QREasy Affiliate Privacy and Cookie Notice

Effective date and version: 23 July 2026, version 2026-07-23

This notice supplements the QREasy Privacy Policy and Cookie Policy for the QREasy Affiliate Program operated by IllumiNode LLC, 16192 Coastal Highway, Lewes, Delaware 19958, USA.

Information we process

When someone applies, QREasy processes account details, country, applicant type, legal or business name where required, website and promotional channels, audience and promotion descriptions, application answers, Program acceptances, support correspondence, and administrative review records. Approved Affiliates complete identity and payout onboarding directly with Stripe. QREasy receives Stripe account identifiers, capability and requirements status, and transfer or payout status, but does not store raw bank-account details or identity-verification documents.

Referral activity may include a random anonymous referral identifier, Affiliate and campaign identifiers, the QREasy destination, sanitized referrer and UTM values, consent state, coarse country where permitted, timestamps, and bot or fraud classifications. QREasy links a referral to a QREasy user only when attribution is lawfully locked. Affiliates receive aggregate reporting and do not receive referred-customer names, email addresses, payment details, full IP addresses, or other unnecessary personal information.

Cookies, session state, and consent

Where the visitor has granted the relevant consent, QREasy may store a signed first-party referral cookie for the configured attribution period, which is 60 days by default. The cookie contains no directly identifying personal information and is protected against tampering. If persistent referral tracking is refused, QREasy may use signed session-only referral state that expires when the browser session ends. Refusing referral tracking does not block normal use of QREasy, but attribution may be unavailable after the session ends.

Visitors can withdraw consent through QREasy cookie settings. Withdrawal prevents future optional storage; it does not automatically invalidate processing that was lawful before withdrawal or records required for fraud prevention, accounting, legal claims, or an already locked referral.

Purposes and legal bases

QREasy processes Affiliate data to administer applications and contracts, attribute referrals, calculate commissions, operate Stripe Connect transfers, provide reporting, prevent fraud and abuse, secure the service, meet accounting and legal obligations, and establish or defend legal claims. Depending on the context and applicable law, the legal basis is performance of a contract, steps requested before entering a contract, consent for optional storage, compliance with legal obligations, or QREasy's legitimate interests in operating and protecting the Program.

Recipients and international transfers

Data is shared only as needed with service providers such as Supabase for authentication and data storage, Stripe for billing and Connect onboarding and transfers, and Vercel for hosting. Administrators and professional advisers may access relevant records under appropriate duties. These providers may process data outside the EEA using applicable safeguards such as adequacy decisions or Standard Contractual Clauses. QREasy does not sell Affiliate or referral data.

Retention

Unsuccessful applications are retained only for the documented review, dispute, and reapplication period. Contract, acceptance, commission, transfer, payout, accounting, fraud, and audit records are retained for the period required by applicable tax, company, anti-fraud, and limitation laws. Raw click-level data is minimized and retained for a shorter operational period defined in the Program retention schedule. Aggregated, non-identifying statistics may be retained longer.

Rights and contact

Subject to applicable law, individuals may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent. Some records cannot be deleted immediately where QREasy must retain them for accounting, fraud prevention, legal claims, or compliance. Requests may be submitted through QREasy's published contact page. Individuals may also complain to their competent supervisory authority.

Qualified privacy counsel must review this notice, retention periods, legal bases, international-transfer safeguards, and consent implementation before public applications are enabled.