Privacy Policy

This Privacy Policy describes how PAYET FABRICE, as publisher of the RefCampaign platform, collects, uses, stores and protects your personal data.

We attach great importance to protecting your personal data and are committed to processing it in accordance with the General Data Protection Regulation (GDPR) and French Data Protection Act.

The data controller is:
PAYET FABRICE
French SIREN: 798 679 296
Email: contact@refcampaign.com
Address: 20 ALLEE DES FLAMBOYANTS, 97429 PETITE-ILE, France

We collect the following personal data:

Identification data:
• First and last name
• Email address
• Phone number (optional)
• Postal address (for Merchants)

Account data:
• Login credentials
• Password (encrypted)
• Profile information

Payment data:
• Billing information
• Payment history
• Banking information (processed by Stripe, our payment provider)

Usage data:
• IP address
• Browser type and operating system
• Pages visited and visit duration
• Actions performed on the Platform
• Affiliate tracking data (clicks, conversions)

Cookies and similar technologies:
• Session cookies
• Analytics cookies
• Affiliate tracking cookies

Your personal data is collected and processed for the following purposes:

Service provision:
• Account creation and management
• Access to Platform features
• Payment processing and billing
• Customer support and technical assistance

Affiliate program management:
• Click and conversion tracking
• Commission calculation and payment
• Reporting and statistics

Service improvement:
• Platform usage analysis
• Fraud detection and prevention
• Testing and development of new features

Communication:
• Sending transactional emails (confirmations, notifications)
• Sending marketing emails (with your consent)
• Information about service updates

Legal obligations:
• Compliance with accounting and tax obligations
• Response to requests from competent authorities

Processing of your personal data is based on the following legal bases:

• Contract execution: for provision of RefCampaign service
• Legitimate interest: for service improvement, fraud prevention and security
• Consent: for sending marketing emails and use of certain cookies
• Legal obligation: for compliance with accounting, tax and legal obligations

Your personal data may be transmitted to the following recipients:

Authorized personnel:
Our employees and collaborators who need access to data to ensure Platform operation.

Service providers:
• Hetzner: Platform and primary PostgreSQL database infrastructure in Helsinki, Finland
• Vercel: marketing website and documentation hosting
• Stripe: payment processing and billing
• Resend: transactional email sending from notifications.refcampaign.com
• PostHog: analytics and usage tracking (optional)
• Contentsquare / Hotjar: UX analytics, heatmaps and session replay (optional, with analytics consent)

Competent authorities:
In case of legal obligation, we may need to communicate your data to judicial, administrative or tax authorities.

Our providers are subject to strict contractual obligations regarding data protection and can only use your data for defined purposes.

Other integrations:
• Self-hosted Plausible, administered by Fabrice Payet at analytics.fp-infra.dev: cookieless audience measurement on the public website without a prior consent request. Campaign parameters, URL fragments, custom properties and amounts are removed before transmission; only the referring website origin is retained
• Meta: advertising measurement, only after marketing consent and when configured
• PayPal: execution of payouts from the Merchant's account when the Merchant enables this integration

The provider list details the other technical services.

Some providers process data outside the European Economic Area, including in the United States. Hosting the Platform and its primary database in Finland does not mean all processing stays within the EU.

Depending on the recipient and processing, transfers must rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses. The EU–US Data Privacy Framework only applies to certified organizations and covered processing. Cookie consent alone is not a safeguard for international transfers.

The provider list describes their purposes and locations. For information about applicable safeguards or a copy, contact contact@refcampaign.com.

Your personal data is retained for the period necessary for the purposes for which it was collected:

• Account data: throughout service usage, then 3 years after last activity
• Billing data: 10 years in accordance with accounting obligations
• Affiliate click records: 30 days
• Conversion and commission records: for the period required to operate the service and comply with accounting, tax, fraud-prevention and dispute-management obligations
• Browser attribution cookie _rc_sid: 90 days after consent, unless the visitor withdraws consent earlier

Beyond these periods, data is deleted or anonymized, subject to applicable legal retention duties.

Plausible audience measurement: events and sessions have an automatic deletion rule after 25 months. Encrypted backups are retained for approximately 7 additional days.

In accordance with GDPR, you have the following rights regarding your personal data:

• Right of access: obtain a copy of your personal data
• Right of rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your data
• Right to restriction: limit processing of your data in certain cases
• Right to portability: receive your data in a structured, readable format
• Right to object: object to processing of your data for legitimate reasons
• Right to withdraw consent: for consent-based processing
• Right to define post-mortem directives: on fate of your data after death

To exercise these rights, you can contact us at: contact@refcampaign.com

You also have the right to lodge a complaint with the CNIL (www.cnil.fr).

We implement appropriate technical and organizational measures to protect your personal data against destruction, loss, alteration, unauthorized disclosure or unauthorized access:

• Encryption of sensitive data (SSL/TLS)
• Password encryption
• Restricted access to personal data
• Intrusion monitoring and detection
• Regular backups
• Staff training on data protection

However, no method of transmission over the Internet or electronic storage is completely secure. We therefore cannot guarantee absolute security.

The Platform uses cookies and similar technologies for authentication, preferences, analytics and affiliate attribution.

Types of cookies used:

• Strictly necessary cookies: essential for Platform operation (authentication, security, selected language)
• Performance cookies: analysis of Platform usage for improvement, with your consent, including Contentsquare / Hotjar UX analytics and session replay
• Affiliate attribution cookie _rc_sid: a first-party session identifier created only after the Merchant's consent-management platform signals that the visitor has granted attribution consent; it expires after 90 days and is deleted when consent is withdrawn
• Marketing cookies: advertising campaign measurement, with your consent

For attribution on a Merchant's website, the Merchant is responsible for obtaining the visitor's consent, retaining any legally required evidence and forwarding grants, refusals and withdrawals to RefCampaign. RefCampaign does not create the browser attribution session or process that visit for automatic affiliate attribution before the Merchant sends a grant signal. A refusal means that the browser visit is not attributed automatically to an affiliate. A Merchant may still attribute a conversion from information it knows independently, such as a coupon, an explicit referral code or a server-side affiliate code attached to the order.

Visitors can withdraw consent through the Merchant's consent controls. Withdrawal deletes the current attribution cookie and stops access to that browser session. Optional analytics categories are also disabled until accepted.

Refusal of strictly necessary cookies may prevent use of certain Platform features.

The Platform is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at contact@refcampaign.com so we can delete this data.

We reserve the right to modify this Privacy Policy at any time.

Any significant modification will be notified to you by email or Platform notification. The last update date is indicated at the top of this document.

We encourage you to regularly consult this page to be aware of any modifications.

For any questions regarding this Privacy Policy or to exercise your rights, you can contact us:

By email: contact@refcampaign.com

By mail:
PAYET FABRICE
20 ALLEE DES FLAMBOYANTS
97429 PETITE-ILE
France

We are committed to responding to your requests within a maximum of one month.