Worth.it Privacy Policy

Last Updated: [DATE] — TODO

THIS IS A DRAFT TEMPLATE AND HAS NOT BEEN REVIEWED BY AN ATTORNEY. DO NOT PUBLISH OR RELY ON THIS DOCUMENT WITHOUT LEGAL REVIEW.

This Privacy Policy explains how [LEGAL ENTITY NAME] — TODO ("Worth.it," "we," "us," or "our") collects, uses, and shares information when you use the Worth.it platform (the "Platform").

1. Information We Collect

1.1 Information You Provide Directly

Account information: name, email address, phone number, password, profile photo, and (for Businesses) company name and contact details.
Profile content: bio, product recommendations, links, and other content you choose to display on your Worth.it page.
Application information: information submitted by Promoters when applying to promote a Business's products.
Communications: information you provide when contacting us for support.

1.2 Information Collected Automatically

Usage data: pages viewed, links clicked, session duration, referral source, device and browser type, and IP address.
Click and attribution data: when a tracked link is clicked, we record the click, an associated identifier (such as a cookie or device ID), the timestamp, and the resulting attribution to a Promoter and product.
Sale/conversion data: information about whether a purchase occurred following a tracked click, as confirmed through our current sale-confirmation process (see our Terms of Service).

1.3 Information from Businesses

Businesses may provide data about product listings, commission rates, and sale confirmations related to Promoters on the Platform.

1.4 Payment Information

Payment method details (such as card numbers) are collected and stored directly by our third-party payment processor (currently Stripe), not by Worth.it directly. Worth.it does not store full payment card numbers on its own systems. [PENDING COUNSEL REVIEW — confirm this accurately describes our actual Stripe Connect integration (e.g., whether any tokenized payment data or account identifiers are stored by Worth.it), and confirm any resulting PCI-DSS obligations, before publishing.] — TODO

1.5 Other Sensitive Information

Beyond payment information (addressed above), we do not intentionally collect other sensitive categories of personal information (such as government ID numbers or health information) through the Platform.

2. How We Use Information

We use collected information to:

Operate and provide the Platform, including generating tracked links and profile pages
Attribute clicks and sales to the correct Promoter
Allow Businesses to review Promoter applications
Communicate with you about your account or the Platform
Analyze usage patterns to understand which factors correlate with successful promotion, in order to improve the Platform
Detect and prevent fraud, abuse, or violations of our Terms of Service
Comply with legal obligations

3. How We Share Information

Between Users and Businesses: A Promoter's public profile information is visible to anyone who visits their page. Application information is shared with the Business being applied to. Click/sale attribution data relevant to a specific Business's products is shared with that Business.
Service providers: We may share information with vendors who help us operate the Platform (e.g., hosting, database, analytics providers), under obligations to protect that information.
Legal purposes: We may disclose information if required by law, or to protect the rights, safety, or property of Worth.it, our users, or others.
Business transfers: If Worth.it is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.
We do not sell personal information to third parties for their own independent marketing purposes. [Confirm this statement matches actual practice before publishing — it is a specific, enforceable claim under laws like the CCPA.] — TODO

4. Data Retention

We retain account and usage information for as long as your account is active, and for a reasonable period afterward as needed to resolve disputes, enforce our agreements, and comply with legal obligations. [Specific retention periods should be defined based on legal requirements in your operating jurisdictions.] — TODO

5. Your Choices and Rights

Depending on your location, you may have rights to access, correct, delete, or port your personal information, or to opt out of certain uses. To exercise these rights, contact us at [CONTACT EMAIL] — TODO. [If you have users in California, the EU/UK, or other jurisdictions with specific privacy statutes (CCPA, GDPR, etc.), this section needs jurisdiction-specific language drafted by counsel — the obligations differ meaningfully by region.] — TODO

6. Cookies and Tracking Technologies

We use cookies and similar technologies to operate tracked links, remember your session, and understand usage of the Platform. You can control cookies through your browser settings, though disabling cookies may affect the accuracy of link attribution and therefore your ability to earn commission correctly.

7. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect information collected through the Platform. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Children's Privacy

The Platform is not directed to individuals under 18, and we do not knowingly collect personal information from anyone under 18.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last Updated" date, and material changes will be communicated as required by law.

10. Contact Us

Questions about this Privacy Policy can be sent to [CONTACT EMAIL] — TODO.

This document is a draft template only and does not constitute legal advice. Consult a licensed attorney before publishing or relying on this Privacy Policy, particularly regarding data collection scope, retention, and jurisdiction-specific privacy law compliance (e.g., CCPA, GDPR).