Privacy Policy

Who we are

Nodsworth ("Nodsworth", "we") provides affiliate and operations services, including features we add over time, for online brands. Today the Service reviews a brand's affiliate data and prepares recommendations for the brand to approve. We are based in Illinois, USA. This policy covers nodsworth.com and app.nodsworth.com.

What we collect and why

We handle these kinds of data, for these purposes:

• Account and contact data: names, work emails, login details, billing contact and payment status, and messages you send us. We use it to run and bill your account, keep it secure and contact you about the service.
• Business and store data from files you upload or tools you choose to connect: for example orders, discount codes, sales, commission and payout figures, and the names and emails of your affiliates. We use it only to provide the service to you: checks, reports and recommendations.
• Usage data: records of what happens in your account, such as sign-ins, approvals and other actions, plus our host's standard server logs (IP address and page requested). We use it to run, secure and fix the service and to keep an audit trail. It is not used for advertising.

This policy covers new features that use the same kinds of data for the same purposes.

Before a material change, meaning price changes, new kinds of data we collect or use (for example payroll data), and sharing your data with a new kind of recipient or for a new purpose, we will update this policy and email customers first.

The sections below describe exactly what we collect today.

Free affiliate audit

When you ask for a free audit, we collect:

• brand name
• work email
• Shopify store address
• the affiliate export you upload (and a referrals export, if you add one), which can include affiliate names, emails, discount codes, sales and commission
• that you agreed to the consent statement on the form, and when

We use this only to prepare your audit and reply to you. Asking for an audit does not create an account.

Your contact details and files are encrypted when they arrive. Your files are opened only to prepare your audit, in a temporary workspace that is deleted afterwards. Your report is at a private link and shows affiliates by short handle and ID, not by email.

Everything for a free audit (your details, files, report, its link and our copies of the audit emails) is deleted automatically 30 days after it arrives, whether or not you become a customer.

We don't store your IP address with your request. To stop spam we limit how many requests can come from one network address or email in a short time. For that we keep a one-way hashed form of the address and email for up to 24 hours.

Only Nodsworth staff with an administrator role and two-step login can see audit requests. Views are logged.

If you use our short request form instead (no file), we keep the brand name, work email, store address, which affiliate app you use and roughly how many affiliates you have, and delete it after 180 days.

If you become a customer

Today, to do the work, we process:

• Account details: your name, email and login. Passwords are stored only as salted hashes. Two-step login secrets are encrypted.
• Files you upload, such as your UpPromote affiliate and referral exports. These can include affiliate names, emails, discount codes, sales and commission figures. We keep each file exactly as uploaded, so every number we show can be traced back to its source.
• If you upload a PayPal payment log, we keep only a one-way hash of each recipient email, not the email itself.
• If you connect Shopify: we ask only for Shopify's read_orders permission (read-only). We store just the order number, date, discount code and amount for orders that used an affiliate's code. We don't request customer names, emails, addresses or phone numbers. Your Shopify access token is encrypted, and it is deleted if you uninstall the app.
• Your decisions in Nodsworth (what you approved or declined), kept as a record.

We use this data only to provide the service to you. Messages to your affiliates are drafts that you approve, and today Nodsworth does not send them for you. If that changes, we will update this policy first.

What we never do

• Sell or rent your data, or your affiliates' data.
• Move your money, hold funds or make payouts. You pay affiliates in your own UpPromote or PayPal account.
• Store your PayPal, UpPromote or bank passwords or login details.
• Show ads or use advertising or analytics trackers.
• Send your data to AI model providers. We don't do this today; if that changes, we will update this policy and tell customers first.

Where your data is stored

Each customer's data is kept in its own separate database file with our hosting provider, Render, in the United States (Ohio region). Free-audit requests are kept in their own separate, encrypted store there. Data moves over encrypted (HTTPS) connections.

Service providers

We use these providers to run Nodsworth:

• Render (Render Services, Inc.): hosts the app and stores its data. Like most hosts, its standard server logs record the IP address and page of each request.
• Cloudflare (Cloudflare, Inc.): runs the DNS for our domain, and our host's network edge runs on Cloudflare, so web requests (including your IP address) pass through it.
• Resend: sends the emails our app sends, such as password-reset links and free-audit emails.
• Google Workspace (Google): hosts our email, so messages you send to hello@nodsworth.com and our replies are stored there.
• Stripe (Stripe, Inc.): subscription billing. Stripe collects card details on its own pages. We receive your billing contact and payment status; we never see or store full card numbers.
• Shopify: only if you choose to connect your store, under Shopify's own terms.

If we add a provider that would get a new kind of data or use it for a new purpose, we will tell customers first.

Cookies

We set one cookie, nodsworth_session. It keeps you signed in and links each form to your visit so others can't submit forms in your name (CSRF protection). It is marked HttpOnly and SameSite=Lax, is sent only over HTTPS on our live site, and expires after 12 hours at most. Signed-in sessions end after a period of inactivity. We use no advertising, analytics or third-party cookies.

Security

• Two-step login is required for all Nodsworth staff and for customer accounts with real business data.
• Staff see only the clients they are assigned to, with the access level they are given. Sensitive staff actions are recorded in a tamper-evident log.
• Login attempts are rate-limited.
• Text in uploaded files is treated as untrusted and checked for instructions aimed at software.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell you as required by law.

Keeping and deleting data

Free-audit requests and files: deleted automatically 30 days after they arrive. Short request-form entries: deleted after 180 days.

Customer data: kept while you are a customer. Uploaded files and financial records are set to be kept for up to 7 years by default, so figures stay traceable. You can ask us to delete your data at any time by emailing hello@nodsworth.com. We handle deletion requests by hand and will confirm when it's done, except where the law requires us to keep something.

Your choices and rights

You can ask to see, correct or delete your personal data, or ask what we hold about you. Email hello@nodsworth.com. We will answer within 45 days. If you are an affiliate of one of our customers, you can contact the brand you work with or us.

Children

Nodsworth is for businesses. It is not meant for anyone under 18, and we don't knowingly collect children's data.

Changes to this policy

If we change this policy, we will post the new version here with a new effective date. For material changes, meaning price changes, new kinds of data we collect or use (for example payroll data), and sharing your data with a new kind of recipient or for a new purpose, we will email customers before the change takes effect. Other changes, such as covering a new feature that uses the same kinds of data, take effect when posted.

Contact

Questions or requests: hello@nodsworth.com. Nodsworth, 2501 Chatham Rd #6030, Springfield, IL 62704, USA.