Privacy Policy

This policy covers openpromoter.com and OpenPromoter Cloud at app.openpromoter.com. DevDiggers Technologies runs both.

If you self-host OpenPromoter, your copy runs on your own server. It sends nothing to us. This policy then covers only your visits to openpromoter.com.

Who is responsible for your data

DevDiggers Technologies runs OpenPromoter.

Address: 548, Sector 12D, Awas Vikas Colony, Bodla, Agra, Uttar Pradesh, India, 282007
Email: support@openpromoter.com
Grievance officer: Yash Kapoor, at the same address and email

We do not sell personal data. We do not show ads.

Two roles we play

OpenPromoter holds two kinds of data. The law treats them differently.

Your own account. When a founder signs up, we decide how that account data is used. We are the controller for it.
Your affiliate program. A founder uses OpenPromoter to run a program for partners and customers. The founder decides what data goes in and why. We process it only on the founder's instructions. Our Data Processing Agreement covers this.

Are you a partner or a customer of a company that uses OpenPromoter? That company is responsible for your data. Ask them first. We will help them answer you.

What openpromoter.com collects

The website is a static site. It sets no cookies and runs no analytics or ad scripts.

Every request passes through Cloudflare. To deliver a page, Cloudflare processes your IP address, browser type and the page you asked for. It may log IP addresses to block attacks. See the Cloudflare Privacy Policy.

Your browser may store your light or dark theme choice. That setting never leaves your browser.

What OpenPromoter Cloud collects about founders

Your account

Your name, email address and password. We store the password as a one-way hash.
Two-factor settings and active sessions.
Your workspace and program settings, team members and their roles.
An audit log of important actions, such as payout approvals and setting changes.

Billing

You pay for a plan through Stripe. Stripe collects your card details. We never see or store full card numbers.

We keep your plan, invoices, billing country and tax ID if you give one. We need these for accounting and tax law in India.

Connections you add

You may connect Stripe, Paddle, Lemon Squeezy, Polar, Chargebee, PayPal or Wise. We store the keys or tokens these services give us. They are encrypted in our database.

What your affiliate program holds

A founder's program can hold data about three groups of people. The founder controls this data.

Partners: name, email, website, application answers, messages and payout details. Payout details are a PayPal email, a Stripe account ID or Wise details. Tax forms (W-9 or W-8BEN) include a tax ID. Tax IDs are encrypted.
Customers: the email, name and payment amounts the founder's billing tool sends us. We use them to work out commissions.
Visitors who click a partner link: a hashed IP address, browser type, country, landing page and referring page. The raw IP address is never stored.

The tracking script on a founder's website

The founder can add our script, op.js, to their own website. When a visitor arrives through a partner link, the script sets a first-party cookie named op_ref. It lasts 60 days by default. The founder can change the length.

The founder can also run the script without cookies or wait for consent. The founder is responsible for asking visitors for consent where the law requires it.

AI features

Some features use AI. Examples are the program designer, the recruiter and the assistant. When you use one, we send the needed program data to Anthropic, the company behind Claude.

Anthropic does not train its models on this data under its commercial terms. See the Anthropic Privacy Policy. The AI features work without partner tax IDs or payout details. We never send those.

Who processes data for us

These companies help us run OpenPromoter Cloud. Each one gets only what its job needs.

Company	What it does	Where
Hostinger	Runs our server and database	United States
Cloudflare	DNS, security and custom domains	Worldwide
Amazon Web Services	Sends email (SES) and stores backups (S3)	United States
Stripe	Takes plan payments and runs Stripe Connect payouts	United States
PayPal	Sends partner payouts when a founder chooses PayPal	United States
Wise	Sends partner payouts when a founder chooses Wise	United Kingdom and others
Anthropic	Runs the AI features	United States

We update this list before we add a new company. The DPA explains how founders hear about changes.

Where your data lives

Our server and database are in the United States. If you are in the European Union, the UK or India, your data leaves your country.

For data from the EU and UK, we rely on the European Commission's Standard Contractual Clauses. The DPA includes them.

Email

We send email you need to use the product. Examples are sign-in links, password resets, partner invites and payout notices. These come from Amazon SES.

Product news goes only to founders who ask for it. Every news email has an unsubscribe link.

How long we keep data

Account and program data: while your account is open.
After you delete your account: we remove it from our live database right away. Backup copies roll off within 30 days.
Invoices for your plan: as long as Indian tax law requires. That is usually about 8 years.
Click records: while the program exists. The founder can delete partners and their data at any time.

You can export your data or delete your account under Settings > Account.

Your rights

Where you live decides which of these rights you have:

Get a copy of your personal data
Correct data that is wrong
Delete your data where the law allows it
Take your data to another service
Object to how we use it or limit that use
Withdraw consent you gave earlier
Complain to your local data protection authority

These rights come from laws like the GDPR in the EU and the Digital Personal Data Protection Act in India.

Email support@openpromoter.com to make a request. We answer within 30 days.

Security

All traffic uses HTTPS.
Passwords are hashed. Keys, tokens and tax IDs are encrypted in the database.
Two-factor sign-in is available to every founder. Large payout batches ask for a fresh code.
Only the people who run OpenPromoter can reach the server.

No system is fully secure. If we learn of a breach that affects you, we tell you without delay. Report a security issue as our security policy explains.