Privacy Policy
Effective date:
This policy explains what personal data the Jara Partner Programme (this site and the Jara referral service behind it) collects about applicants and partners, why, and what choices you have. The programme is run by Xerence Innovations LLC (“Jara”, “we”). Merchants who use the Jara Bundle Deals & Upsells Shopify app are covered by that app's own privacy policy.
Data we collect
We collect only what we need to run the programme:
- Application: your name, email address, desired handle, links to your social profiles or website, audience size, niche, and the optional message you write.
- Partner account: your handle, display name, email address, account status, commission rate and referral codes. If you sign in with Google, we store your Google account ID and email address; we never receive your Google password. For sign-in links we store only a hash of each one-time token.
- Payout details: your bank account details, or your PayPal or Wise email address. They are encrypted at rest with AES-256-GCM, shown back to you only in masked form, and decrypted only when a Jara admin exports a payout batch to pay you.
- Stores you refer: their shop domains, the store contact email reported when the app is installed (used only to detect self-referrals), install and subscription events, and the settled subscription amounts that the Shopify Partner API reports for those stores. Your dashboard shows these stores with masked domains.
- Earnings: your commission entries, payouts and payment references.
- IP address: this site passes your IP address to our referral service to limit repeated requests. There it is salted with a secret key and hashed (SHA-256); only the hash is used, and the hash is stored only with sign-in link requests. Our application logs do not record IP addresses, and the load balancer in front of this site does not keep access logs.
- Cookies: an encrypted session cookie that keeps you signed in and protects forms (see Cookies below).
- Audit log: a record of changes Jara staff make to your account, with email addresses and payout details masked.
How we use it
We use this data to:
- review applications and decide whether to approve them;
- run your partner account, referral codes and partner link, and attribute referred stores to you;
- calculate your commission from Shopify Partner API data, and pay you through the payout method you chose;
- prevent fraud and abuse, with rate limits, self-referral checks and automated-form checks;
- send transactional email: sign-in links and your approval email.
When we pay you, the bank or payment provider you chose receives the details needed to make the payment. We don't send marketing email, use analytics or advertising trackers, or sell your personal data.
Legal bases
Where data protection law (such as the GDPR or UK GDPR) requires a legal basis, we rely on these:
- Reviewing applications, running your partner account, attributing referred stores, calculating commission, paying you and sending sign-in and approval emails: performing our agreement with you, or taking steps you asked for before entering it.
- Preventing fraud and abuse (rate limits, self-referral checks and automated-form checks) and keeping the service secure: our legitimate interest in protecting the programme, Jara and the merchants who use the app.
- Keeping commission and payout records after an erasure, and collecting tax information: complying with our accounting and tax obligations.
- Signing in with Google: performing our agreement with you, using the sign-in method you chose.
How long we keep data
How long we keep each kind of data (the automatic periods are the current defaults, which the Jara team can change):
- Applications that are not approved: deleted automatically 180 days after they are reviewed.
- Partner account: while your account is open, and until your personal data is erased at your request.
- Commission and payout records: kept for 7 years after the end of the tax year they relate to, for accounting and tax; after an erasure they are kept without your personal details.
- Payout details: until you replace them (saving new details overwrites the old ones); deleted when your personal data is erased.
- Sign-in link records (token hash and IP hash): deleted automatically 30 days after they are created.
- Application logs: kept only on the servers that run the service. They are rotated as they grow and deleted when the service is redeployed or its server is replaced; we do not copy them to long-term storage. They do not contain IP addresses or payout details.
- Error reports: kept by Sentry for up to 90 days, then deleted automatically.
Closing your account: ask for deletion in your dashboard under Settings, Delete my account, or email privacy@jarakit.com. Nothing is deleted automatically: the Jara team reviews each request, then erases your personal data. Your name, email address, handle, Google sign-in, payout details, sign-in link records, portal login, application texts and social links, pending landing-page referrals, the message you add to the request, and free-text notes about you are deleted or replaced with anonymous placeholders. Your commission entries, payouts, the stores you referred and the audit log are kept without your personal details, linked only by an internal ID, because we need them for accounting and tax. We keep those financial records for 7 years after the end of the tax year they relate to, then delete them.
Service providers (sub-processors)
These service providers process personal data for us:
- Amazon Web Services (AWS): hosting of this site, the referral service and their databases, in the us-east-1 region (N. Virginia, United States).
- Amazon Simple Email Service (SES), part of AWS: sends sign-in links and approval emails.
- Shopify: the Shopify Partner API provides the install and subscription payment data used to calculate commission.
- Google: sign-in with Google (OpenID Connect), only if you choose it. We receive your Google account ID, your email address and whether it is verified.
- Sentry: error monitoring. Cookies, authorisation headers, request bodies, query strings and user details are removed from error reports before they are sent. Sentry stores error reports in the United States.
Your rights
You can ask to access, correct or delete your personal data by emailing privacy@jarakit.com. You can also correct your display name and payout details yourself in your dashboard, and ask for your account to be deleted there under Settings.
Deletion requests are reviewed by the Jara team before anything is erased; your commission and payout records are then kept without your personal details, as described above. We may need to check that a request really comes from you. We reply within 30 days.
Depending on where you live, you may have further rights, such as to receive a copy of your data in a portable format, to object to or restrict some processing, or not to be treated differently for using your rights. If you think we have mishandled your data, you can complain to your local data protection authority; we would like the chance to resolve it first, so please write to privacy@jarakit.com.
Changes to this policy
We update this policy when our data handling changes, and change the effective date at the top of this page. We email partners at least 30 days before a material change takes effect, unless it is required sooner by law.
Contact
Questions or requests about your personal data: privacy@jarakit.com.
The Jara Partner Programme is run by Xerence Innovations LLC, 1021 E Lincolnway Suite #9497, Cheyenne, Wyoming 82001, United States.