Last updated: October 16, 2026
Tapixy may earn a commission from qualifying purchases made through affiliate links. This policy describes the information we handle so storefronts, creator accounts, and affiliate attribution can operate in line with participating network requirements and applicable privacy law, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, “CCPA”). It should be read together with our Terms of Service.
1. Information we collect
- Creator accounts (identifiers): username, email and recovery email, password hash, passkey public keys, display name, bio, payout details you provide, and session cookies needed to stay logged in.
- Storefront content: look videos, item titles, and the product URLs you publish.
- Device and security data: a random device cookie (stored by us only as a one-way hash), IP address, user agent, approximate country from our network provider, and sign-in times, used to recognize your devices, send new-sign-in alerts, enforce rate limits, and block devices tied to fraud. When an account is frozen, banned, or removed for policy violations, the IP addresses it signed in from are blocked for up to 30 days (never an address shared with other accounts in good standing).
- Device fingerprint: our own script (no third-party service) combines how your browser draws a test image and 3D graphics (canvas and WebGL), your screen size, number of processor cores, time zone, language, and platform into a one-way hash. It is stored in a first-party cookie (
tapixy_fp), with a copy in your browser’s local storage, and sent with requests to Tapixy. We use it only to detect fraud, multiple accounts, and bots, and to restrict devices tied to accounts that are frozen, suspended, banned, or removed for policy violations. A fingerprint that is common to many devices in good standing is not restricted automatically. It is never used for advertising and never sold or shared. - Traffic and clicks (internet activity): when a visitor taps a shop button, we record the creator, look, time, IP address, and user agent so we can attribute clicks, detect bot bursts and click fraud, and reconcile affiliate reports.
- Earnings records (commercial information): affiliate report fields we import (sid / subID, item, advertising fee) to calculate the 70/30 split and 90-day hold.
We do not collect sensitive personal information as defined by the CCPA for the purpose of inferring characteristics about you, and we do not receive shoppers’ payment card numbers, full shipping addresses, or merchant account passwords.
2. Affiliate networks and cookies
Outbound product links may pass through an affiliate network or merchant redirect and include a creator attribution identifier. Participating networks and merchants may set or read cookies and similar technologies to attribute a qualifying purchase, as described in their own privacy notices. We only receive the advertising-fee data a network makes available for attributed sales.
Our pages also load CJ Affiliate’s page script, which turns eligible product links into tracked affiliate links and counts page impressions for CJ’s reporting. CJ may set or read its own cookies when it does so, under CJ’s privacy policy. We use this script for affiliate attribution only.
3. How we use information
- Operate public storefronts and creator dashboards.
- Build affiliate links with the correct creator attribution id.
- Hold and later clear creator earnings after 90 days, then pay only after admin approval.
- Prevent fraud: detect bots, click farms, and self-referral; flag accounts with anomalous click volume for manual review; freeze accounts and block devices tied to Fraudulent Activity as described in the Terms.
- Protect the service (rate limits, bot checks, session auth, sign-in alerts, and security headers).
- Comply with law and with affiliate network requirements, and enforce our Terms.
IP addresses, user agents, device identifiers, and click logs are collected and used strictly for fraud prevention, security, and affiliate attribution. We do not use them to build advertising profiles, and we do not sell them or share them with third parties for cross-context behavioral advertising.
4. Sharing
We disclose personal information only for business purposes:
- Affiliate networks and merchants, when you or a visitor follows an affiliate link (standard HTTP referral plus attribution id), and when we reconcile or dispute commissions.
- Service providers that process data on our behalf under contract, such as hosting and database providers, Cloudflare (network security and the Turnstile bot check), and our email delivery provider.
- Legal and safety: when required by law, to respond to legal process, or to investigate fraud or protect Tapixy, creators, or shoppers.
- Business transfers: in connection with a merger, acquisition, or sale of assets.
We do not sell personal information, and we do not “share” personal information for cross-context behavioral advertising, as those terms are defined by the CCPA. We have not done so in the preceding 12 months, and we do not knowingly sell or share the personal information of consumers under 16.
5. Retention
Creator accounts and published looks remain until you delete them or we close the account. Click logs, device records, and earnings rows are kept as long as needed for payouts, fraud review, chargeback and reversal handling, affiliate reconciliation, and legal obligations, and then deleted or de-identified.
6. Your California privacy rights (CCPA / CPRA)
If you are a California resident, you have the right to:
- Know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we disclose it to;
- Delete personal information we collected from you, subject to legal exceptions (for example, records we must keep to complete a payout, detect fraud, or comply with law);
- Correct inaccurate personal information;
- Opt out of the sale or sharing of personal information. We do not sell or share it, but you may still submit a request and we will record your preference;
- Limit the use of sensitive personal information. We only use it as permitted by the CCPA;
- Non-discrimination: we will not deny service, charge different prices, or provide a different quality of service because you exercised these rights.
How to submit a request. Email contact@tapixy.com with the subject “California Privacy Request,” state which right you are exercising, and send it from the email address on your account (or include your username). We will confirm receipt within 10 business days and respond within 45 days, extendable once by 45 more days with notice. To protect your account, we verify your identity by matching information we already hold, such as access to your account email. An authorized agent may submit a request on your behalf with your signed permission, and we may still ask you to verify your identity directly.
Creators can also update profile fields from the dashboard and delete looks they own at any time. Shoppers can use each merchant’s own privacy controls for activity that occurs after they leave our storefront.
7. International users and data transfers
Tapixy is operated from the United States, and our servers and service providers are located in the United States and other countries. If you use Tapixy from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. We rely on our contracts with service providers and on the safeguards in this policy to protect it.
Depending on where you live (for example, the European Economic Area, the United Kingdom, Canada, or Australia), you may have rights to access, correct, delete, restrict, or object to processing of your personal information, to data portability, and to complain to your local data protection authority. We process creator data to perform our contract with you (running your account and paying you), for our legitimate interests in preventing fraud and securing the service, and to comply with legal obligations such as tax reporting. Send any request to contact@tapixy.com and we will respond within the time your local law requires.
8. Security
We use reasonable safeguards, including hashed passwords and device identifiers, signed session tokens, and HTTPS. No method of transmission or storage is completely secure.
9. Children
The service is not directed at children under 13, and we do not knowingly collect personal information from them. Creator accounts are limited to adults under our Terms.
10. Contact
For support, privacy requests, or payout queries, reach out directly to contact@tapixy.com.
11. Changes
We may update this policy as the product or affiliate network requirements change. The “Last updated” date at the top will change when we do, and we will notify creators of material changes by email or in the dashboard.