Data & privacy (GDPR)

The short version

Everything runs on your server — no external tracking service, no data sent to us or anyone else, no per-referral phone-home. That single fact removes most of the privacy paperwork that SaaS affiliate platforms create: there's no platform subprocessor to name, no international transfer to justify.

What the plugin stores, and how

• Visitors: referral cookies are first-party and signed; IP addresses are truncated and hashed before storage — the raw IP is never written to the database. Visit rows honor your retention windows and are cleaned up automatically.
• Affiliates: the account data they submit (name, email, your custom application fields) plus their referral and payout history — data you need to run the contract you have with them.
• Customers: referrals reference orders; the plugin doesn't build customer profiles.

Your controls

Under Settings → Data & privacy: retention windows for visit and tracking data, and consent gating so tracking only runs after your consent tool says yes. Developers get surgical control via the afwp_tracking_allowed filter — return false and nothing is set or recorded for that visitor.

Rights requests

The plugin integrates with WordPress's built-in personal-data tools (Tools → Export Personal Data / Erase Personal Data), so an affiliate's data rights request is handled through the same flow as the rest of your site.

Paperwork

You still have a program to document: add the affiliate program to your privacy policy and records of processing — what you process (affiliate contact and payment details, referral records, hashed visit data), why (running the program, paying commissions, preventing fraud), and how long (your retention settings). The walkthrough with wording suggestions is in GDPR-compliant affiliate tracking — and as with everything legal, have counsel confirm your specifics.