Privacy Policy
This explains what the iCraft affiliate program (refer.icraft.dev) collects, why, and your rights. It covers affiliates only — each product has its own policy for its end users.
1.Who we are
ICRAFT SAS operates this affiliate program. For any privacy request, contact hello@icraft.dev.
2.What we collect
- Account: your handle, email, phone, and a one-way password hash (we never store your plaintext password). Optionally a profile picture you upload, or your Google profile picture if you sign in with Google.
- Referral activity: clicks and conversions on your link, which app, the value and the visitor's country.
- Fraud prevention: your IP address and country at sign-up (and on your first commission event), kept to detect self-referrals and duplicate accounts. Support tickets record only a truncated IP prefix. IPs are used for rate-limiting and fraud checks — never for advertising.
- Payouts: a Stripe account identifier. Your bank details and ID documents are collected and held by Stripe, not by us.
3.How we use it
- Run the program: attribute referrals and calculate commissions.
- Pay you, and verify eligibility / prevent fraud and abuse.
- Contact you about your account and material program changes.
- Send you service emails (welcome, payout receipts) and occasional program emails (tips, new apps in the program). You can opt out of non-essential emails at any time via the link in each email or by contacting us.
We do not sell your data or use third-party advertising trackers.
4.Legal basis
Performance of our agreement with you (running the program and paying you), our legitimate interest in preventing fraud, and your consent where you choose Google sign-in.
5.Cookies
We use a strictly necessary session cookie to keep you logged in, and a referral attribution identifier (≈30 days) so your referrals are credited to you. No advertising or cross-site tracking cookies.
6.Who we share with
- Stripe — payouts, banking and identity verification.
- Cloudflare — hosting and data storage (D1 database and Workers KV), plus Turnstile bot protection at sign-up (it processes technical browser signals; no advertising use).
- Google — only if you choose to sign in with Google.
- BumbleBox (an iCraft product) — email delivery for service and program emails.
7.Storage & security
Affiliate data is stored with Cloudflare (D1 database and Workers KV). Passwords are hashed with PBKDF2. All traffic is over HTTPS. This service is deliberately isolated from iCraft's financial/treasury systems.
8.Retention
We keep your data while your account is active. On deletion request we remove it, except where we must retain records of paid commissions for legal and accounting purposes.
9.Your rights
You can access, correct, export, or delete your data, and object to certain processing. Deletion is self-serve: use the Delete account button in your dashboard settings, or email hello@icraft.dev and we'll action it. You may also lodge a complaint with your local data-protection authority.
10.Changes
We'll post updates to this policy here with a new “last updated” date.