Privacy policy

This policy explains what personal data we collect when you visit aggrefine.com or use the Aggrefine platform at app.aggrefine.com, what we use it for and what rights you have. We have tried to keep it short and specific. If something is unclear, email us at privacy@aggrefine.com.

Who we are

Aggrefine is run by LINA Solutions AB, a company registered in Sweden. We are the controller for the personal data described in this policy, unless we say otherwise below.

What we collect

Your account

When you sign up we store your name, your email address and the date you last logged in. If you sign up with a password, the password is handled by Amazon Cognito and we never see it. If you sign up with Google, see the section on Google sign-in below.

Your organization and team

We store your organization's name, country, website and registration number if you give them, who is a member of it and with which role, and the email addresses of people you invite. Invitations expire after 7 days and we keep a record of who invited whom.

Advertiser and network data

Aggrefine connects to affiliate networks using accounts you own. Through those connections we store information about the advertisers (merchants) and affiliate programs you work with: names, websites, program status, commission terms, product feeds and the earnings the networks report to you. This is mostly business data. Where it does contain personal data, such as an advertiser contact's name or email address, we process it on your behalf and only to provide the service to you.

Merchants' product data may be shared between customers approved for the same merchant. Product data specific to your publisher account is kept separate. Your credentials, approvals, tracking links, earnings and settings are never shared with other customers.

Your network API keys

To connect a network, you give Aggrefine the API key or login for your own account with that network. Think of Aggrefine as the tool you use to reach your accounts: the keys are yours, and they only fetch your data and the product feeds of the merchants you are approved for.

• We use them for one thing only: to fetch that data from the network for Aggrefine.
• We never use them for anything else, never act in your network account beyond fetching data, and never share them with anyone.
• They are encrypted before they are stored, and they are never shown again after you save them, not even to people in your own organization.
• Other customers can never use or see them.
• When you disconnect the network or close your account, we delete them.

Billing

Payments are handled by Stripe. Your card details go directly to Stripe and never reach our servers. We keep your billing contact, company details, VAT number, plan and invoice history.

When you create an organization we also create a customer for it at Stripe, even if you stay on the free plan, so upgrading later is quick. It holds the organization's name and country and the email address of the person who created it. When the organization is deleted we delete that customer at Stripe, unless it has invoices: those are accounting records and are kept (see below).

Usage and technical data

Our servers log requests, including IP address, browser type and the page requested, so we can keep the service secure and fix problems.

Each call to our API at api.aggrefine.com is logged so we can find it when a call fails: your organization, the first characters of the API key used (never the key itself), the channel, which endpoint was called (without its query), the result, how long it took and a request ID, plus the IP address it came from. We keep these logs for 7 days.

If you accept analytics cookies on aggrefine.com, we use Google Analytics to understand how people find and use the website: the pages you visit, where you came from, your approximate location (country and city) and your device and browser. Google Analytics does not store your IP address. Nothing is sent to Google until you accept, and we have turned off Google's advertising features (Google signals and ad personalization), so we do not use it to build advertising profiles. We do not use Google Analytics in the platform at app.aggrefine.com.

The contact form

The form on our contact page asks for your name, your email address and your message. When you send it, our platform emails them to info@aggrefine.com, through Resend, with your address as the one we reply to. The platform does not store them in its database or log them. The email itself is kept in our inbox, like any email you send us. To stop spam, the form uses Cloudflare Turnstile: Cloudflare checks that a person, not a bot, is sending it, using signals such as your IP address and browser, and our platform counts how many messages each IP address sends per minute, in memory only.

Emails and messages

If you contact us, by email or with the contact form, we keep the conversation so we can help you. We send account emails (verification codes, password resets, invitations and the confirmation that an account was deleted) through Resend, and, to an organization's owners and admins, a daily email when merchants they work with announce leaving their network or leave it, and an email when a network login stops working or a product or earnings sync fails (once, until it works again).

Google sign-in

If you choose to sign in with Google, Google shares your name, email address, whether that email address is verified, and your Google account ID with us. We use this only to create your account and log you in. We do not ask for access to your Gmail, Drive, contacts or any other Google data.

We do not sell this information, use it for advertising, or share it with anyone except the service providers listed below who help us run Aggrefine. Aggrefine's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Aggrefine's access at any time in your Google account settings.

Why we use it

• To provide the service you signed up for: your account, your team, and the data you connect. Legal basis: our contract with you.
• To bill you and keep accounting records. Legal basis: contract and our legal obligations under Swedish accounting law.
• To keep the service secure, prevent abuse and fix errors. Legal basis: our legitimate interest in running a safe and reliable service.
• To send you service emails, such as security notices or changes to these documents. Legal basis: contract and legitimate interest.
• To measure how our website is used with Google Analytics, if you accept. Legal basis: your consent, which you can withdraw at any time under "Cookie settings" at the bottom of every page.
• To answer messages you send us, by email or with the contact form, and to keep the form free of spam. Legal basis: our legitimate interest in replying to you and running a safe service.

We do not sell personal data and we do not use it for automated decisions that affect you.

Where your data is stored

Our database and application run on Amazon Web Services in the Stockholm region (eu-north-1), Sweden. Website files are delivered through Amazon CloudFront, which serves them from locations close to you.

Some of our service providers may process data outside the EU and EEA, mainly in the United States. When that happens, the transfer is covered by the EU-U.S. Data Privacy Framework or by the European Commission's standard contractual clauses.

Who we share it with

We use these service providers. They only process your data on our instructions.

When you connect an affiliate network, we contact that network on your behalf, using your own account with them. They see these requests the same way they see you logging in to your account.

How long we keep it

• Account and organization data: as long as your account is open. You can delete your account yourself in the platform (Settings → Account): your account, and access to every organization you are the only member of, go right away; those organizations' data is deleted within minutes, and we email you when everything is gone.
• Network and advertiser data: until you disconnect the network (we delete it within minutes) or delete your account.
• A merchant's feeds and deals: until 3 days after none of your channels is approved for its program anymore (the 3 days cover a network briefly reporting the wrong status). Your earnings from it stay with your account.
• Merchants' product data (our terms, section 5): it is the merchants' data, not yours, so it isn't deleted with your account; you stop seeing it as soon as none of your channels is approved for the merchant. We delete a merchant's product data, with its feed copies, 30 days after no customer is approved for the merchant anymore, or 30 days after the merchant leaves the network (the end date it announced, or the day we learned of it if that was later, or the day the network stops listing it, once every connection that had the merchant has read its network's list in full), unless it comes back within those 30 days. We keep a short record that it left. The history of its products' prices, stock and changes is deleted after 12 months; the record of which of its products changed when, which our API's list of changes reads, after 7 days.
• Which merchants and feeds each of your channels showed, which our API's list of changes compares with: 8 days after a call for changes last used it, or when you delete the channel or your account.
• The latest complete product-feed copy: while we keep that feed in our catalog, so we can reprocess it without another download. Older copies: up to 180 days, and sometimes less. Copies stored only for your publisher account are deleted when you disconnect the network or delete your organization; shared copies still needed by other approved customers are kept.
• Messages sent with the contact form: not stored by the platform; the email they become stays in our inbox, as long as we need it to help you, like any other email.
• Login sessions: 30 days, or until you log out.
• Server logs: 30 days. Logs of calls to our API (api.aggrefine.com): 7 days.
• Google Analytics data: 14 months. Google's cookies in your browser: up to 13 months, or until you withdraw consent.
• Database backups: 7 days. Deleted data disappears from backups when they roll over.
• Invoices and accounting records: 7 years, as Swedish accounting law requires. A Stripe customer without invoices is deleted with its organization.

Cookies

The platform uses one cookie that keeps you logged in, and our sign-in service (Amazon Cognito, at auth.aggrefine.com) sets cookies while you sign in, for example with Google. They are needed for the service to work, so we do not ask for consent for them.

Our website remembers your light or dark theme and your cookie choice in your browser's local storage. Google Analytics cookies (named _ga and _ga_ followed by an ID) are only set if you accept them. You can change your choice at any time under "Cookie settings" at the bottom of every page; if you withdraw consent, we delete those cookies.

Our API documentation at docs.aggrefine.com, hosted by Mintlify, shows Mintlify's cookie banner. We have turned off Mintlify's analytics, so nothing is tracked whatever you choose: the only thing stored is your choice, in a cookie named c15t (kept for a year) and in your browser's local storage.

Our contact page loads Cloudflare Turnstile, which checks that the form is sent by a person. Cloudflare's Turnstile privacy addendum describes what it collects; it uses it to detect bots, not to identify or track you. Turnstile is not loaded on any other page.

Your rights

You can ask us for a copy of your personal data, ask us to correct or delete it, object to or restrict how we use it, and ask to receive it in a portable format. You can also delete your account yourself in the platform, under Settings → Account. Where we rely on consent, you can withdraw it at any time. Email privacy@aggrefine.com and we will reply within a month.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY) or the authority in the country where you live.

If your organization's admin invited you, some of your data is managed by that organization. We will help them answer your request.

Security

Data is encrypted in transit and at rest. Each customer's data is kept separate from other customers' data, and only the people who need access to run the service have it. You can read more on our security page.

Changes

If we change this policy in a way that matters, we will tell you by email or in the platform before the change takes effect. The date at the top shows when it was last updated.