Affiliate King Privacy Policy
Effective date: 7 October 2026. Last updated: 19 October 2026
Affiliate King is a Shopify app that lets online stores run creator and affiliate programmes. It is made by Dubient Designs Pte. Ltd., a company registered in Singapore ("Dubient Designs", "we", "us").
This policy explains what personal data Affiliate King handles, why, and what choices you have. It covers three groups of people:
- Merchants: stores that install Affiliate King.
- Creators: people who apply to, or join, a store's creator programme.
- Shoppers: people who buy from a store that uses Affiliate King.
Who is responsible for your data
- Merchant account data: we decide how it's used, so we are the controller.
- Creator and shopper data: the store that runs the programme decides how it's used, so the store is the controller. We process this data on the store's behalf, under the store's instructions and our Merchant Terms, which include a data processing agreement. If you're a creator or shopper, the store's own privacy policy also applies, and the store is your first point of contact.
What we collect and why
Merchants
When you install Affiliate King, Shopify shares, and we store:
- Store details: your store's domain, name, currency and storefront address.
- Contact email: the email you give us for programme notifications.
- Access tokens: these let the app work with your store. We encrypt them.
- Your settings: commission rules, sign-up page design, discount defaults, payout methods and similar.
- Plan: whether you're on Free or Premium. Shopify handles billing, so we never see your payment details.
- An activity log: the changes made in the app, so you can see who changed what.
We use this to run the app for you, to support you, and to keep the app secure.
Creators
When you apply to a store's creator programme, the store chooses which questions to ask. Depending on those choices, we store:
- Your answers: your name and email, plus any of these the store asks for: country, phone number, social media handles and links, follower range, the kind of content you create, why you want to join, and your answers to the store's own questions.
- Your consent choices: your agreement to the privacy policy, and whether you opted in to campaign news.
- Your creator account (if the store approves you):
- your referral code and discount code
- your commission rate
- your password, stored only as a salted hash
- when you last signed in
- Payout details you enter, such as a PayPal email or bank details. We encrypt these separately, and only the store can view them, to pay you.
- Your earnings: the referred orders, commission, bonuses and payouts credited to you.
We use this so the store can review your application, set up your account, credit your sales, and pay you. We send you emails about your application and your account. Your choice about campaign news is shown to the store, which decides whether to contact you. Affiliate King doesn't send marketing emails itself.
Shoppers
Affiliate King never reads shoppers' names, email addresses, phone numbers or postal addresses.
Referral link clicks: when you follow a creator's referral link, we record:
- the time
- the page you landed on
- the referring page
- a random visitor ID
- a one-way hash of your browser's user agent
We don't store your IP address with clicks. We use this to count clicks and credit sales to the right creator.
Orders: when you place an order that a creator referred, we store:
- the order number and amounts
- the products bought
- a one-way hash of your Shopify customer ID
The hash lets us apply the store's rules, for example paying a creator on all orders from customers they brought in. It can't be turned back into your customer ID or identify you on its own. To check whether an order is your first with the store, we ask Shopify for your order count, but we don't store it.
Cookies
On a store's website, Affiliate King sets two first-party cookies, and only if you've allowed marketing cookies through the store's cookie banner:
| Cookie | What it does | How long it lasts |
|---|---|---|
ak_ref |
Remembers which creator's link you used, so a later purchase is credited to them | The store's referral window, 30 days unless the store changes it |
ak_visitor |
A random ID used to count unique clicks | 1 year |
Without marketing consent, only the current visit is credited, and no cookie is set.
The creator portal uses a cookie to keep creators signed in.
Security and abuse prevention
To stop password guessing and spam applications, we briefly keep a one-way hash that combines the IP address, the store and the email address used. We delete it after one day.
Service providers we use
We share data only with providers that help us run Affiliate King:
| Provider | What for | Where |
|---|---|---|
| Shopify | The platform the app runs on, and billing | Global |
| Cloudflare | Hosting, database, file storage and network security | Global network; our database's primary location is in the Asia-Pacific region |
| Resend | Sending emails | United States |
| bunny.net (Bunny Fonts) | Fonts on the sign-up page. Your browser downloads them directly, so bunny.net sees your IP address. bunny.net says Bunny Fonts sets no cookies and doesn't log IP addresses. | European Union |
We don't sell personal data. We don't use it for advertising, and we don't share it with anyone else, except with tools a store connects itself (below) or when the law requires it.
When data moves between countries, we rely on our providers' standard safeguards, such as the European Commission's Standard Contractual Clauses.
Tools a store connects
A store on the Premium plan can connect its own Klaviyo account (an email marketing service). When it does, Affiliate King sends Klaviyo that store's creator details: name, email address, referral link and code, discount code, and programme events (applications, approvals, sales, commission, bonuses and payouts). Klaviyo is the store's own provider, and the store's agreement with Klaviyo and the store's privacy policy apply to that data. A creator is added to the store's marketing list only if they opted in to news when they applied. The store can disconnect Klaviyo at any time, and we then stop sending data to it.
How long we keep data
| Data | How long we keep it |
|---|---|
| Referral link clicks | 13 months |
| Rejected applications | 12 months after the decision |
| Password reset links | 7 days after they expire |
| Abuse-prevention records | 1 day |
| Everything else about a store, including its creators, orders and payouts | While the store uses Affiliate King |
When a store uninstalls Affiliate King, Shopify tells us, and we delete all of that store's data 48 hours later.
When Shopify asks us to delete a shopper's data, we remove the shopper's customer ID hash from the store's orders.
A store can remove a creator at any time.
Your rights
Depending on where you live, you may have the right to:
- access, correct or delete your personal data
- object to or restrict how it's used
- receive a copy of it
You can also withdraw any consent you've given, for example by unsubscribing from campaign news.
- Creators and shoppers: please contact the store first, because it controls your data and can act quickly. You can also contact us, and we'll pass your request to the store and help it respond.
- Merchants: contact us directly.
If you're unhappy with how your data is handled, you can complain to your local data protection authority.
Security
- Data is encrypted in transit (HTTPS) and at rest.
- Access tokens and payout details are also encrypted by the app itself.
- Passwords are stored only as salted hashes.
- Access to production systems is limited to the people who run Affiliate King.
Children
Affiliate King is not meant for children. Stores must not use it to collect data from anyone under 16, or the minimum age where they operate if that's higher.
Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll tell merchants in the app or by email before it takes effect.
Contact
Dubient Designs Pte. Ltd. Singapore Email: contact@dubientdesigns.com