Privacy Policy for Affiliates

Last updated 12 October 2026

Moonbase is a platform that software makers use to sell their products, with Moonbase as the seller, and to pay affiliates a commission on the sales they bring. This policy explains what personal data Moonbase processes about you as an affiliate, why, and what rights you have.

Buyers and merchants have policies of their own: the one for buyers is on every store that uses Moonbase, and there is one for merchants.

Who we are

"Moonbase", "we" and "us" mean Moonbase AS, a Norwegian company (registration number 931 730 258, Utsikten 6, 3718 Skien, Norway), and, for some sales in the United States, its subsidiary Moonbase LLC (30 N Gould St, STE R, Sheridan, WY 82801, United States).

You can reach us about anything in this policy at privacy@moonbase.sh.

Our role

Under data protection law, the "controller" decides why and how personal data is used. Moonbase is the controller of the personal data in this policy: your affiliate account, what we collect if we verify you, and what we need to pay you. The merchants you work with receive some of it, as described under "Who we share data with", and handle it under their own privacy policies.

Where your data comes from

Most of the data we process comes from you. The rest comes from:

• The merchants you work with, which may invite you, set up the contracts you hold with them, and decide which sales earn you commission.
• Our identity provider, which tells us the result of your identity check, if we verify you.
• Public sources, such as company and VAT registers and sanctions lists.
• Your device, which sends us your IP address, approximate location and browser details automatically when you use our services.

You need to give us your payout details to be paid, and the details asked for in verification, if we verify you, to be approved. Anything else is up to you.

Your affiliate account

• You: your name or business name, email address, address, and tax and VAT numbers.
• Your work with merchants: the contracts you hold with them, the sales attributed to you, your commission, payouts and payout bank account, and the invoices we issue.
• Your agreement with us: which version of our terms you accepted, when, and from which IP address.
• How you use the affiliate app: the pages you visit and the actions you take, error reports, and your conversations with our support.

We use this to run the affiliate programme and pay you (Article 6(1)(b)), to keep the records the law requires (Article 6(1)(c)), and to keep our services secure and improve them (Article 6(1)(f)).

If we verify you

Before we pay you, and at times after that, we may verify you. We then process your name, date of birth, address and tax number, the result of an identity check, documents you send us, such as proof of address or bank statements, and our reviewers' notes and decision.

The identity check is carried out by our identity provider, Stripe. It compares a photo of your identity document with a photo of your face taken at the time, which is biometric data. Stripe asks for your explicit consent before the check (GDPR Article 9(2)(a)) and keeps the images; we receive the result. Our reviewers also search public sanctions lists for your name.

We do this to know who we pay, to prevent fraud, money laundering and breaches of sanctions, and to meet the requirements of our payment and banking partners (legal bases: complying with legal obligations, Article 6(1)(c), where a law requires it, and otherwise our legitimate interests, Article 6(1)(f)). If you do not take part, we cannot pay you.

When you use the affiliate app

When you use the affiliate app, our servers and our hosting provider record technical information such as your IP address, approximate location, browser, and the pages requested, to deliver the app, keep it secure and prevent abuse (Article 6(1)(f)). We keep these logs for up to 90 days. Cookies and similar technologies are described below.

Who we share data with

We do not sell personal data. We share it only as described in this policy:

• The merchants you work with: your name, email address and the commission you earn with them.
• Payment and banking partners: Wise (payouts), the banks involved in a payout, and Stripe (identity checks, if we verify you).
• Service providers that work for us under contract: Amazon Web Services (hosting, storage and email sending), Google (data warehouse and address autocomplete), Tinybird (analytics), Sentry (error monitoring), PostHog (product analytics in the affiliate app), Fogbender (support chat), rsms.me (fonts), Slack (internal notifications to our staff about affiliate accounts), and Tripletex (accounting).
• Moonbase AS and Moonbase LLC, between themselves.
• Authorities, courts, auditors and advisers, where the law requires it or to establish or defend legal claims.
• A buyer of our business, if all or part of Moonbase is sold or merged, under this policy.

Where your data is processed

We store our data with Amazon Web Services in the EU (Ireland), and our data warehouse with Google in the EU (Belgium). Some of our service providers, such as Google, Fogbender and Slack, are based in the United States or process data there. When personal data leaves the European Economic Area, we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on the European Commission's standard contractual clauses. Contact us for a copy of the safeguards.

How long we keep data

We may keep data longer where we need it for a legal claim, an investigation or a dispute that is still open.

How we protect data

Data is encrypted in transit and at rest, access to it is limited to the staff who need it, changes to it are recorded, passwords are stored only as hashes, and the most sensitive identifiers are encrypted with separately managed keys. No system is perfectly secure; if a breach puts you at high risk, we will tell you.

Your rights

You have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted, where we no longer need it or have no other legal basis to keep it;
• restrict our use of your data, or object to it, where we rely on our legitimate interests;
• receive data you gave us in a portable format, or have it sent to someone else;
• withdraw a consent you have given, at any time, without affecting what was done before; and
• ask a person to review an automated decision.

Write to privacy@moonbase.sh. We answer within one month, free of charge, and may ask you to confirm your identity first. We cannot delete the records the law requires us to keep, such as invoices and the records of payouts.

You can complain to the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no), or to the data protection authority where you live or work. We would appreciate the chance to deal with your concern first.

Cookies and similar technologies

Cookies and browser storage let a site remember things between pages and visits. We use:

• Sign-in: a cookie that keeps you signed in to the affiliate app for up to 14 days after your last visit. This is needed for the service you ask for.
• Error monitoring: Sentry records errors and how fast pages load, and, in visits where something goes wrong, a replay of the page with all text and images hidden, so we can fix problems. Error reports include your name and email address. It does not set cookies.
• Analytics: PostHog uses a cookie and browser storage to understand how the affiliate app is used. We use it only with your consent where the law requires it.
• Third-party features: Google Maps, to complete addresses as you type; rsms.me fonts; and the support chat of Fogbender. Each can receive your IP address and may set its own cookies.

You can block or delete cookies in your browser, but signing in may then stop working.

If you live in the United States

We do not sell personal information, and we do not share it for cross-context behavioral advertising. Depending on the state you live in, you may have the right to know what personal information we collect and how we use it, and to access, correct or delete it. Write to privacy@moonbase.sh to use these rights; we will not treat you differently for doing so.

Children

Our services are not directed at children under 16, and everyone we verify must be at least 18.

Changes to this policy

We update this policy when what we do changes, and show the date of the latest version at the top. If a change matters to you, we will also tell you by email before it applies.