Privacy Policy

This Privacy Policy explains how Brightyard, Inc., operating as Coherence ("OpenPartner," "we," "us"), collects, uses and shares personal data when you visit openpartner.dev, use the hosted OpenPartner service, or use the OpenPartner Network. Brightyard, Inc. is a Delaware corporation based in the United States.

A self-hosted copy of OpenPartner runs on its operator's own infrastructure. We don't receive its data and this policy doesn't cover it, except for what a self-hosted instance sends to the Network when its operator connects it.

Who's responsible for your data

Privacy laws distinguish a controller, who decides why and how personal data is used, from a processor, who handles it on a controller's behalf. We're both, for different data.

We're the controller for

• Brand accounts and billing: the people who sign up for and manage a hosted OpenPartner account, billing contacts, and our billing records.
• This website: visitors to openpartner.dev, including the docs, blog and marketplace pages, and anyone who emails us.
• The OpenPartner Network: creator accounts and public creator profiles, the marketplace, the creator directory brands search, and the records the Network keeps about brands.
• Product analytics, security, fraud prevention and sanctions compliance across all of the above.

We're a processor for

• Customer Data: the data a brand runs through the hosted service. That's its partners, the clicks on its partner links, identity stitches, conversion events, commissions and payouts, including data about the brand's partners and its own customers. The brand is the controller. We process Customer Data only on the brand's instructions, under our Terms of Service and any Data Processing Addendum we've signed with the brand.

If you're a partner in a brand's program, or a customer of a brand, the brand's own privacy policy covers that data, and the brand is the one to ask about it. If you send such a request to us, we'll pass it to the brand and help it respond.

What we collect

Brand accounts and billing

• Account details: name, email address, organization name, and your role.
• Password, if you set one: you can sign in with a one-time email link, with Google, or with a password. If you choose a password, we store only a salted one-way hash of it, never the password itself, so we can't read it or tell you what it is.
• Sign-in and security records: when you last signed in, your sessions, and server logs (described below).
• Billing: your plan, subscription and invoice records, billing email, and Stripe customer and payment-method identifiers. Stripe collects and holds your card or bank details. We never see full card numbers.
• Settings: your brand profile, logo, payout settings and similar choices you make in the dashboard.
• Communications: what you send us by email or through support.

Signing in with Google

Brand admins, OpenPartner staff, and partners on a brand's portal can sign in with their Google account instead of a password or an emailed link. When you choose "Continue with Google," Google tells us your email address and whether Google has verified it, and may include your name and profile picture.

• How we use it: we use only the verified email address, to find your account and sign you in. Nothing else from your Google account is used.
• What we keep: nothing beyond the email address your account already uses. We don't store your Google profile, Google access tokens, or any other data from your Google account.
• Sharing: we don't share Google user data with anyone, sell it, or use it for advertising or to train AI models.

OpenPartner's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google is the controller of your Google account, and the Google Privacy Policy applies to it. You can remove OpenPartner's access at any time in your Google account settings and keep signing in with an emailed link or a password.

Visitors to openpartner.dev

• Server logs: our hosting provider logs each request, including your IP address, browser user agent, the page requested and the time.
• Analytics, only if you accept them: PostHog records the pages you view, clicks and similar interactions, the referring page, your browser and device type, an approximate location derived from your IP address, and a random identifier kept in a cookie. Nothing loads until you choose Accept in the cookie banner. See our Cookie Policy.
• Embedded videos: marketplace program pages can embed a video from YouTube (in its privacy-enhanced mode), Vimeo or Loom. When it loads, that provider receives your IP address and browser details under its own privacy policy.

The OpenPartner Network

• Creator account: email address, name, handle, avatar, bio, categories, the audience details you enter (audience locations, age range and size), portfolio links, past brands, email preferences, and when you last signed in.
• Social platforms you add: handles, profile links, the follower counts you report, and verification status. If you verify a YouTube channel, we store its channel ID.
• Applications and partnerships: the programs you apply to, your application message and preferred link slug, the brands you work with, and the commission terms.
• Network opt-in: when a brand you already work with invites you to the Network, your consent and when you gave it. When you opt in, the brand may give us your name, email address, website, social links and audience size. We only use them to fill fields you've left blank.
• Performance statistics: your 90-day clicks, conversions, revenue and commission across programs, computed from your partnerships.
• Clicks on share links: when someone clicks a creator's share link, we record a hash of the visitor's IP address, their browser user agent, the referring page, campaign (UTM) parameters, the time and, where available, their country. We pass the click to the brand the link belongs to.
• Brands on the Network: business name, contact name and email address, the address of the brand's OpenPartner instance, logo, and Stripe billing identifiers for self-hosted instances on the Network access plan.

YouTube. Verifying a YouTube channel uses YouTube API Services. We send Google the channel handle or ID you give us, and keep only the channel ID and the result. By verifying a YouTube channel, you agree to the YouTube Terms of Service, and the Google Privacy Policy applies to what Google receives. To have us delete the channel data we hold, email [email protected] or delete your account.

Customer Data we process for brands

When a brand runs a program on the hosted service, we process this on its behalf:

• Partners: name, email address, the partner's Stripe account ID, commission terms, and anything the partner gave in a join-page application (website, social links, audience size, pitch). If a partner sets a password for the brand's partner portal, a salted one-way hash of it, which works only on that brand's portal. If the brand pays partners itself, the partner's payout details, entered by the partner or the brand: a PayPal email address, bank account details, a UPI ID or other payment instructions, the account holder's name and, where a currency requires it, their postal address. We store them encrypted. We don't collect tax forms.
• Clicks on partner links: the partner, link and program, the landing URL, the referring page, the visitor's browser user agent, campaign (UTM) parameters, the time, a fraud flag, where available the visitor's country, and a hash of the visitor's IP address. We don't keep the IP address itself in the database, but the hash isn't anonymous, so we treat it as personal data.
• Identities: the identifier the brand uses for a customer, linked to the click that brought them. It's usually the brand's own user ID or a Stripe customer ID. For some coupon checkouts it's the customer's email address.
• Conversion events: the type (such as signup, purchase, invoice paid or refund), amount and currency, the brand's own references, related Stripe identifiers, and any other details the brand chooses to send.
• Commissions, payouts and adjustments.
• Cookies and local storage: our link router sets a cookie holding the click ID when someone follows a partner link, and the OpenPartner script on the brand's own website can store the click ID in a first-party cookie and local storage, so a later signup can be credited. The brand decides whether to use the script and is responsible for any consent its visitors must give. See the Cookie Policy.

How we use data, and our legal bases

We use personal data we control for the purposes below. If you're in the European Economic Area, the UK or Switzerland, these are our legal bases:

Where we rely on legitimate interests, you can object (see Your rights). We don't sell personal data, share it for targeted advertising, or use it to train AI models.

Automated decisions. We automatically refuse sign-ups and sign-ins from places where we can't operate (see the sanctions section of our Terms). If you think we've refused you in error, email [email protected] and a person will review it. We make no other decisions about you by automated means alone that have legal or similarly significant effects.

Who we share it with

• Sub-processors: companies that host and run the service for us, listed with their purpose and location on our Sub-processors page. They may use the data only to provide their service to us.
• Brands, on the Network: anyone can see a creator's public profile (never the email address). Brands searching the creator directory see the profile and the performance statistics. When you apply to a program, the brand sees your email address, name, handle, bio and application message, and when it approves you, those are copied into the brand's own partner records, where its privacy policy applies. Clicks on your share links go to the brand the link belongs to.
• Stripe: processes our billing and, where a brand uses Stripe Connect, payouts. Stripe is also responsible for payment data under its own privacy policy.
• Destinations you or a brand choose: webhooks, partner postback URLs and other integrations a brand or partner sets up receive the data they're configured to receive.
• Legal requirements: when the law, valid legal process or the protection of someone's rights or safety requires it.
• Business transfers: if OpenPartner is acquired or merges, data may transfer as part of that deal. We'll tell you, and this policy will keep applying to it.

We don't sell personal data, don't share it for cross-context behavioral advertising, and don't use advertising trackers. We don't share Google user data from Google sign-in with anyone. Google itself isn't a recipient: when you sign in with Google, Google sends us your email address; we don't send Google data about you.

International transfers

We're based in the United States and store data in the US, in our hosting provider's New York region. Some sub-processors also process data in other countries. When personal data moves from the European Economic Area, the UK or Switzerland to the US or another country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments where needed. They're in our Data Processing Addendum for Customer Data and in our agreements with sub-processors.

We are not certified under the EU-U.S. Data Privacy Framework or its UK and Swiss extensions. To ask for a copy of the safeguards we use, email [email protected].

How long we keep data

A brand's commission and payout records are Customer Data, so they're deleted with the brand's account. Brands should export what they need for their own tax and accounting records before closing an account. Deleted data can remain in our database backups until they expire, about 7 days later. We may keep data longer where the law requires it, or to establish or defend a legal claim.

Your rights

If you're in the European Economic Area, the UK or Switzerland, you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct data that's inaccurate or incomplete;
• have your data deleted;
• restrict how we use it;
• receive data you gave us in a portable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, without affecting what we did before; and
• complain to your data protection authority, such as the one where you live or work, or the Information Commissioner's Office in the UK.

Wherever you live, you can ask us to access, correct or delete your data, and we'll handle the request under the most protective rules that apply to you. Email [email protected]. We'll confirm your identity, usually by checking that you control the email address on the account, and reply within one month. We may extend that by up to two more months for complex requests, and we'll tell you if we do. Requests are free.

Creators can also download their data and delete their account from their Network settings. Brands can export their data from the dashboard at any time. For Customer Data, we'll refer you to the brand that controls it.

US state privacy rights (including California)

This section applies to residents of California and other US states with comparable privacy laws, and supplements the rest of this policy. It's also our notice at collection.

What we collect and who receives it

In the past 12 months we've collected these categories of personal information:

We collect it from you, from your browser or device, from brands (about their own partners and customers), from Stripe, and from Google when you verify a YouTube channel or sign in with Google. We use it for the purposes in How we use data and keep it for the periods in How long we keep data. We don't create profiles to infer things about you.

The only sensitive personal information we handle for our own purposes is what's needed to sign you in (one-time sign-in links, session tokens, and a hash of your password if you set one). We use it only to provide the service. Partners' payout details, which can include bank account numbers, are Customer Data we process for brands (see above).

No sale or sharing

We don't sell personal information or share it for cross-context behavioral advertising, as the CCPA defines those terms, and haven't in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. openpartner.dev treats a Global Privacy Control or Do Not Track signal from your browser as declining analytics.

Your rights and how to use them

You have the right to know what personal information we've collected about you and to get a copy of it, to have it deleted, to correct it, and not to be discriminated against for using these rights. You'd also have the right to opt out of sale or sharing and to limit our use of sensitive personal information, but we don't do either.

To make a request, email [email protected] with "US privacy request" in the subject. We'll verify your identity by confirming you control the email address we hold for you, and reply within 45 days (or tell you if we need up to 45 more). An authorized agent can make a request for you with your signed permission, and we may ask you to confirm your identity with us directly. If we decline a request, you can appeal by replying with "Appeal" in the subject. We'll answer within 45 days, and if you're still not satisfied you can contact your state attorney general.

For Customer Data we act as the brand's service provider, so we'll refer requests to the brand.

Children

OpenPartner is for businesses and adults. You must be at least 18 to create a brand account or a Network creator profile. The service isn't directed to children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email [email protected] and we'll delete it.

Security

We encrypt integration credentials (email-provider passwords and tokens, webhook signing secrets, partner postback URLs, and Stripe and Network connection tokens) and partners' payout details with AES-256-GCM, store API keys and session tokens only as hashes, store passwords only as salted one-way hashes (scrypt), limit repeated wrong-password attempts, use TLS in transit, and limit who on our side can access production data. No system is perfectly secure. If a breach affects personal data we control, we'll notify you and the authorities as the law requires. If it affects Customer Data, we'll tell the brand without undue delay so it can meet its own obligations.

Changes

We'll post any changes here and update the date at the top. For material changes, we'll email account holders or show a notice in the product at least 30 days before they take effect.

Contact

Brightyard, Inc. (operating as Coherence) is responsible for this policy. Questions and requests: [email protected]. That's the fastest way to reach us.

By post: Brightyard, Inc., c/o Corporation Service Company, 251 Little Falls Drive, Wilmington, DE 19808, USA.