Privacy Policy
Welcome to Commission Sync, a B2B SaaS platform operated by Pixel on Pixels (“we,” “us,” or “our”). This Privacy Policy explains how we collect, use, and protect information when publishers (“Creators”) use our service, and how we process data when end-users interact with our widgets on Creator websites.
1. Data Collection for Platform Security and Rate Limiting
When end-users interact with the Commission Sync widget embedded on a publisher's domain, we temporarily process their IP address to prevent distributed denial-of-service (DDoS) attacks, automated bot scraping, and fraudulent click-tracking manipulation.
- Lawful Basis: This processing is conducted under the legal basis of Legitimate Interest pursuant to Article 6(1)(f) of the UK GDPR, which expressly codifies processing necessary to ensure the security of network and information systems.
- Data Minimisation & Retention (Upstash Redis): Raw IP addresses are never logged or stored in our persistent databases. Upon transmission, the IP address is immediately subjected to a one-way cryptographic hash (SHA-256) with a hidden salt. The resulting pseudonymised string is held in volatile, in-memory infrastructure exclusively for rate-limiting calculations and is automatically, permanently destroyed upon the expiration of a strict Time-to-Live (TTL) window (maximum 60 minutes).
- Strict Purpose Limitation: This pseudonymised security data is strictly isolated. Pixel on Pixels guarantees this data will never be utilized for user profiling, marketing, cross-site behavioral tracking, nor sold to third-party data brokers.
2. Data We Collect from Creators (Our Customers)
If you create an account to use Commission Sync, we collect:
- Authentication Data: Name, email address, and profile picture (via Google OAuth / NextAuth).
- Billing Information: Processed securely via Stripe. We do not store your raw credit card numbers.
- Configuration Data: Domain whitelists, Yazing usernames, and widget preferences stored in MongoDB.
3. Creator Obligations (Data Controllers)
Creators utilizing Commission Sync act as the “Data Controller” for their own websites. Creators agree to explicitly inform their users about the use of our widget for affiliate routing and security IP hashing by including our standard disclosure snippet in their own Privacy Policies.