Privacy Policy

Last updated: June 2026

This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and the choices and rights you have. It applies to everyone who interacts with the Platform: affiliates who promote products, merchants who list offers and consume our APIs, and visitors who browse our public marketing site. Throughout this document, “the Platform”, “we”, “us”, and “our” refer to Influencemart, the operator of Influencemart.

Influencemart is an API-first, event-driven affiliate aggregator. We sit between merchants and affiliates: we ingest product catalogs, generate trackable links, record clicks and conversions, attribute commissions, and settle payouts. Because attribution is the core of what we do, some data necessarily flows between merchants and affiliates — this policy describes exactly when and what. For context on how the network operates, see how it works and our trust & safety commitments.

1. Data we collect from affiliates

When you register and operate as an affiliate, we collect the information needed to verify you, generate your tracking links, and pay you accurately:

• Account & identity — name, email address, password (stored only as a salted hash), phone number, and the country or region you operate from.
• Promotion profile — the websites, social handles, app listings, or other channels you intend to promote through, and the promotion methods you select. We use this to assess eligibility against our affiliate terms and to detect prohibited activity.
• Activity & performance — links you create, campaigns you join, clicks and conversions attributed to you, commission balances, and the status of each commission.
• Communications — messages you send to support, inquiries submitted through our contact page, and your support history.

2. Data we collect from merchants

When you onboard as a merchant or integrate via our APIs, we collect business and integration data so that your offers can be listed, tracked, and reconciled:

• Business profile — legal or trading name, contact name and email, website, and the category of products you sell.
• Catalog & campaign data — the products, prices, commission rates, landing URLs, and campaign terms you publish to the network. This content is intended for distribution to affiliates and is treated as non-confidential catalog data.
• Integration credentials — API keys and webhook endpoints you configure. API keys are stored as secure hashes; we display them in full only once at creation.
• Settlement records — the conversions you confirm or reverse, and the commission and fee amounts that result.

See merchants and our API overview for what integration involves, and the merchant terms for the contractual framework.

3. Click and tracking data

Attribution is impossible without recording the journey from a click to a conversion. When a user follows an affiliate link, we process:

• A short-lived click identifier that ties the referral to the affiliate, campaign, and product.
• Technical signals needed for legitimate attribution and fraud prevention — including a truncated or hashed IP address, user-agent string, approximate region, referrer, and timestamps.
• The conversion event a merchant reports back to us (for example, that order X originated from click Y), and its lifecycle as the commission moves through its status flow.

We do not build advertising profiles of end users, sell click data, or track individuals across unrelated sites. Click and tracking data is used to attribute commissions correctly, to detect fraud, and to produce aggregate performance reporting.

4. API and webhook logs

Because the Platform is API-first, we maintain operational logs of the requests that flow through it. These logs support security, debugging, abuse prevention, and dispute resolution, and may include:

• The identifier of the API key used, request method and path, response status, and timing.
• The originating IP address and user-agent of API and webhook callers.
• Webhook delivery attempts and their outcomes, including retries, so that merchants and affiliates can audit what was sent and received.
• Idempotency keys and event identifiers used to guarantee that the same conversion is never counted twice.

We log metadata about requests, not the secret values themselves. API keys appear in logs only as a non-reversible reference, never in plaintext.

5. Payout and KYC data

To pay affiliates and to meet our legal and anti-fraud obligations, we collect and process settlement and verification information:

• Payout details — the destination you choose from our supported payout methods (such as bank transfer or supported digital wallets), including the account or wallet identifiers required to send funds.
• Know-Your-Customer (KYC) data — identity and, where applicable, tax or business-registration details that we may require before releasing payouts, to comply with applicable Nepal regulations and to prevent fraud and money laundering.
• Ledger & transaction history — an append-only record of commissions earned, adjustments, holds, and payouts made. This financial record is retained for the periods required by law.

Payout and KYC data is among the most sensitive information we hold. Access is restricted to the staff and systems that need it to process payments, resolve disputes, or satisfy a legal requirement.

6. Cookies and tracking technologies

We use a small number of cookies and similar technologies, kept to what is genuinely necessary:

• Essential cookies — to keep you signed in, maintain your session securely, and protect against cross-site request forgery. The Platform does not function without these.
• Attribution identifiers — the short-lived click identifier described above, set when a user follows an affiliate link so that a resulting purchase can be credited to the correct affiliate.
• Preference signals — minimal data to remember non-sensitive choices you make while using the site.

We do not use third-party advertising or cross-site behavioral tracking cookies. You can control cookies through your browser settings, though disabling essential cookies will prevent you from signing in or being credited for referrals.

7. How we share data for attribution

The Platform works by connecting merchants and affiliates, so some data is shared between them — but only what attribution and settlement actually require:

• To merchants, we pass the click identifier and campaign and product references needed to confirm a conversion and the commission owed. We do not hand merchants an affiliate’s payout, KYC, or login credentials.
• To affiliates, we surface the campaigns, products, commission rates, and the attributed clicks, conversions, and earnings tied to their own account — not other affiliates’ data and not a merchant’s confidential business records.
• To service providers that operate the Platform on our behalf — for example payment, hosting, and email infrastructure — strictly to deliver the service, under confidentiality obligations.
• For legal and safety reasons — to comply with the law, enforce our terms, prevent fraud, or protect the rights and safety of users and the public.

We do not sell personal data. Any sharing beyond what is described here would only occur with your consent or where required by law.

8. Data retention

We keep data only as long as it serves a legitimate purpose:

• Account data is retained while your account is active and for a reasonable period afterward to handle disputes and reactivation.
• Click, conversion, and webhook logs are retained long enough to support attribution windows, fraud investigation, and reconciliation, then aged out or aggregated.
• Financial, payout, and KYC records are retained for the minimum periods required by applicable accounting, tax, and anti-money-laundering law in Nepal, even after an account closes.

When data is no longer needed for these purposes, we delete it or irreversibly anonymize it.

9. Security

We apply technical and organizational measures appropriate to the sensitivity of the data we hold, including:

• Encryption of traffic in transit (HTTPS/TLS).
• Passwords stored only as salted hashes, and API keys stored as hashes — never as recoverable plaintext.
• Role-based access controls so staff and systems can reach only the data their function requires.
• Signed, idempotent webhooks and request logging to detect tampering and prevent duplicate processing.
• Ongoing monitoring for abuse and the prohibited activities listed in our trust & safety program.

No system is perfectly secure, but we work continuously to protect your data and to limit the impact of any incident.

10. Your rights and how to contact us

Subject to applicable law, you can exercise the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix inaccurate or incomplete information; much of your account and payout data can be updated directly in your dashboard.
• Deletion — request erasure of your data, except where we must retain it to meet a legal, financial, or fraud-prevention obligation.
• Objection & restriction — object to or ask us to limit certain processing.
• Withdraw consent — where processing relies on consent, you may withdraw it at any time without affecting prior lawful processing.

To make a request, email us at support@affiliatenepal.com or use our contact page. We may need to verify your identity before acting on a request. You can also review our broader terms of service and pricing for how the service is provided.

Not legal advice

This summary is provided for transparency and is not a substitute for professional legal advice. It describes our current practices and may be updated as the Platform, the law, or our operations evolve; material changes will be reflected by updating the date above and, where appropriate, notifying account holders.

Questions? Contact us at support@affiliatenepal.com or via our contact page.