Privacy Summary

Here's a short overview of how Reditus handles your data. For the full picture, see how Reditus handles data privacy, our privacy policy and our DPA.

Where your data lives, and the documents behind it

• The production database and the application are hosted in the EU (Frankfurt and Nuremberg, Germany).
• Our Data Processing Agreement applies automatically to every customer through our Terms of Service, so there's nothing to sign. A pre-signed PDF is on the page; email privacy@getreditus.com for a countersigned copy.
• Every vendor that processes customer data is on our sub-processor list, and we give at least 30 days' notice before we add a new one.
• Our security overview and the Trust Center have the details.
• Reditus holds no GDPR certification and no security certification of its own. Our hosting providers hold theirs: Hetzner holds ISO/IEC 27001:2022, and Supabase holds SOC 2 Type 2 and ISO 27001.

What our tracking collects

Tracking script on your website

• When a visitor arrives through an affiliate or referral link, the script sets a first-party cookie that records that the visit came via an affiliate. It builds no visitor profile.
• Typically no cookie consent is needed for this cookie. This is based on the opinion of a Dutch lawyer and may not apply in every country (for example Germany), so check your own local regulations. More in why you typically don't need to ask for cookie consent.
• IP addresses are truncated at the point of collection, before anything is stored.

Signup snippet

• The snippet tells Reditus that a referred visitor signed up, with their email address or with your own unique ID for them.
• Affiliates never see the full email address of the people they referred. They see a masked version: the first letter, a row of stars and the domain.
• With UID tracking (no emails needed), you send your own account or organization IDs instead of email addresses. Combined with server-side tracking, no customer emails or visitor profiles reach Reditus, as long as payment data goes through the Payments API and the Stripe, HubSpot and Calendly integrations aren't connected. UID tracking is opt-in.

Payment data

• Stripe connects natively; any other payment processor sends payments through the Payments API. Reditus matches payments to referrals and creates commissions only for referred customers.
• Rather not give Reditus access to your Stripe account? With the Payments API you can first ask which referrals exist and send payment data only for those.

Privacy choices in the product

• There are no affiliate leaderboards, on purpose: a leaderboard would expose affiliates' personal information.
• Data is kept for the life of your account. After you stop using Reditus, the retention and deletion schedule in Annex A1 of the DPA applies.

Deleting your account and data requests

There's no delete button in the app yet. Ask for a human in the support chat and we'll delete your account for you; we don't give a fixed timeframe for a deletion. For formal data-protection requests, email privacy@getreditus.com. We acknowledge requests within 5 working days. Steps: how to delete your account.

Questions about your data

For privacy or security questions, a security questionnaire or a countersigned DPA, email privacy@getreditus.com. Want to be removed from the Affiliate Finder results? Email the same address, and we remove you.