Affiliate Privacy Notice

Effective date: 2026-07-10 · Version: 1.0 (pilot)

This Affiliate Privacy Notice ("Notice") describes what data Bot for Kalshi collects from affiliates, what data affiliates can see about referees, and how that data is used, retained, and shared. It supplements (and where there's overlap, refers back to) our general Privacy Policy, which governs everything else about how we handle personal data.

Plain-language summary. We collect what we need to pay you and prevent abuse — your account email, payout info, IRS forms past $600. You see masked information about people you've referred so you can verify your commissions, but never enough to identify or contact them. We don't sell affiliate data. We retain payment records for 7 years because the IRS makes us. You can email support@botforkalshi.com to request access, correction, or (where we can) deletion.

1. Scope of this Notice

This Notice applies specifically to your participation in the Bot for Kalshi affiliate program. For everything else — site-wide analytics, your Bot for Kalshi account, your trading activity, your billing data when you're a paying customer — refer to the general Privacy Policy. Where this Notice says less than the general policy, the general policy fills the gap. Where it says more or differently, this Notice controls for affiliate-program data.

2. Data we collect about you (as an affiliate)

Category	What	Why
Account	Your email and (if provided) name from your existing Bot for Kalshi account.	Identify your codes, send program-related email, contact you about payouts.
Affiliate code & activity	The code(s) you claim, the date you claimed them, deactivations, edits.	Run the program. Surface in your dashboard and the admin tools.
Performance	Click counts and signups attributed to your code(s), derived from the `aff_code` cookie + page-view logs + signup events.	Calculate your commission. Show you per-placement analytics in /affiliate/analytics.
Payout details	Bank account or Stripe Connect account information (collected by Stripe, not by us directly); mailing address for tax forms; tax classification (W-9 for U.S. persons, W-8 for non-U.S.).	Pay your commissions. Issue required tax forms.
Tax records	Cumulative commissions paid per calendar year; copy of the Form 1099-NEC if you earned $600+ in that year.	Comply with IRS reporting and withholding rules.
Abuse signals	IP addresses tied to clicks on your link, browser fingerprints, payment-method fingerprints of referees, click-to-signup timing patterns.	Detect self-referrals, click fraud, and other prohibited conduct (see Affiliate Terms §10).
Dashboard usage	Page views on `/affiliate/`, API calls to `/api/affiliate/`, support requests you send us.	Improve the dashboard, debug issues, answer support tickets.

3. Data you see about referees

Your dashboard intentionally shows less about referees than the kalshi_bot operations team can see, because you don't need their identity to verify your commissions — you just need to confirm the math.

You can see	You cannot see
Masked email (e.g. `j***e@gmail.com`) — enough to disambiguate two signups, not enough to contact them.	Full email address.
Date the signup occurred and the date it qualified.	Name, billing address, phone, demographic data.
Commission amount and payout status (accrued / qualified / paid / refunded / voided).	Payment-method details, card brand, card last-4.
Aggregate clicks per UTM source you tagged, in /affiliate/analytics.	Anything the referee does inside Bot for Kalshi — bots they build, trades they place, their P&L, their Kalshi API key.
Whether a payout was paid out, when, and the method (ACH/Stripe Connect).	The Stripe customer ID, the Stripe subscription ID, internal user IDs.

You are not permitted to contact referees using any information visible in the dashboard, or to attempt to de-anonymize them. See Affiliate Terms §13.

4. How we use your data

Pay you. Calculate commissions, run payouts, generate tax forms.
Run the program. Display your dashboard and analytics, send program emails (payout notifications, terms changes, end-of-pilot updates), respond to support requests.
Prevent abuse. Detect self-referrals, click fraud, fake signups; investigate suspected violations of the Affiliate Terms.
Comply with law. Tax reporting, response to lawful legal process, fraud investigations.
Improve the program. Aggregate (de-identified) performance data informs how we evolve the offer.

We do not use your affiliate-program data to train any AI/ML model, build advertising audiences, or profile you for any purpose unrelated to running the Program.

5. Who we share it with

Stripe (payment processor) — bank/Connect account details, payout amounts. Subject to Stripe's Privacy Policy.
IRS & state tax authorities — Form 1099-NEC and the underlying data if you earn $600+ in a calendar year.
Our infrastructure providers — Railway (compute), Supabase (Postgres database), Resend (transactional email), Cloudflare (DNS/CDN). They process data on our behalf under standard data-processing agreements and are not permitted to use it for their own purposes.
Law enforcement — only in response to valid legal process (subpoena, court order, lawful government request) and only the specific data described in the request.
A successor — if Bot for Kalshi is acquired, affiliate-program data may transfer to the acquirer under the same terms.

We do not sell affiliate data. We do not share it with advertising networks, data brokers, or marketing partners.

6. Cookies & tracking

The affiliate program uses one first-party cookie specifically:

aff_code — set when a visitor clicks /r/<YOURCODE>. Lifetime: 90 days. Httponly, SameSite=Lax, secure in production. Contains only the uppercased affiliate code (no PII).

For information on the other cookies the site uses (analytics, session, etc.), see the general Privacy Policy.

7. Your choices & rights

Access. You can see your own affiliate-program data in the /affiliate dashboard and the Payouts page. For a full data export including everything we hold, email support@botforkalshi.com.
Correction. Update your account email or payout details through your account settings, or by emailing us.
Deletion. Most affiliate-program data is tied to financial records we're required to keep (see §8). Where we can delete identifying information without breaking required retention, we will — email us. If you've never reached the 1099 threshold, we can deactivate your code and remove most identifying details.
Opt-out of marketing email. Program-related transactional email (payout notifications, terms changes, abuse alerts) cannot be opted out of while you're an active affiliate. If you want to stop receiving them, withdraw from the program.
Withdraw. You may leave the program at any time (see Affiliate Terms §15). We will continue to process previously-qualified commissions and retain the records required for tax reporting.

If you are a California resident, see the "California rights" section of the general Privacy Policy — the CCPA rights described there extend to affiliate-program data.

8. Retention

Active affiliates. Held for the duration of your participation plus 7 years after your last commission payment (per IRS recordkeeping requirements for 1099-eligible payments).
Affiliates who never earned a payout. Held while your code is active. Deleted on request, or automatically 24 months after the last activity if we can't reach you at your account email.
W-9 / W-8 forms. Retained for at least 4 years after the last tax year for which they were used (per IRS Reg. §31.6109-1(c)).
Tax forms we issue (1099-NEC). Retained for at least 4 years.
Abuse-investigation data. Retained until the investigation closes plus a reasonable period (typically 2 years) in case of related claims.
Aggregate / de-identified data. May be retained indefinitely.

9. Security

The affiliate-program data store sits on the same Supabase Postgres database as the rest of the application. It's protected by:

TLS in transit for all client connections.
Encryption at rest by the database provider.
Row-level security policies that limit who can read what (the affiliate_payouts table is service-role-only, accessed only through the application server).
Bank/payout details handled by Stripe — we never see or store full bank account numbers ourselves.

No system is perfectly secure. If you suspect unauthorized access to your affiliate account, email support@botforkalshi.com right away. We will notify affected affiliates of any security incident as required by applicable law.

10. International transfers

Bot for Kalshi is operated from the United States. The Program is currently open only to affiliates who can receive payment in U.S. dollars via U.S. ACH or Stripe Connect. By participating in the Program from outside the United States you consent to the transfer and processing of your data in the United States, which may not provide the same level of data protection as your home jurisdiction. We do not currently offer Standard Contractual Clauses, UK IDTA, or other equivalent EEA/UK transfer mechanisms. EU/UK residents who require those should not participate in the Program until we expand support.

11. Children

The Program is not directed to and may not be used by anyone under 18. We do not knowingly collect data from anyone under 18 in connection with the Program.

12. Changes to this Notice

We may update this Notice from time to time. Material changes will be emailed to every active affiliate at least 30 days before they take effect; the updated effective date will appear at the top of this page. Continued participation in the Program after the effective date of a change constitutes acceptance of the change.

13. Contact

Questions about this Notice, requests for access/correction/deletion, or privacy concerns specific to the affiliate program: email support@botforkalshi.com with the subject "Affiliate privacy request" and we'll respond within 30 days.

See also: the Affiliate Program Terms, our general Terms of Service, and the general Privacy Policy.