Promio ("we", "us") operates an affiliate and referral program platform that connects companies running programs with affiliates who promote them. This policy explains what personal data we process, why, and what rights you have. For questions, contact support@promio.me.
The data controller responsible for this website is:
Promio, a business of Péter Rápli
Herbersteinstraße 4/2076, 8020 Graz, Austria
Email: support@promio.me
Full business details are in our Impressum.
Account data — name, email address, password (stored as a salted hash), account type, and for companies the company name and website. Provided by you at signup.
Program activity — programs you create or join, referral codes, messages between companies and affiliates, uploaded assets, and settings.
Payment and payout data — your subscription payments, the record of affiliate payments companies mark as made, and payment references. Subscription card details are processed by Stripe or Shopify and never stored on our servers.
Affiliate payment instructions — affiliates can save a free-text note saying how they want to be paid, which may include bank, PayPal or other payment details if they choose to enter them. We store that note and show it to the companies that owe them commission, because those companies pay affiliates directly. Promio never collects, holds or transfers affiliate commission itself and does not use these details to move money.
Affiliate bank account (SEPA) — affiliates can optionally save an account holder name, IBAN and BIC. We show them, masked, only to the companies whose programs the affiliate has joined, and include them in full only in the SEPA payment file such a company generates to pay its affiliates from its own bank account. Promio does not execute these payments. A generated payment file is deleted when the company discards it and 90 days after it is marked paid; the bank details themselves are kept while the account exists and removed when the affiliate clears them or deletes the account. Changes to an IBAN are logged and shown to the companies concerned, to protect against fraud.
Referral tracking data — when you click an affiliate link or buy from a participating company's site, we process the referral code, page URL, referrer, IP address, browser user agent, order identifiers, and order amounts. We process this on behalf of the company running the program, to attribute conversions and calculate commissions.
Store integration data — when a company connects its store to Promio through an integration such as our Shopify app or WooCommerce plugin, we receive limited order details for referred orders — the customer's email and name, order total, currency, order identifiers, and any referral or discount code used — solely to attribute the sale to the right affiliate, calculate or reverse the commission, and reconcile invoices. For this data the company is the controller and Promio acts only as its processor under the data processing agreement in our Terms. We do not use it for our own marketing and do not sell it. Retention follows our internal Data Retention Policy, and we honor store and customer data-deletion requests (including Shopify's data-request, customer-redact, and shop-redact webhooks).
Security data — IP addresses in security and audit logs (sign-in attempts, sensitive account actions), kept to protect accounts and prevent abuse.
On Promio itself we use strictly necessary cookies: an authentication cookie for signed-in sessions and a session cookie for security features. We do not run third-party advertising trackers.
On participating companies' websites, our tracking snippet stores a referral code in a first-party cookie and local storage for attribution. This is placed by the company as part of their affiliate program; the company is the data controller for it.
To provide the platform (accounts, programs, tracking, commissions, payment records, bank payment files, credit notes), to send transactional email (password reset, email verification) and service notifications you can switch off in your profile, to secure the platform (rate limiting, audit logs, fraud checks such as self-referral detection), and to comply with legal obligations such as invoicing records. We do not sell personal data.
Stripe (subscription payments), Brevo (transactional email delivery), and our hosting provider. Each processes data under their own data processing agreements.
Account data is kept while your account exists. Conversion, payment and credit-note records are kept as long as required for accounting and legal purposes. Security logs are kept for a limited period. When you delete your account, we remove or anonymize personal data that we are not legally required to retain.
Where the GDPR applies, you may request access, correction, deletion, restriction, portability, or object to processing, and you may lodge a complaint with your supervisory authority. Email support@promio.me to exercise these rights. You can change your email notification preference in your profile at any time.
We will post any changes to this policy on this page and update the date above. Material changes will be announced in the app or by email.
