Privacy Policy
Last updated: 9 August 2026
01Who is responsible for your data
The data controller is Simon Saxtorph Sarelius Petersen, operating AffiFeed from Denmark.
For any privacy question, or to exercise the rights described in section 8, contact contact@affifeed.com. We aim to respond within 30 days, as required by the GDPR.
02What we collect
AffiFeed is a business tool. Most of what it stores is commercial product data rather than personal data, but the following is collected:
| Data | Why we hold it |
|---|---|
| Account details | Your email address, and a name if you provide one. Needed to create your account, sign you in, and contact you about the service. |
| Password | Handled by our authentication provider and stored only as a salted hash. We never see or store your password in readable form. |
| Affiliate network credentials | The API keys and affiliate IDs you enter for Partner-Ads, Adtraction and similar networks. Required to import product feeds on your behalf. |
| Imported catalogue data | Advertisers, products, prices, images and stock status pulled from the networks you connect. This is the advertisers' commercial data, not personal data. |
| Feeds and designs | The feeds you build, the products you select, and your styling choices. |
| Operational logs | Sync events, timings, error messages and progress checkpoints. Used to show you sync status and to diagnose failures. |
| Email delivery records | Whether service emails were sent, delivered or unsubscribed, so we do not email you when you have opted out. |
We do not run advertising trackers, we do not profile you, and we do not buy or sell personal data.
03Why we are allowed to process it (legal bases)
- Performance of a contract (GDPR Art. 6(1)(b)) — running your account, importing your feeds, generating your embeds. Without this data the service cannot function.
- Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing abuse, diagnosing faults, and improving reliability. We balance this against your rights and keep the data minimal.
- Legal obligation (Art. 6(1)(c)) — retaining accounting records where Danish law requires it.
- Consent (Art. 6(1)(a)) — only where we ask for it explicitly, such as optional product announcements. You can withdraw consent at any time.
04Where your data is stored
Your data is stored in the European Union (Ireland) on infrastructure provided by Supabase, our database, authentication and hosting provider.
Supabase Inc. is a US-headquartered company. Where any support or administrative access from outside the EU is possible, it is governed by the European Commission's Standard Contractual Clauses together with a data processing agreement. Your project data itself remains hosted in the EU region.
When you connect an affiliate network, AffiFeed sends requests to that network using the credentials you supplied, in order to fetch your approved advertisers and product feeds. Those networks are independent controllers of their own data and their privacy policies apply to that relationship.
05Who we share it with
We do not sell personal data. We share it only with:
| Recipient | Role |
|---|---|
| Supabase (EU/Ireland) | Database, authentication, and hosting. Acts as our processor. |
| Affiliate networks you connect | Receive API requests made with your own credentials, at your instruction. |
| Email delivery provider | Sends account emails such as sign-in links, password resets and email-change confirmations. |
We may also disclose data where legally required, or to establish or defend legal claims.
06Sign-in storage and cookies
AffiFeed does not use advertising or analytics cookies. To keep you signed in, we store a session token in your browser's local storage. This is strictly necessary for the service to work — without it you would be signed out on every page load. Clearing your browser storage signs you out.
The product embeds do not track anyone. The script you place on your website renders product cards from your own feed data. It sets no cookies, stores nothing in the visitor's browser, and sends no data about your visitors back to AffiFeed.
07How long we keep it
| Data | Retention |
|---|---|
| Account and profile | For as long as your account exists. |
| Network credentials | Until you delete the connection or your account. Deleting a connection removes the stored key. |
| Imported products and feeds | Until you delete them or your account. Products removed from a source feed are marked inactive rather than deleted, so your existing embeds do not break unexpectedly. |
| Sync logs | Kept as operational history and cleared periodically. |
| After account deletion | Your account and associated data are deleted. Backups roll off on their normal cycle, and anything we must keep for accounting is retained for the statutory period under Danish law. |
You can delete your account yourself at any time from the Account page.
08Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Correct data that is inaccurate or incomplete.
- Have your data erased.
- Restrict or object to how we process it.
- Receive your data in a portable, machine-readable format.
- Withdraw consent at any time, where processing is based on consent.
To exercise any of these, email contact@affifeed.com.
If you believe we have handled your data improperly, you may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark — datatilsynet.dk. You may also complain to the supervisory authority where you live.
09Security
Access to your data is restricted to your own account through database-level row security, traffic is encrypted in transit with TLS, and data is encrypted at rest by our infrastructure provider. Your affiliate network keys are never returned to your browser in full — the interface only ever shows the last four characters.
No system is perfectly secure. If a breach occurs that is likely to pose a risk to your rights, we will notify the Danish Data Protection Agency within 72 hours and inform you without undue delay where required.
10Children
AffiFeed is a business tool and is not directed at children. You must be at least 18 to create an account. We do not knowingly collect data from children.
11Changes to this policy
We may update this policy as the service develops. The date at the top always reflects the current version. If a change materially affects your rights, we will notify you by email or in the application before it takes effect.