Privacy Policy

Effective date: 3 November 2026

Provestats lets affiliates connect their affiliate-platform accounts through read-only APIs and share verifiable, view-only statistics with operators. This policy explains what personal data we collect when you use provestats.com, why we collect it, and the rights you have under the EU General Data Protection Regulation (GDPR). We have tried to keep it as plain as the product itself.

1. Data controller

The controller responsible for your personal data is:

2. Data we collect

a) Account data. When you sign up we ask for your e-mail address, your Telegram handle and a password. The password is stored as a salted hash — we cannot read it. We do not require your name or identity documents. If you create an optional operator workspace, you choose a workspace name, which may identify your business.

b) Platform connection data. When you connect an affiliate platform (for example CellXpert, Affilka, RefferOn, Income Access, MyAffiliates or NetRefer), we store the read-only API credentials you provide — such as platform URL, affiliate ID and API key — in encrypted form. Through that connection we retrieve the statistics the platform API returns: reconciliation figures and pseudonymized player-level metrics (geo, deposit counts and amounts, turnover, NGR, bonus figures and activity dates). We never pull your platform password, system player IDs, tracking links or your commission data — the connection is limited to read-only reporting functions by design.

c) Share-link data. When you create a share link we store its settings (selected fields, date range, expiry, one-time view) and log accesses by viewers: timestamp, IP address and browser type. These logs exist so you can see that your report was opened and so we can enforce expiry and one-time-view rules.

d) Partner program data. If you join the partner program, we record clicks on your personal referral link (provestats.com/r/<id>) — timestamp, IP address and browser type — and the registrations that result from them, so we can attribute verified sign-ups to you and detect fraudulent traffic.

e) Payment data. Paid plans are billed through Stripe (card and Apple Pay) and BitPay (cryptocurrency). Your card number and full payment details go directly to those providers; we never store card numbers. We keep only what we need for billing records, such as the plan, amount, date and a payment reference.

f) Support communications. If you contact us by e-mail or Telegram, we process the messages you send us and the contact details you use, in order to help you.

g) Staff referral data. If you sign up through a Provestats team member's link, we record whose link it was.

g) Operator workspace data. Optional workspaces store their name, team memberships, roles, status, invitations and an audit history of workspace actions. An invitation records the recipient e-mail, issuing Admin, role and acceptance or revocation. Operator referral registration attribution is separate from the partner program and does not give anyone access to your reports. Each workspace keeps one record per affiliate: how and when you became its affiliate (you signed up through its referral link, sent it a report, or one of its members added a report you shared by link), which team member the record belongs to, whether and when you agreed to share your e-mail address and Telegram handle with it, and a name and notes its team may add about you. We record a report submission only when you explicitly send an owned share link to a workspace or when a workspace member adds a report you shared by link to their workspace (the submission then also records which member added it), and record any later withdrawal.

3. Purposes and legal bases

We process personal data only where the GDPR gives us a legal basis to do so:

• Performance of a contract (Art. 6(1)(b)): creating and running your account, connecting platforms, generating and serving share links, operating the partner program and optional operator workspaces, and billing paid plans.
• Legitimate interests (Art. 6(1)(f)): preventing fraud and abuse — including enforcing the rule that one platform account can only ever be linked to one Provestats account — securing the service, keeping viewer access logs, and improving the product.
• Legal obligations (Art. 6(1)(c)): keeping accounting and billing records as required by Danish bookkeeping law.
• Consent (Art. 6(1)(a)): where a specific feature requires it. You can withdraw consent at any time without affecting processing that happened before withdrawal.

4. What we never do

• We never sell personal data — yours or anyone else's.
• We never show your commissions, system player IDs or tracking links to the people who view your share links. These fields are not retrieved in the first place.
• We never write to your platform accounts. Connections are read-only, and we cannot modify anything at the source.

5. Recipients and processors

We share personal data with service providers who help us run Provestats, under data processing agreements where required, and — when you sign up through an operator workspace's referral link, send it a report, or one of its members adds a report you shared by link — with that workspace, as described below:

• Our hosting provider, which stores the service's data on our behalf.
• Email delivery — Resend (transactional email: account and security messages; EU data-residency region; processed under a Data Processing Agreement).
• Stripe, for card and Apple Pay payments.
• BitPay, for cryptocurrency payments.
• Telegram, when we communicate with you for support or send you notifications on the handle you provided.
• The affiliate platforms you connect (for example CellXpert, Affilka, RefferOn, Income Access, MyAffiliates or NetRefer), to the extent needed to execute the API connection you set up.

Workspace Admins can see team membership and invitation details. Managers see their own workspace activity. If you sign up through a workspace's referral link, send a report to a workspace, or a member of a workspace adds a report you shared by link, that workspace's Admins and the manager your record belongs to can see when and how you joined and any name and notes they add about you; other Managers cannot. They also see your contact details once you share them with that workspace, by sending it a report or by signing up through its referral link when the sign-up form's notice tells you so. Your contact details are the e-mail address and Telegram handle currently on your account, including later changes you make in Settings (the handle as you entered it; we do not verify it). If you signed up through a referral link before that notice existed, the workspace sees your contact details only after you send it a report. Your contact details also reach a workspace when one of its members adds a report from a share link you created while the share dialog said that operators who add the report will see your e-mail address and Telegram handle: its Admins and the manager your record belongs to see them, and the member who added the report sees your e-mail address next to it. A share link you created before that notice existed never shares them. We notify you when a workspace adds your report, and you can withdraw it from that workspace on Send to operator, as you can a report you sent. Names and notes stay inside that workspace: we do not show them to you in the app, but your data export includes them. When you explicitly send a report, the workspace Admins and the original referring Manager can also open the report while its share link remains available, and a report a member added can be opened by the Admins and that member; other Managers cannot open it. Withdrawing a submission removes workspace access to the report through that submission; your contact details stay visible to that workspace until you withdraw them or delete your account. You can withdraw this sharing at any time by e-mailing info@techedz.com: we then stop showing your contact details to that workspace in Provestats, apart from the e-mail address shown with the reports you sent it (it may already have noted them). Sending it a report again, or a member adding a share link you create after your withdrawal under the share dialog's notice, shares them again; a member adding a link you created before your withdrawal does not. Revoke the public share link separately if you also want to stop access through its URL.

6. International transfers

Our service is hosted in the EU/EEA. Where a provider processes data outside the EEA — for example a payment provider or Telegram — we rely on European Commission adequacy decisions or Standard Contractual Clauses (SCCs) to protect the transfer. Our email delivery processor, Resend, is configured for the EU data-residency region and is bound by the same Standard Contractual Clauses (SCCs) safeguard for any residual cross-border processing.

7. Retention

• Account data is kept while your account is active, and afterwards only as long as statutory periods require.
• API credentials are deleted when you disconnect a platform or delete your account.
• Viewer access logs and expired-link data are kept for a maximum of 12 months.
• Partner referral click logs keep the visitor's IP address and browser type for a maximum of 12 months; after that we remove both and keep only the anonymous click count.
• Operator invitations are removed in the daily sweep 30 days after expiry, acceptance or revocation. Deleting an account also removes invitations sent to its e-mail, accepted by it or issued by it.
• Billing records are kept for 5 years under the Danish Bookkeeping Act.

When you delete your account, we immediately and irreversibly anonymize the account record: your e-mail address is replaced with an anonymized identifier, your password and stored platform credentials are destroyed, and your Telegram link is removed. Your notification history, security tokens and data exports are deleted at the same time. What remains afterwards is kept in a form that no longer directly identifies you — billing records (5 years, under the Danish Bookkeeping Act), the record that a platform account has been claimed by a Provestats account (kept for fraud prevention — see the one-account rule in section 3), aggregate partner-program statistics, and internal security-audit entries.

Account deletion archives your workspace memberships and withdraws your report submissions; share links are revoked and their recoverable tokens are erased. If you are the last active Admin, the workspace and all its memberships are archived. Deletion also erases the names, notes and contact-sharing consent that workspaces keep about you; because your account record is anonymized, your e-mail address and Telegram handle disappear from their lists. Registration counts and workspace audit history remain linked to the anonymized account record.

8. Security

All traffic to and from Provestats is encrypted in transit using TLS. Platform API credentials are encrypted at rest. Access to production data is restricted to personnel who need it, and platform connections are read-only by design — even in the worst case, a Provestats connection cannot be used to change anything in your platform account.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased ("right to be forgotten");
• restrict processing in certain circumstances;
• receive your data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, e-mail info@techedz.com. We respond within one month. You also have the right to lodge a complaint with Datatilsynet, the Danish Data Protection Agency (www.datatilsynet.dk), or with the supervisory authority in your own EU country.

Settings lets you request a data export, available to download for 7 days. It includes your own workspace memberships, invitation, registration attribution, report submission and audit-event metadata, and the record each operator workspace keeps about you — including any name and notes its team added. It excludes invitation secrets, report URLs, API credentials and other users' private data.

10. Cookies

Provestats uses only strictly necessary cookies and local storage — the minimum needed to keep you logged in, keep the service secure and carry your requested referral or invitation flow across pages. An operator referral cookie preserves the first referral for up to 30 days; an operator invitation cookie lets you resume explicit acceptance after sign-in for up to 7 days. A team referral cookie remembers which Provestats team member's link you followed, for up to 30 days. Registration alone never accepts an invitation or shares reports. We do not use advertising cookies, analytics cookies or any third-party trackers, so there is no cookie consent banner to click through.

Fonts are self-hosted; no font requests leave our servers.

11. Player data in reports

Reports on Provestats contain pseudonymized player-level metrics (geo, deposit counts and amounts, turnover, NGR, bonus figures and activity dates) as returned by the affiliate platform. Provestats displays this data without alteration and does not attempt to re-identify anyone. Affiliates control who sees their reports through share-link settings (field selection, expiry, one-time view) and remain responsible for their own sharing choices — if you share a report with an operator, that is your decision about your data.

12. Age limit

Provestats is a business tool for the iGaming affiliate industry and is intended for adults only. You must be at least 18 years old to create an account. We do not knowingly collect data from anyone under 18; if we learn that we have, we will delete it.

13. Changes to this policy

We may update this policy when the service or the law changes. The effective date at the top always shows the current version. For material changes, we will notify you by e-mail or Telegram before they take effect. Continued use of Provestats after that date means the updated policy applies.

14. Contact

Questions about this policy or about how we handle your data? Write to info@techedz.com and we will get back to you.