Legal
Privacy Policy
This policy covers what CommissionFlow collects from visitors, how we use it, and the choices you have under the EU General Data Protection Regulation (GDPR), the UK Data Protection Act (DPA 2018), and the California Consumer Privacy Act (CCPA/CPRA).
1. Who we are
CommissionFlow is a B2B affiliate comparison platform. For the purposes of GDPR we act as the data controller for the personal data described in this policy. To exercise any right in this document, contact hello@commissionflow.tech.
2. Data we collect
- Visitor analytics. A pseudo-anonymous visitor ID used to count unique pageviews, measure scroll depth on comparison hubs, and detect broken outbound partner links. The ID is random and not tied to your name or email.
- Click attribution. When you click a partner CTA on a comparison hub, we record the partner, the product slug, the referer, and a server-generated commission row. No personal data is attached by default.
- Email (if you contact us). Only what you write to us. We retain it for as long as needed to answer and then delete the thread unless you asked us to keep it.
- Server logs. Standard request logs (IP, UA, path, response code) kept for ≤30 days for security and abuse investigation, then aggregated or deleted.
3. Cookies we set
We use a small set of cookies. Essential cookies remember your consent choice. Analytics cookies assign a pseudo-anonymous visitor identifier and count pageviews. Affiliate cookies track click attribution and are set only when you click a partner CTA. The cookie banner lets you decline analytics while keeping the site functional.
| Name | Purpose | Provider | Duration | Category |
|---|---|---|---|---|
| cf_consent | Records your decision on the cookie consent banner — accept or decline. | CommissionFlow | 12 months | Essential |
| polsia_vid | A pseudo-anonymous visitor identifier used to count unique visitors across pages and to compute comparison-page engagement. Set by the Polsia visitor beacon. | CommissionFlow | 12 months | Analytics |
| <partner_specific> | Once you click through to a SaaS partner’s site, that partner owns the cookies it sets (session, auth, marketing attribution). CommissionFlow does not read those cookies — refer to the partner’s own policy. | Partner | Per partner | Affiliate |
4. Partner-side cookies
When you click an outbound CTA on a comparison hub, you leave CommissionFlow and land on the partner’s own domain. The partner’s site then sets its own cookies for authentication, marketing, and analytics. We do not read those cookies; the partner controls them under its own privacy policy, which is linked from the partner’s footer or signup flow.
5. Your rights
Under GDPR (and the equivalent UK DPA 2018) you have the right to access, correct, erase, restrict, port, and object to the processing of your personal data, plus the right to lodge a complaint with your supervisory authority. If you are in California, the CCPA and CPRA give you the right to know, delete, opt out of sale/sharing, and limit the use of sensitive personal information. To exercise any of these rights, email hello@commissionflow.tech with the subject line “Data request” — we acknowledge within five business days and fulfill within thirty calendar days.
6. How long we keep data
Analytics aggregates are kept for 26 months and then either fully aggregated or deleted. Click-attribution Commission rows are kept for as long as required by the partner’s payout window (typically 24–36 months) and then archived. Email threads are deleted within twelve months of the last reply unless you ask for them to be retained.
7. Children
CommissionFlow is a B2B service and is not directed at children. We do not knowingly collect data from anyone under the age of digital consent in their jurisdiction (16 in most EU member states).
8. Changes to this policy
When this policy changes in a way that affects your rights, we will surface a notice on the home page for at least 30 days and bump the “Last updated” line below. Material changes will not be retroactive.
Last updated: 2026-07-19. This policy is provided for general informational purposes and is not legal advice. If you have questions specific to your own compliance, please consult counsel.
Consent records retained for days. See our .