Cookie Policy

1. Overview

Cookies are small text files a website stores in your browser. Local storage is a similar browser feature. This policy lists every cookie and storage key that Afflo sets, both on our own app and, through our tracking snippet, on the stores of brands that use Afflo. For how we handle the data itself, see the Privacy Policy.

2. Every cookie and storage key

The snippet only reads and writes these keys; it does not set third-party cookies, does not use fingerprinting, and does not follow people across different websites. Each brand's cookies live only on that brand's own domain.

3. On the Afflo app

On our own domain we set only afflo_session and afflo_ws. Both are strictly necessary to provide the service you asked for (signing in and showing the right workspace), so under the ePrivacy rules they do not need consent. We do not use analytics, advertising or social-media cookies, so we do not show a cookie banner. If that ever changes, we will ask for your consent first and update this page.

4. On brands' stores

When a brand installs our tracking snippet, it sets the first-party _afv and _afc cookies (and copies in local storage) on the brand's domain. When you arrive through an affiliate's link, the snippet records the click, and if you buy within the program's tracking window, the affiliate who referred you earns a commission. After an affiliate click, if you type your e-mail into a form on that site, the snippet sends it to Afflo so a later purchase can be credited; we store it only as a salted hash.

The brand decides whether to use the snippet and is responsible for asking for your consent where the law requires it. Afflo processes this data on the brand's behalf. Questions about a specific store are best sent to that store first.

5. Your choices

• Use the store's cookie banner to accept or refuse marketing or attribution cookies.
• Delete cookies and site data in your browser settings at any time, or block them for specific sites.
• Blocking afflo_session will stop you from signing in to Afflo.
• Refusing attribution cookies does not stop you buying anything. A discount code shared by a creator still works, and can still credit them.

6. For brands: consent setup

In the EU and UK, storing or reading identifiers in a visitor's browser that are not strictly necessary for the service they asked for needs their prior consent (Art. 5(3) of the ePrivacy Directive, implemented in Slovakia in the Electronic Communications Act). Affiliate attribution is generally treated as marketing (some regulators accept it as a narrow functional purpose, but you should not rely on that without advice). As the controller for your store, you must cover the Afflo snippet in your own cookie banner and privacy notice:

• List _afv, _afc, _afc_cart and _aft under your marketing (or attribution) category, with the purposes and durations from the table above.
• Name Afflo ([TO FILL] Legal company name) as your affiliate-tracking processor in your privacy notice, and mention that e-mails typed into forms after an affiliate visit are used to credit sales.
• Load the snippet only after the visitor consents to that category, using one of the patterns below.
• Keep our Data Processing Addendum with your records.

Option A: let your consent tool activate the script

Most consent tools (for example Cookiebot, CookieYes, Iubenda, Klaro or vanilla-cookieconsent) block a script by changing its type to text/plain and switch it on when the visitor accepts the matching category. Mark the snippet like this, adapting the category attribute to your tool:

<script type="text/plain"
        data-category="marketing"
        data-src="https://YOUR-AFFLO-DOMAIN/t.js"
        data-key="pk_your_public_key"
        async></script>

Some tools use other attribute names (for example data-cookieconsent="marketing" for Cookiebot, or src instead of data-src). Check your tool's documentation and confirm the script is not requested before consent (open your browser's network tab).

Option B: load it from your own consent callback

// Call this from your consent tool's "accepted marketing" callback.
function loadAfflo() {
  if (window.afflo && window.afflo._loaded) return;
  var s = document.createElement("script");
  s.src = "https://YOUR-AFFLO-DOMAIN/t.js";
  s.setAttribute("data-key", "pk_your_public_key");
  s.async = true;
  document.head.appendChild(s);
}

If you call afflo.conversion(…) on a thank-you page before the snippet has loaded, queue the call instead: window.afflo = window.afflo || { q: [] }; afflo.q.push(["conversion", { orderId, amount, currency }]);. Queued calls run once the snippet loads, and are dropped if it never loads because consent was refused.

What changes without consent

• The snippet sets no cookies and sends nothing, so link clicks from visitors who refuse are not credited by cookie.
• The ?_afc= or ?ref= parameter is read when the snippet first runs. If a visitor accepts on a later page, the original click may be lost; consider keeping the landing page's parameters until the banner is answered.
• Personal discount codes and server-side order webhooks still work, so affiliates are still credited when their code is used.

This section is practical guidance, not legal advice. Your own lawyer or data-protection officer should confirm the right setup for your store and countries.

7. Contact

• Company: [TO FILL] Legal company name
• Registered office: [TO FILL] Registered address, Slovakia
• Company ID (IČO): [TO FILL] IČO, [TO FILL] Commercial register entry
• VAT ID: [TO FILL] VAT ID (IČ DPH)
• Contact: [TO FILL] contact e-mail
• Data protection contact: [TO FILL] privacy e-mail