Privacy Policy

This Privacy Policy describes how Selgeo (Apliteni OÜ; “we”, “us”, “our”) collects, uses and protects personal data of users of our platform (merchants and partners) as well as visitors to merchant websites in the context of our attribution services.

We operate in line with the EU General Data Protection Regulation (GDPR) and the ePrivacy Directive, building Privacy by Design into our cookie-free attribution architecture.

1. Who is the data controller?

Selgeo acts as the Controller for merchant registration data, Global Partner Account data and tax information.

Legal entity: Apliteni OÜ
Jurisdiction: Estonia (European Union)
Contact email: contact@selgeo.com

For merchant customers' data received from Stripe for attribution purposes we act as aProcessor and handle that data solely on the merchant's instructions.

2. What data we collect and on what basis

We only collect data that is necessary to operate the platform and to comply with EU law.

Subject category	Data types	Legal basis (GDPR)
Merchants	Email, name, company name, VAT ID, encrypted Stripe API keys / OAuth tokens.	Performance of a contract: Art. 6(1)(b) — providing access to the Workspace.
Partners	Email, name, hashed password, payout details, Tax ID, residential address, date of birth.	Performance of a contract: Art. 6(1)(b) — operating the Global Partner Account and recording commission payouts (email, name, hashed password, payout details); and Legal obligation: Art. 6(1)(c) — tax reporting under the DAC7 Directive (EU 2021/514) for the tax fields (Tax ID, residential address, date of birth).
Buyers	Email (via Stripe), purchase amount, transaction ID. Click IDs are stored in the visitor's browser sessionStorage — see Section 3.	Legitimate interest: Art. 6(1)(f) — ensuring attribution accuracy and fraud protection.

3. Our cookieless technology (ePrivacy)

No cookies. Our JS snippet on merchant websites does not set any cookies (first-party or third-party).
sessionStorage. We store the Click ID and technical tokens in the browser'ssessionStorage. This data lives only within a single tab and is cleared when the tab closes.
Server-side. Attribution runs on our servers via Stripe webhooks. We do not use browser fingerprinting or cross-site tracking.

4. How we use data from Stripe

The Stripe integration is used solely to:

Determine whether a conversion occurred and its amount, in order to calculate commissions.
Automatically synchronise promotion codes.
Check the status of refunds so we can adjust commissions accordingly.

We do not have access to full card numbers, CVV codes or payment history unrelated to your partner programme.

5. Where your data is stored (data residency)

EU data security is our priority.

Localisation. All personal data of EU data subjects is stored exclusively on servers within the European Economic Area (EEA).
Infrastructure. We use secure EEA-based data centres.
Transfers. We do not transfer data outside the EEA without Standard Contractual Clauses (SCCs) approved by the European Commission.

6. Who receives your data (sub-processors)

We do not sell your data. It may only be shared with a limited set of recipients:

Merchants and partners — mutual data exchange (email, reports) necessary to operate payouts.
Stripe — payment infrastructure. You connect your own Stripe account (Stripe is your own payment provider), and Stripe also processes your payment for the Selgeo subscription. It is not a Selgeo sub-processor of Merchant data — see the categorised list below.
Tax authorities — as part of DAC7 and VAT VIES reporting, where EU law requires it.
Hosting providers — operating our servers inside the EU.
Email delivery provider — sending transactional emails (account, payout and notification messages) on our behalf.

A current, named list of sub-processors with locations and transfer mechanisms is published atselgeo.com/sub-processors and updated at least fourteen days before any change.

7. Data retention

We keep data only as long as needed for the purposes in Section 2:

Accounts. Until the user deletes the account, plus 30 days for anonymisation.
Accounting data. 7 years (EU financial regulations).
DAC7 data. 10 years from the reporting period.
Attribution logs. The merchant's attribution window plus 90 days.

8. Your GDPR rights

You have the full set of rights over your data:

Access and portability — export your data in JSON or CSV from the dashboard.
Right to be forgotten — delete your account and anonymise all data not required by law.
Rectification — edit your profile and tax details in real time.
Object (Art. 21) — where we process your data on the basis of our legitimate interests (Art. 6(1)(f) — for example attribution accuracy and fraud protection), you may object at any time on grounds relating to your particular situation. We will then stop unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise, or defend legal claims.
Restriction (Art. 18) — you may ask us to restrict the processing of your data in the circumstances set out in Article 18 GDPR.
Withdraw consent (Art. 7(3)) — where processing is based on your consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out before then.
Right to complain — you can contact your local supervisory authority. In Estonia, that is Andmekaitse Inspektsioon (the Estonian Data Protection Inspectorate).

9. Security and incident notification

We apply strict protective measures under Art. 32 GDPR:

Encryption — TLS 1.3 in transit, AES-256 at rest.
Workspace isolation — data is isolated at the Workspace level.
Notification. In the event of a data breach we will notify the supervisory authority and affected individuals within 72 hours if the incident poses a risk to their rights.

10. Contact form on selgeo.com

If you send us a message through the contact form on selgeo.com, we process:

Name and email address — to identify you and reply to your enquiry. Legal basis: legitimate interest (Art. 6(1)(f)) — responding to an enquiry you chose to send us.
Message content — to understand and answer your enquiry. Legal basis: legitimate interest (Art. 6(1)(f)) — responding to an enquiry you chose to send us.
HMAC-SHA256 hash of your IP address (with a server-side pepper — the original IP is never stored) — to detect spam and abuse. Legal basis: legitimate interest (Art. 6(1)(f)).
Submission timestamp — to handle and triage your enquiry. Legal basis: legitimate interest (Art. 6(1)(f)).

Retention. 12 months from your last contact, unless your enquiry becomes part of an ongoing customer relationship.

Your rights. Emailcontact@selgeo.com to access or delete your contact record. Because we rely on legitimate interest, you may object to this processing at any time on grounds relating to your particular situation (Art. 21).

11. Cookies and analytics on selgeo.com

We use our own privacy-focused analytics (Lessly, a platform operated by the same company as Selgeo, Apliteni OÜ) on this marketing site to understand which channels bring visitors and how many go on to sign up. It runs in two modes, and the mode depends on your choice in our cookie banner:

Before you accept, or if you decline. We record an anonymous, cookieless page view: the page address, the site that referred you, and any campaign parameters (for example UTM tags) in your link. No cookies are set or read, and no visitor or session identifier is created — we cannot link one page view to another, or to you. Legal basis: legitimate interest in understanding aggregate traffic to our own site (Art. 6(1)(f)). Because nothing is stored on or read from your device, this does not require consent under the ePrivacy Directive.
After you accept the “statistics” category. Analytics cookies are set, which lets us recognise a returning visit and follow a visit through to sign-up. Legal basis: your consent (Art. 6(1)(a)).

Cookie	Purpose	Category	Retention
`_lt_aid`	Analytics visitor identifier	Statistics	Up to 400 days (~13 months)
`_lt_sid`	Analytics session identifier	Statistics	Session
`lessly_consent`	Remembers your cookie choice	Strictly necessary	Up to 12 months

Only after you accept. The lessly_consent cookie simply records your choice and is strictly necessary. The analytics cookies (_lt_aid, _lt_sid) are set only if you accept the statistics category.
Withdraw any time. Reopen the cookie preferences from the banner to change or withdraw your choice. Withdrawing deletes _lt_aid and _lt_sid and returns measurement to the anonymous, cookieless mode described above.

Lessly is operated by the same company as Selgeo (Apliteni OÜ) and runs on the same EU infrastructure, so your analytics data stays within Apliteni and the EEA — it is not shared with an independent third-party analytics provider.

12. Waitlist sign-up on selgeo.com

If you join our waitlist on selgeo.com, we process:

Email address — to add you to our announcement list and let you know when a place opens or the product is ready. Legal basis: your consent (Art. 6(1)(a)), given when you submit the waitlist form.
Sign-up source and date — so we can see which channels bring sign-ups. Legal basis: legitimate interest (Art. 6(1)(f)).

We share your email address with MailerLite Limited (Ireland, European Union), our email-marketing provider, which manages the list and delivers these announcements on our behalf. MailerLite stores the data primarily in the EU under its Data Processing Agreement; where it engages US-based sub-processors it relies on the EU-US Data Privacy Framework and the Standard Contractual Clauses for those transfers.

Retention. Until you unsubscribe or ask us to remove you, and in any case no longer than 12 months from your last interaction. Every announcement email carries a one-click unsubscribe link.

Your rights. Unsubscribe from any email, or contactcontact@selgeo.com to be removed. You can withdraw your consent at any time; withdrawal does not affect processing carried out before then.

Effective 11 July 2026. Contact:contact@selgeo.com.