus that a referred visitor registered, with their email address or with your own unique ID for them.
• Payments: payment data from your Stripe connection or the Payments API, which Reditus matches to referrals to calculate commissions.
• IP addresses: truncated at the point of collection, before anything is stored. An IPv4 address loses its last block, and an IPv6 address is cut to a /40 prefix.
• Affiliates: affiliates' profiles and the payout details they enter, such as a PayPal email address or an IBAN for bank or Wise payouts. Reditus needs these to pay them.
• What affiliates see about referred people: never the full email address. Affiliates only see a masked version: the first letter, a row of stars and the domain.
• Your team: the users on your account and their login details.
• The Affiliate Finder: it shows publicly available information about potential affiliates. Not every result comes with contact details; where it does, the email address comes from Hunter. Reditus provides that data; how you use it, for example how you contact the people you find, is your own responsibility under the GDPR. Anyone who wants to be removed from the Finder results can email privacy@getreditus.com, and we remove them.

Keep customer emails out of Reditus: UID tracking

With UID tracking (no emails needed), you send your own account or organization IDs instead of email addresses. Reditus matches referrals and payments on those IDs, and commissions and reporting work as usual. Combined with server-side tracking, no customer emails or visitor profiles reach Reditus.

That last part holds when your payment data goes through the Payments API and the Stripe, HubSpot and Calendly integrations aren't connected, because each of those brings the email address to Reditus on its own.

A few things to know:

• UID tracking is opt-in. Without it, the referred person's email address is sent for attribution.
• An ID is pseudonymous, not anonymous: you can link it to a person, so it still counts as personal data.
• Prefer not to give Reditus access to your Stripe account at all? Send payments through the Payments API instead. You can even ask first which referrals exist and send payment data only for those.

Cookies and consent

Typically no cookie consent is needed for the Reditus cookie: it only records whether a signup came via an affiliate and builds no visitor profile. This is based on the opinion of a Dutch lawyer and may not apply in every country (for example Germany), so check your own local regulations. The reasoning is in why you typically don't need to ask for cookie consent.

Whatever your local rules say, inform visitors about the cookies you use, for example in your cookie policy. Our cookie policy lists the cookies the Reditus tracking script can set on your website. And if your consent banner holds back the Reditus script until a visitor accepts, the cookie isn't set for visitors who decline, so their signups can't be credited to an affiliate.

How long data is kept

• Click, referral and lead records are kept for the life of your account, because your referral and commission reporting depends on them, and they're deleted with the account.
• After a customer stops using Reditus, there's a 60-day window to export the data, followed by deletion within a 120-day longstop, or earlier on request. The binding schedule per data category is in Annex A1 of the DPA.
• Database backups are daily snapshots with a 7-day rollback window.

Deleting your account and other data requests

There's no delete button in the app yet. Ask for a human in the support chat and we'll delete your account for you; we don't give a fixed timeframe for a deletion. Steps: how to delete your account.

For formal data-protection requests, for example to access or erase personal data, email privacy@getreditus.com. We acknowledge requests within 5 working days. Your rights are described in our privacy policy.

Security measures

• The production database and the application run in the EU, at Supabase (Frankfurt) and Hetzner (Nuremberg).
• Reditus holds no security certification of its own; our hosting providers do. Hetzner holds ISO/IEC 27001:2022, and Supabase holds SOC 2 Type 2 and ISO 27001.
• Passwords are stored only as bcrypt hashes in our own database, and login sessions last two weeks.
• There are no affiliate leaderboards in Reditus, on purpose: a leaderboard would expose affiliates' personal information.

The full overview is on our security page.

What about the CCPA?

For questions about the CCPA or other US privacy laws, for example in a security questionnaire, email privacy@getreditus.com or ask for a human in the support chat.

For affiliates

• Reditus stores your profile and the payout details you enter (your PayPal email address, or your IBAN for bank or Wise payouts), so we can pay you.
• For your account in the Reditus network, Reditus is the controller of your data. For a program you join, the SaaS company that runs it is the controller of that program's data.
• There's no delete button in the app. Ask a human in the support chat to delete your account, or email privacy@getreditus.com for a formal data-protection request.

Questions about your data? Email privacy@getreditus.com.