Privacy Policy

1. Controller details

[Insert AFFINEX legal entity name, registration number, registered address, business address, jurisdiction, VAT details if applicable, official email and regulatory/licence disclosures after legal review.]

2. Personal data we may collect

• Application and contact data: full name, country, email, Telegram username, Instagram username, WhatsApp number, preferred contact method, application answers, experience, potential-player estimates, audience/network information, target markets and social links.
• Account and role data: account ID, email, authentication method, role, agent/admin/super-admin status, login/security information and MFA status where applicable.
• Application administration data: application date/time, status, assigned admin, internal notes, approval/decline records and contact history.
• Agent data: agent ID, referral link, B-TAG, commission rate, join date, account status, assigned manager and performance information where connected.
• Support data: support requests, AI conversations, human-support escalations, email or Telegram contact, conversation history and timestamps.
• Technical data: IP address, device/browser information, analytics, cookies, security logs, session data and login timestamps where collected.

3. Purposes and legal bases

• Application review, onboarding, account creation, authentication, commission administration and partner support may be processed for contractual necessity or steps requested before entering a contract.
• Fraud prevention, security, audit logs, portal protection, abuse detection, network integrity, legal-risk management and service improvement may be processed on legitimate interests, balanced against user rights.
• Legal compliance, age and eligibility checks, sanctions/compliance reviews, accounting and regulatory obligations may be processed to comply with legal obligations.
• Analytics, optional marketing communications, non-essential cookies and certain preference-based processing may require consent depending on the jurisdiction and technology used.
• AI support may be processed to respond to user requests, improve support quality, maintain security and escalate issues to humans when needed.

4. Authentication and passwords

Users may authenticate using email/password, Google or Apple where enabled. AFFINEX admins must never view or set user passwords. Password resets use secure reset flows, and Google/Apple credentials remain controlled by those providers.

5. AI assistant and automated decisions

AFFINEX may provide an AI support assistant for common questions. AI responses are informational and may be inaccurate. Human admins are intended to make final application and approval decisions; AFFINEX does not intend to make legally or similarly significant decisions solely by automated processing without required safeguards.

6. Processors and third parties

AFFINEX may use vendors and third parties such as Lovable, Supabase, hosting providers, email providers, Google authentication, Apple authentication, analytics providers, AI providers, payment or security services and the underlying casino/platform where necessary for approved partner operations. AFFINEX should maintain appropriate processor agreements, transfer safeguards and vendor disclosures.

7. International transfers

Personal data may be processed outside the user’s country or outside the EEA depending on vendor infrastructure and support workflows. Where required, AFFINEX should use appropriate transfer mechanisms such as adequacy decisions, Standard Contractual Clauses, transfer impact assessments and supplementary safeguards.

8. Data retention

• Rejected applications: retain only as long as reasonably necessary for application records, fraud prevention, dispute handling and legal obligations; a practical review period should be finalized by counsel.
• Approved agents: retain during the relationship and afterward as needed for accounting, audit, legal, fraud-prevention, tax and dispute purposes.
• Support records and AI chats: retain for support continuity, quality, security and dispute purposes, then delete or anonymize according to a defined schedule.
• Security records and audit logs: retain long enough to investigate security events, protect the platform and meet legal obligations.
• Terminated accounts: retain minimum records needed for legal, fraud, accounting and compliance purposes, then delete or anonymize where possible.

9. User rights

Depending on applicable law, users may have rights to access, rectification, erasure, restriction, objection, portability, withdrawal of consent and complaint to a supervisory authority. AFFINEX should provide a clear contact channel for GDPR and privacy requests.

10. Cookies and analytics

Essential authentication, session and security cookies may be used without consent where strictly necessary. Analytics, advertising, preference and some third-party technologies may require prior consent, a cookie banner, preference controls and a standalone Cookie Policy depending on jurisdiction and configuration.

11. Security

AFFINEX uses reasonable technical and organizational measures designed to protect accounts and personal data, including role-based access, MFA support for sensitive access, secure password-reset flows, access controls, audit logging and monitoring. No system can be guaranteed completely secure.

12. Data requests

Users can request access to or export of their personal information by contacting partners@affinexnetwork.com or using the data-request page. Identity verification may be required before fulfilling requests.