HELLO SAFE (hereinafter "HelloSafe", "we") attaches particular importance to the protection of your personal data. This policy describes the processing operations we carry out on your data in the context of the HelloSafe partner program.

1. Data Controller

The data controller is HELLO SAFE, whose contact details are available in our legal notice.

2. Data Collected and Purposes

We process the following categories of data:

• Registration data (email address, name, hashed password, company name, website, audience, country): to create and manage your partner account. Legal basis: performance of the contract.
• Profile data (logo, tagline, persona): for the personalization of your partner space and the Coach deliverable. Legal basis: performance of the contract.
• Affiliate tracking data (hashed IP address, user agent, referrer, approximate country): to measure clicks on your tracking links. IP addresses are never stored in plain text. Only their salted SHA-256 hash is retained. Legal basis: legitimate interest in measuring program activity.
• Conversion data (amount, commission, external order identifier, status): to calculate your commissions. Legal basis: performance of the contract.
• Coach analytics data (client reference, age bracket, destination, etc.): to generate the coverage analyses you provide to your clients. Legal basis: performance of the contract.

3. Sub-processors

We use the following sub-processors, all of whom are contractually committed to comply with applicable data protection laws, including the GDPR:

• Cloudflare, Inc. (United States): hosting, CDN, and serverless function execution. Transfer outside the EU is governed by standard contractual clauses.
• Supabase, Inc. (United States; database and authentication hosted within the European Union): PostgreSQL database, account management, and authentication.
• Resend Inc. (United States): transactional emails.
• Google LLC: optional authentication via OAuth 2.0 (only if you choose "Sign in with Google").
• PostHog: product analytics, configured in cookieless mode; no session recording is performed.

4. Retention Periods

• Partner account: for the duration of the relationship, plus 3 years after the last activity (commercial limitation period).
• Connection logs and tracking data: 13 months.
• Billing and commission data: 10 years (statutory accounting requirement).
• Coach analytics data: 3 years from creation.

5. Your Rights

You have the following rights over your personal data: access, rectification, erasure, restriction, objection, portability, and withdrawal of consent (where applicable). California residents also have the right to know, delete, and opt out of the sale of personal information under the CCPA/CPRA. You may exercise any of these rights via our contact page.

You also have the right to lodge a complaint with the relevant supervisory authority: EU/EEA residents may contact the CNIL (cnil.fr); US residents may contact their state attorney general or the Federal Trade Commission (ftc.gov).

6. Cookies

We use only essential cookies necessary for the operation of the Site (authentication session, attribution of an affiliate click to a partner). These cookies do not require your prior consent.

Our product analytics tool (PostHog) is configured in cookieless mode: it sets no third-party cookies and performs neither session replay nor autocapture of form fields.

7. Security

Passwords are hashed with bcrypt by our authentication provider, transfers are made over HTTPS, IP addresses are anonymized before storage, and the principle of least privilege is applied to administrator access. Major security incidents are notified to the relevant supervisory authority (including the CNIL for EU-based processing) and to the affected individuals without undue delay. For partners in US states with specific data breach notification requirements, HelloSafe also complies with applicable local law.