Privacy

What Amazon Affiliate Finder stores when you run a search, how long it keeps it, who sees it, and how to reach us about it.

The search you run

A search is the keyword you enter, its status (queued, running, done or failed), the time it was filed, and the allowance it counts against. A search run from an account is linked to that account. A search run without an account is linked to a salted hash of the IP address the request came from and to nothing else: the address itself is never written down, and the daily free allowance is counted by tallying those hashed rows, so the count exists without the address existing.

Your keyword is turned into a small set of search phrases before anything leaves the server: the keyword with best, with review, with reviews, and with the Amazon affiliate disclosure phrase. Those phrases are what the search engine call sends.

The results

One row per site kept for the search: the domain, the ranking page that was read, the position that domain reached, the query that found it, how many Amazon product links the page carried, and the distinct affiliate tags those links used. A site keeps a row only when its ranking page carried at least one Amazon product link. The page is stored as a link so the row can point back to what was read.

The contact addresses

On a plan that includes contacts, a row also holds the addresses the site published on its own pages. Each one comes with a short label describing the address and the exact page URL it was found on. No address is guessed from a name and a domain, and nothing is checked by connecting to a mail server. There is no field for a person, a job title, a company or a mailbox owner, and we do not add one. The free plan keeps no addresses at all: its rows carry the sites, the pages and the link counts only.

The search engine cache

The answer a search engine returns for a query is saved in a cache keyed by that query string, so a repeated keyword does not pay for the same answer twice. The cache holds the pages the search engine returned for the phrase. It does not record who asked for it, and it never holds the addresses a site publishes. A saved answer is served for 7 days and then deleted by the same cleanup job that deletes searches.

How long we keep it

A search run from an account, and its sites and addresses, are deleted automatically 30 days after the search. A search run without an account is deleted after 24 hours. The deletion job reads the same constants this page does, so the window here is the window the code enforces, not a target. Deleting a search takes its site rows and the addresses stored on them with it.

Who processes the data

Three companies see data in the course of running the tool, and they see only the part their job needs.

• DataForSEO receives the search phrases built from your keyword and returns the ranking pages for them. It does not receive your account details, your IP address or the addresses a site publishes: the pages themselves are fetched by us, from the site.
• Cloudflare hosts the site and routes mail for our support address.
• Stripe handles billing. Card details go to Stripe directly, and no card number reaches us.

No shared contact database

An address lives inside the search that found it. We do not pool searches into one contact database, we never return an address found in one search in the results of another, and we never sell the results or a list built from them. A search returns what the sites it found published, and nothing else is built from it.

Why we may read those pages

The pages read are the ones a site publishes to the world, and the addresses returned are the ones the site put in public view on them. Our basis for reading them is legitimate interest: business contact discovery, on pages a public search engine ranked for your keyword, with no guessing and no pattern building beyond what the page says. Before a page is fetched, the crawler asks that site's robots.txt for permission, and a page the file disallows is not fetched. The crawler page describes how those requests behave and how a site can block them.

If you are in the EU and act on an address a result contains, you are responsible for the notice the GDPR requires for your own outreach. We send none on your behalf.

Opting out

Anyone can add an address to the opt-out list, and an address on that list is left out of every future search. The list stores a SHA-256 hash of the address and no other field, so it cannot be read back as a set of addresses. Add an address to the opt-out list.

Accounts and mail

An account holds an email address, a name if you give one, a password hash, the plan, the details Stripe sends us about the subscription, and the running count of searches charged in the month. The sign-in and sign-up endpoints count attempts in a short window, keyed by the same salted IP hash, so one network cannot use the service as a free load generator; those counters expire with their window. If a search runs long, one email saying it is ready goes to the account address. No other mail is sent, and nothing is sent to any address a result contains.

Deleting your account

You can delete your account yourself: Dashboard, then Delete account, and type DELETE to confirm. Any subscription is cancelled at once and does not renew. If billing cannot be reached, nothing is deleted and you can try again. Then your account record, your searches with their sites and addresses, your API keys, your usage rows and your search packs are deleted, and a search still waiting to run is dropped. The record of free searches started from your network keeps only the salted IP hash and the time, with no link to the account, so the daily free limit still holds. We keep one log entry saying an account was deleted, with its internal id, its Stripe customer id and the cancelled subscription ids, and no email address. Earlier entries in our staff log about the account are kept with your email address removed. Stripe keeps its own record of past payments.

Your rights and how to ask

Ask us what we hold, ask for a copy, ask for a correction, or ask us to delete it. A question about an address that appears in a stored result gets an answer naming the searches involved and the stored page URL each address came from, which is part of why the source page is kept. Mail [email protected] and say what you want to know or what you want deleted.

Who runs it

Amazon Affiliate Finder is a Quolapps product, made by Mike Wiberg. Quolapps is at quolapps.com. Privacy questions go to [email protected].