Privacy Policy
How Trix Affiliates handles your information.
Effective July 23, 2026
1.Who we are
Trix Affiliates (“we”, “us”) operates trixaffiliate-os.com and the Trix Affiliates platform. This policy explains what personal information we collect, why, who we share it with, and the rights you have over it.
2.Information we collect
You give us:
- Account data — email address, name, password (stored only as a salted hash).
- Workspace content — brands, affiliate programs, products, campaigns, content drafts and any notes you enter.
- Business data you record — commissions, conversions, ad spend and performance figures.
- Billing details — handled by Stripe. We receive only the last four digits, card brand, expiry and billing country. We never receive or store your full card number.
- Support messages you send us.
Collected automatically:
- Technical data — IP address, browser and device type, timestamps.
- Usage data — pages visited and features used, to diagnose faults and improve the product.
- Essential cookies — required to keep you signed in. See section 8.
We do not knowingly collect information from anyone under 18, and we do not collect special category data (such as health, biometric or political data).
3.Why we use it
- To provide the Service — run your workspace, store your data, generate output you request. (Legal basis: performance of a contract.)
- To take payment — manage trials, subscriptions, invoices and failed payments. (Contract; legal obligation.)
- To communicate — service notices, trial-ending reminders, security alerts, support replies. (Contract; legitimate interests.)
- To secure and improve — detect abuse, fix faults, understand which features are used. (Legitimate interests.)
- To meet legal obligations — tax, accounting and lawful requests. (Legal obligation.)
4.AI processing
When you ask the Service to generate content, the relevant prompt and context are sent to our AI provider to produce that output. We send only what is needed for the request. Providers process this to return your result; we do not authorise them to use your content to train general models. Avoid pasting sensitive personal data into generation prompts.
5.Who we share it with
We use a small set of vetted providers (“sub-processors”) that process data on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication | United States |
| Netlify | Website & application hosting | United States |
| Stripe | Payment processing, billing | United States |
| Resend | Transactional email delivery | United States |
| Vercel (AI Gateway) | AI content generation | United States |
We may also disclose information where legally required, or as part of a merger or acquisition — in which case we will notify you before your information becomes subject to a different policy.
6.International transfers
Our providers are based in the United States, so if you are outside the US your information will be transferred there. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.
7.How long we keep it
- Account and workspace data — while your account is active.
- After deletion — removed from live systems within 30 days, and from backups within 90 days.
- Billing records — retained up to 7 years where tax law requires it.
8.Cookies
We use essential cookies only — they keep you signed in and secure your session. We do not use advertising or cross-site tracking cookies. Blocking essential cookies will prevent you from logging in.
9.Security
Data is encrypted in transit (TLS) and at rest. Access is restricted by row-level security so one workspace cannot read another’s data. Passwords are salted and hashed; card numbers never touch our servers. No system is perfectly secure, but we will notify affected users and regulators of a qualifying breach without undue delay.
10.Your rights
Depending on where you live, you may have the right to:
- access a copy of your personal information;
- correct information that is inaccurate;
- delete your information (“right to erasure”);
- export your data in a portable format;
- object to or restrict certain processing;
- withdraw consent where processing relies on it;
- complain to your data protection authority.
California residents (CCPA/CPRA): you also have the right to know what we collect, to delete it, and not to be discriminated against for exercising those rights. We do not sell or share personal information for cross-context behavioural advertising.
To exercise any right, email privacy@trixaffiliate-os.com. We respond within 30 days and may need to verify your identity first.
11.Changes
We may update this policy. Material changes will be announced by email or in-app before they take effect, and the effective date above will change.
12.Contact
Privacy questions: privacy@trixaffiliate-os.com · General: support@trixaffiliate-os.com