Effective date: 17th June 2024  |  Last updated: 22nd July 2026

Introduction

Fanzoone OÜ (registry code 16537736, Tornimäe tn 5, 10145 Tallinn, Estonia), which operates the CPA Hunter service ("CPA Hunter", the "Company", "we", "us" or "our"), respects your privacy. This Privacy Policy (the "Policy") describes how we collect, use, store and disclose data that you provide to us or that we obtain when you visit the cpahunter.io website (the "Site"), use the dashboard, the browser extension and other products and services (together with the Site, the "Service").

The Company acts as the controller of your personal data within the meaning of the EU General Data Protection Regulation 2016/679 (GDPR). We process data in accordance with the GDPR and Estonian law. For questions about the processing of personal data, write to hello@cpahunter.io.

Please read this Policy carefully. By using the Service, you agree to the practices described here. If you use the Service on behalf of an organisation, you agree to this Policy on its behalf. If you do not agree with the Policy, do not use the Service.

What Data We Collect

Data you provide. At registration, identity verification, arranging payouts and contacting support, we may collect:

• your name or the name of a legal entity;
• your email address and phone number;
• your country of tax residence and tax number (TIN);
• payout details and information required for identity verification (KYC), including, where necessary, documents confirming identity or status;
• the content of your enquiries and correspondence with us.

This data may be personal data, that is, information that directly or indirectly identifies you.

For payments and payouts, financial details are processed by third-party payment providers. We do not collect or store full bank card or account numbers; we store information about amounts, dates and statuses of transactions required for accounting.

Data we collect automatically. When you use the Service, we may collect:

• your browser type and operating system;
• your IP address, from which an approximate region can be determined;
• general-level location data;
• device identifiers;
• the sites you visited before and after the Service;
• the pages you view and the links you click within the Service;
• data about your interaction with our emails (opens, clicks);
• standard server logs;
• data collected via cookies, pixel tags and similar technologies.

Data about your activity in the Service. We process information about the affiliate links you create, the clicks and sales on them, the commissions accrued and confirmed, your balance and withdrawals, and the merchants and brands you work with. If you install the browser extension, it processes data needed to create affiliate links (for example, the address of the merchant page on which you use the extension).

Cookies and Similar Technologies

Cookies are small pieces of data stored by your browser. Pixel tags (web beacons) are small images or fragments of code that can recognise cookies and record page views. We use strictly necessary cookies to operate the Service, as well as analytics and marketing cookies. Non-essential cookies are set only with your consent, which you can give or withdraw via the cookie banner. You can also manage cookies in your browser settings; if you disable cookies, some features of the Service may become unavailable.

Connected Accounts and Social Media Verification

The Service lets you connect and verify ownership of your social accounts through official OAuth mechanisms. We request minimal read-only access, never receive or store your passwords, and never publish content on your behalf. Connected-account data is used solely to verify ownership and to display basic public profile information in your dashboard. We do not use this data for advertising, profiling or sale to third parties. All data transfers are protected by encryption (TLS). You can disconnect any account in your profile settings at any time – this revokes the stored tokens; to request full deletion of stored data, write to hello@cpahunter.io.

YouTube (Google). We use Google OAuth 2.0 with the youtube.readonly scope (read-only). Google API data is used only to retrieve the list of your channels, verify ownership of the channel being connected, and display basic public information (channel name, subscriber count and view count). Access tokens are used only during the one-time verification and are not retained afterwards; refresh tokens are not requested. Channel metadata (ID, URL, subscriber count and view count) is stored to maintain the association with your account. You can revoke access in your Google Account security settings. The Company's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

X (Twitter). We use OAuth 1.0a and the verify_credentials endpoint (read-only); we do not post tweets or modify your profile. We store your username, follower count, profile URL and profile ID, and the tokens, for the duration of the connection. You can revoke access in your X connected-apps settings.

Facebook. We request the minimal permissions email and public_profile; we do not post on your behalf, access your friends list, or manage your pages. We store your name, profile URL, email and ID, and the access token, for the duration of the connection. You can revoke access in your Facebook Business Integrations settings.

Twitch. We request the user:read:email scope; we do not manage your streams or channel settings. We store your username, view count, broadcaster type and ID, and the access and refresh tokens, for the duration of the connection. You can revoke access in your Twitch Connections settings.

Instagram (Meta). We request instagram_business_basic (read-only access to basic profile information); we do not publish content, read direct messages, or access your followers list. We store your username, follower count, profile URL and ID, and the access token, for the duration of the connection. You can revoke access in your Instagram apps-and-websites settings.

TikTok. We use TikTok Login Kit with the user.info.basic and user.info.profile scopes; you authorise the connection on TikTok's official screen, and we never receive your password. We store your account identifiers (open ID and union ID), display name, username, avatar and profile URL, the account verification flag, and the access and refresh tokens. Disconnecting the account revokes the stored tokens. We do not post on your behalf and have no access to direct messages, followers or videos beyond the public fields listed.

Purposes and Legal Bases for Processing

We process personal data only where there is a legal basis under the GDPR:

• Providing the Service – registration and account maintenance, link creation, accounting and payment of commissions, support. Basis: performance of a contract (Terms of Use and Partner Agreement), Art. 6(1)(b) GDPR.
• Identity verification, prevention of fraud and money laundering, accounting and tax records. Basis: compliance with legal obligations, Art. 6(1)(c), and legitimate interest in preventing fraud, Art. 6(1)(f).
• Click attribution and sale confirmation – transferring click data to merchants, brands and affiliate networks to confirm sales and accrue commissions. Basis: performance of a contract and legitimate interest, Art. 6(1)(b) and (f).
• Analytics, security and improvement of the Service, protection of our rights. Basis: legitimate interests, Art. 6(1)(f).
• Identity verification via one-time codes (by SMS or in messengers). Basis: performance of a contract and legitimate interest in security.
• Marketing messages, behavioural advertising and non-essential cookies. Basis: your consent, Art. 6(1)(a). Consent can be withdrawn at any time.

To Whom We Disclose Data

We may disclose data to the following categories of recipients:

• Processors (service providers) – hosting, analytics, sending of email and messages (including providers of WhatsApp and Viber services), payment processing, support. They act on our instructions and under data-processing agreements.
• Merchants, brands and affiliate networks – to the extent necessary for click attribution, sale confirmation and commission accrual.
• Public authorities – where required by law, to protect rights and security, prevent fraud or enforce the Terms of Use.
• In a business transfer – in the event of a sale, merger, reorganisation or bankruptcy, data may be transferred to the acquirer as part of the transaction. We will notify you of such a transfer.
• Other third parties – only with your consent.

We may disclose de-identified and aggregated data that does not identify specific users.

Transfers of Data Outside the EEA

The Company is located in Estonia (EU); however, some of our processors and partners are located outside the European Economic Area, including in the United States. When transferring data outside the EEA, we apply appropriate safeguards provided for by the GDPR – the Standard Contractual Clauses approved by the European Commission (SCC) and, where applicable, European Commission adequacy decisions.

Retention Periods

We retain personal data only for as long as necessary for the purposes of processing and within the limits required by law:

• account data – while your account is active and for a reasonable period after its closure;
• accounting and tax documents (invoices, self-billing) – 7 years, as required by the Estonian Accounting Act;
• identity-verification documents (KYC) – for the period set by anti-money-laundering law, generally 5 years after the relationship ends.

After closure of the account, we may retain some data to prevent fraud, protect our rights, resolve disputes and comply with the law.

Your Rights

In relation to your personal data, you have the right to:

• obtain access to your data and a copy of it;
• request rectification of inaccurate data;
• request erasure of data ("right to be forgotten");
• request restriction of processing;
• receive your data in a portable format and transfer it to another controller;
• object to processing based on legitimate interest, and to direct marketing;
• withdraw previously given consent at any time – this does not affect the lawfulness of processing before withdrawal;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you.

To exercise your rights, write to hello@cpahunter.io or change your data in the dashboard settings. We will respond within the periods set by the GDPR, generally within one month.

If we refuse your request, you may ask for an internal review. The review is carried out by a member of staff who was not involved in the original decision, and we will inform you of the outcome. This does not limit your right to lodge a complaint with the supervisory authority.

Right to Lodge a Complaint with the Supervisory Authority

If you believe we are breaching data-protection requirements, you have the right to lodge a complaint with the supervisory authority. In Estonia, this is the Data Protection Inspectorate:

Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia · info@aki.ee · +372 6274135 · www.aki.ee

You also have the right to contact the supervisory authority of your country of residence or work.

Artificial Intelligence and Automated Decisions

We use artificial intelligence and machine learning ("AI") technologies to: analyse the performance of content and links; personalise your experience and match relevant merchants and products; detect fraud, invalid traffic and inflation; generate recommendations; and improve and develop the Service.

We do not make decisions producing legal or similarly significant effects for you solely by automated means without appropriate safeguards. Your loyalty-tier status is determined on the basis of factual data – confirmed commission.

For training and improving models, we use only de-identified and aggregated data that does not identify you. We do not allow third-party AI providers to use your personal data to train their own models and algorithms.

Marketing Messages

If you do not wish to receive marketing messages from us, you can opt out via the "unsubscribe" link in any email, in your settings, or by writing to hello@cpahunter.io. Even if you opt out of marketing, we may send you service messages related to your account and the Service.

Social Media

The Service may allow you to post data to third-party services and platforms, including social media. If you use this feature, your activity may be visible to other users of the relevant platforms. If you connect social media, we may receive data you have made available to those services. Use of such data is governed by the policies of the relevant platforms, which we do not control.

Links to Third-Party Sites

The Service contains links to third-party sites, including to merchants and brands via the cpa.cx domain. These sites are operated by third parties and are not controlled by us. This Policy does not apply to them. We recommend reviewing the privacy policies of such sites.

Security

We take reasonable technical and organisational measures to protect personal data from loss, misuse and unauthorised access. Nevertheless, no transmission of data over the internet or by email is entirely secure, so please be careful when sending us information. In the event of a personal-data breach, we will notify the supervisory authority within 72 hours where required, and data subjects if the breach poses a high risk to their rights.

Children

The Service is intended for persons aged 18 or over. We do not knowingly collect personal data of minors. If we become aware that we have received a minor's data, we will delete it. If you believe we may hold such data, write to hello@cpahunter.io.

Changes to the Policy

We may amend this Policy from time to time. When we make changes, we will publish the new version on this page and update the date at the top, and will notify you of material changes by reasonable means. Changes take effect upon publication; your continued use of the Service constitutes acceptance of the revised version.

Contact

For questions about the processing of personal data, the exercise of your rights, and for general questions and support: hello@cpahunter.io.

Data controller: Fanzoone OÜ · registry code 16537736 · Tornimäe tn 5, 10145 Tallinn, Estonia · cpahunter.io