Privacy in the partner programme

Version 2026-11-04. Controller: Appsentials, owner Luis Benz, Comeniusstr. 4, 01307 Dresden, Germany, hello@monetais.de. This section supplements our privacy policy for the Appsentials partner programme.

1. Visitors of the referral page and merchants

When you open a partner's referral link (appsentials.com/r/…), we store: the time, the partner, the chosen app, a shortened browser identifier (user agent) and an irreversible hash of your IP address formed with a secret key. We do not store the IP address itself; the hash only serves to merge repeated visits. If you enter your Shopify address or redeem a partner code on this page, we also store that address – only then is your shop attributed to the partner.

When you open the app in your Shopify admin for the first time after installing it, the app may report once your shop address (…myshopify.com) and the time. We do not use this report to attribute your shop to a partner; we do not store the IP address of that request, nor its hash.

We also match this with the install and payment data Shopify provides to us as app developer via the Partner API, to determine whether your shop came to us through the partner and to calculate the partner's commission. To prevent abuse we also compare the shop's email address, domain and name with the partner's (self-referral) and merge repeated visits with the same IP hash within 24 hours into one click.

The legal basis is our legitimate interest in correct settlement with our partners and in preventing abuse (Art. 6(1)(f) GDPR). We set no cookie for this and read nothing from your device.

The partner only learns a running number, the first three letters of your shop address, which of our apps you use and whether the shop is active – no name, no contact details, no revenue.

Clicks that do not lead to an attribution are deleted after 90 days. For attributed shops we remove the IP hash and browser identifier after 90 days; the shop address and attribution are kept as the basis for settlement while commissions accrue, and then for the statutory periods (up to 10 years).

2. Partners and applicants

For applications we process name, email address, company, website, type of activity, language and your message. After approval we add: address and country, tax details (VAT ID, tax number, small-business or private-individual status), bank account (IBAN, account holder) or PayPal address, acceptance of the programme terms (version and time), your clicks, attributed shops, commissions, payouts, credit notes and the emails we send you.

Legal bases: performance of the partnership and pre-contractual steps (Art. 6(1)(b) GDPR), statutory retention and invoicing obligations (Art. 6(1)(c) GDPR with sec. 14, 14b UStG, sec. 147 AO) and our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

After login, the partner area sets a strictly necessary session cookie (“aspartner”, 30 days). Login links are valid for 30 minutes and work once.

Rejected applications are deleted after 6 months. Data of active partners is kept for the duration of the partnership. Credit notes, payout and booking records are kept for 10 years as required by German tax law and deleted afterwards.

3. Recipients and processors

Hosting: Fly.io, Inc., USA (servers in the EU [please verify region]). Emails to partners: Brevo (Sendinblue GmbH, Berlin). Notifications to us: Resend, Inc., USA. Application form fallback: Netlify, Inc., USA. Data processing agreements are in place with all processors; transfers to the USA rely on the EU-U.S. Data Privacy Framework where the provider is certified, otherwise on EU standard contractual clauses.

Payouts go through our bank or PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Our tax advisor and the tax office receive settlement records where required by law.

4. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR). You may object to processing based on legitimate interests on grounds relating to your particular situation (Art. 21 GDPR). Write to hello@monetais.de.

You can lodge a complaint with a supervisory authority, e.g. the Saxon Data Protection and Transparency Commissioner.