Privacy Policy

1. Who we are

CommissionAPI is a brand of Sivi Quant Labs Private Limited (“CommissionAPI”, “we”, “us”), a company incorporated in India. We are the controller of the personal data described in this policy.

For any question about this policy or your personal data, contact compliance@commissionapi.com.

2. Scope

This policy covers commissionapi.com and the early-access programme. CommissionAPI is pre-launch: there is no live publisher dashboard, no live offer supply and no production API traffic. As those services launch, this policy will be updated before they begin processing personal data, and the “last updated” date above will change.

It does not cover the practices of advertisers, affiliate networks or other third parties whose programs may in future be reachable through CommissionAPI. Those parties are independent controllers of the data they collect.

3. Information we collect

Information you give us

When you submit the contact form or apply for early access, we collect what you enter: your name, company, work email address, website, country, the category describing you, and any free-text you write about how you intend to use CommissionAPI. On the early-access form, traffic volume, categories and markets are optional.

Information collected automatically

When you submit a form we record the IP address the submission came from and your browser's user-agent string, together with a timestamp. We use these only to detect automated abuse of the form and to understand where applications originate.

Our hosting provider records standard delivery logs (request path, response status, approximate location, timestamp) as part of serving the site.

Information we do not collect

We do not run advertising or analytics trackers on this site. We do not set cookies. We do not use browser storage. We do not ask for, and do not want, special category data, payment details or credentials through these forms.

4. How we use information, and our legal bases

• To review and respond to your application or enquiry. Legal basis: steps taken at your request prior to entering a contract, and our legitimate interest in evaluating prospective partners.
• To contact you about the launch partner programme. Legal basis: your consent where required, otherwise legitimate interest in business correspondence with the address you gave us. You can ask us to stop at any time.
• To keep the service secure and free of abuse. Legal basis: legitimate interest in protecting our systems.
• To comply with legal obligations where they apply to us.

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not make decisions producing legal or similarly significant effects about you by automated means.

5. Cookies and similar technologies

This site sets no cookies of its own and uses no analytics or advertising tags, so there is no consent banner because there is nothing to consent to.

One third-party request is made: web fonts are loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Making that request discloses your IP address to Google, which acts as an independent controller for it. Google states that it does not set cookies for Fonts requests and does not use them for advertising. If you would rather not make that request, a content blocker will stop it and the site will fall back to fonts already on your device.

6. Sharing and disclosure

We share personal data only in these circumstances:

• Infrastructure providers. The site and form submissions are hosted on Amazon Web Services, which processes data on our instructions under its data processing addendum.
• Professional advisers such as lawyers and accountants, where they need it to advise us.
• Legal requirement — where we are obliged to disclose by law, regulation or valid legal process.
• Business transfer — if the business or its assets are acquired, in which case this policy continues to apply to the data transferred, or you are notified of any change.

When the platform launches, providing a service will involve sharing programme and attribution data with the relevant advertisers and affiliate networks. That processing is described in the Terms of Service and the Compliance page, and this policy will be updated before it begins.

7. International transfers

We operate from India. Our infrastructure runs in the AWS Asia Pacific (Mumbai) region, with content delivered globally through an edge network, and certificate and DNS services in the United States. If you are in the European Economic Area or the United Kingdom, this means your personal data may be transferred outside your region. Where that happens, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum as incorporated into our provider agreements.

8. Retention

We keep early-access applications and contact enquiries for as long as we are actively considering or corresponding with you, and for up to 24 months after our last contact, so we can pick up the conversation when the relevant programme opens. Abuse-detection records (IP address, user agent) are kept for up to 12 months. We delete or anonymise data sooner on request, unless we must keep it to comply with a legal obligation or to establish or defend a legal claim.

9. Security

Submissions are transmitted over HTTPS and stored encrypted at rest in a database that is not publicly reachable. Access is restricted to the people who need it, using individually attributed credentials. No method of transmission or storage is completely secure, and we do not claim otherwise; if a breach affects your rights we will notify you and the relevant regulator as the law requires.

10. Your rights

Subject to the law that applies to you, you may ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.

To exercise any of these, email compliance@commissionapi.com. We respond within the period the applicable law allows, normally within 30 days. We will not charge you or treat you differently for exercising a right.

India

Under the Digital Personal Data Protection Act, 2023 you may access, correct, complete, update and erase your personal data, nominate another person to exercise your rights if you die or become incapacitated, and raise a grievance with us. Our grievance officer can be reached at compliance@commissionapi.com. If we do not resolve your grievance you may complain to the Data Protection Board of India.

European Economic Area and United Kingdom

You have the rights described above under the GDPR and UK GDPR, and you may lodge a complaint with your local supervisory authority or, in the UK, the Information Commissioner's Office.

California

You may request disclosure of the categories and specific pieces of personal information we have collected, request deletion or correction, and are protected against discrimination for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA as amended, so there is nothing to opt out of.

11. Children

CommissionAPI is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We will update this policy as the platform develops, and always before launching a service that processes personal data in a materially different way. The date at the top shows when it last changed. Significant changes will be notified to partners by email.

13. Contact

Privacy enquiries and rights requests: compliance@commissionapi.com
CommissionAPI is a brand of Sivi Quant Labs Private Limited, India.