Legal · version 2026-11-03-draft
Peervyce Privacy Policy
DRAFT TEMPLATE — NOT LEGAL ADVICE. This document was written as a starting point for Peervyce and has not been reviewed by a lawyer. Replace every bracketed placeholder (for example [ENTITY NAME] and [ADDRESS]) and have a lawyer licensed in Massachusetts review it before you rely on it or publish it as final.
Effective date: [EFFECTIVE DATE]
This policy explains how [ENTITY NAME] ("Peervyce", "we") collects, uses, and shares personal information when you use peervyce.com, our tracking links and pixels, and related services. Contact: support@peervyce.com, [ADDRESS].
1. Who this covers
- Account holders: Merchants, Affiliates, and their staff.
- Shoppers: people who click an Affiliate's tracking link or buy from a Merchant that uses Peervyce tracking. We usually don't know shoppers' names or emails.
- Visitors to peervyce.com.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account and contact data | Name, email, company, website, role, hashed password, two-factor settings | You |
| Payout and tax data | Stripe connected-account ID and status. Stripe (not Peervyce) collects identity documents, bank details, and W-9/W-8 tax forms | You, via Stripe |
| Billing data | Top-up amounts and Stripe payment references. We never see full card numbers | Stripe |
| Security and log data | IP address, login IPs, browser user-agent, session cookie, rate-limit counters, failed-login counts | Automatic |
| Click data | Click ID, time, Affiliate and Program, IP address, user-agent, referring page, optional sub-ID | Automatic when a tracking link is clicked |
| Conversion data | Order ID, sale amount, time, matched click ID | Merchants |
| Communications | Support emails and notices | You / us |
We do not knowingly collect sensitive personal information (as defined by state privacy laws) and we do not knowingly collect information from children under 13 (or under 16 for EU/UK users). The Platform is for adults running businesses.
3. How we use it
- To run the Platform: accounts, tracking, attributing sales, reporting, and paying commissions.
- To detect and prevent fraud, abuse, and security incidents (for example, bot, datacenter, and self-referral checks on clicks and sales).
- To process payments and payouts and meet tax, accounting, and legal obligations.
- To communicate with you about your account, security, and changes to our terms.
- To improve the Platform using aggregated or de-identified data.
We do not sell personal information for money, and we do not use shoppers' data to build advertising profiles or target ads.
4. Cookies and tracking technologies
Affiliate attribution relies on cookies and click identifiers. When someone clicks a tracking link, we record the click and pass a click ID to the Merchant's site, where the Merchant's snippet may store it in a first-party cookie for the Program's cookie window (1–365 days). Our own site uses a strictly necessary session cookie and a cookie that remembers your consent choice. Details are in our Cookie Notice.
5. How we share it
- Merchants see click and conversion details for their Programs (time, sub-ID, order ID, amount, fraud flags). They do not receive Affiliates' payout or tax details.
- Affiliates see aggregate clicks, sales, and commissions for their links; they do not receive shoppers' IP addresses.
- Service providers acting for us: Stripe (payments, payouts, identity and tax forms), our hosting provider (e.g. Render), and our email provider. They may use data only to provide their services to us, except Stripe, which also acts as an independent controller under its own privacy policy for connected accounts.
- Legal and safety: to comply with law, respond to lawful requests, enforce our terms, or protect rights, property, and safety.
- Business transfers: in a merger, acquisition, or sale of assets, subject to this policy.
Under some state laws, passing click identifiers to Merchants for attribution could be treated as "sharing" for cross-context behavioural advertising. We use them only to attribute and pay for sales, not to target ads. See Section 8 for how to opt out.
6. Retention
- Account data: while your account is open, then up to 7 years for tax, accounting, and dispute records.
- Click IP addresses, user-agents, and referrers: removed automatically after 400 days (long enough to cover the longest cookie window and holding period). The click ID and aggregate statistics stay for reporting.
- Login IP records: up to 400 days. Sessions expire automatically.
- Financial ledger entries and payout records: at least 7 years.
7. Security
We use encryption in transit (HTTPS), hashed passwords and one-time tokens, optional (and for admins, required) two-factor authentication, rate limiting, CSRF protection, and least-privilege access. No system is perfectly secure; we will notify affected users and regulators of a data breach as required by law, including Massachusetts General Laws chapter 93H.
8. Your privacy rights
Depending on where you live, you may have the right to: know or access the personal information we hold about you; correct it; delete it; get a portable copy; and opt out of "sale", "sharing", targeted advertising, or profiling. You also have the right not to be discriminated against for exercising these rights.
- U.S. state laws (for example California's CCPA/CPRA and similar laws in other states) apply to businesses that meet their thresholds. Where they apply to us, we honour verified requests within the legal deadline (generally 45 days) and recognise Global Privacy Control (GPC) browser signals as an opt-out of sale/sharing where required.
- EU/UK users (GDPR/UK GDPR): if we offer the Platform to people in the EU/UK, our legal bases are contract (running your account), legitimate interests (fraud prevention, security, attribution), legal obligation (tax and accounting), and consent (non-essential cookies). You may also object to processing, restrict it, withdraw consent at any time, and complain to your local data-protection authority. International transfers to the U.S. rely on appropriate safeguards such as the EU Standard Contractual Clauses. [EU/UK REPRESENTATIVE, IF REQUIRED]
- How to make a request: email support@peervyce.com from your account email. We may need to verify your identity. Authorised agents must provide proof of authority. If we deny a request, you may appeal by replying to our decision; we will respond within the period required by law.
- Shoppers: because we usually only hold a click ID, IP address, and browser details, include the approximate date and the link you clicked so we can find the record.
9. Changes
We will post updates here and change the effective date. If changes are material, we will notify account holders before they take effect.
10. Contact
[ENTITY NAME] · [ADDRESS] · support@peervyce.com