Privacy
Policy
At ThreeStove ("we", "us", "our"), operated by ThreeStove (KvK 91906741, BTW NL004924342B04), located at Weesperstraat 298, 1018 DN Amsterdam, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our affiliate network platform ("Platform", "Service"). Please read this Privacy Policy carefully. By using our Service, you agree to the collection and use of information in accordance with this policy.
Information We Collect
1.1 Personal Information
We collect information that you provide directly to us, including:
- Name, email address, phone number, and postal address
- Payment information (IBAN, bank account details)
- Tax identification numbers (where required by law)
- Business information (company name, registration number, VAT number)
- Account credentials (username, password)
1.2 Usage Information
We automatically collect information about how you use our Platform, including:
- IP address, browser type, and device information
- Pages visited, time spent on pages, and navigation patterns
- Campaign performance data, clicks, conversions, and earnings
- Log files and analytics data
1.3 Cookies and Tracking Technologies
We use cookies, web beacons, and similar technologies to track activity and store information. See Section 6 for more details.
How We Use Your Information
How We Use Your Information
We use the information we collect for the following purposes. The lawful basis under GDPR Art. 6 is noted for each purpose.
- Service Provision: To provide, maintain, and improve our Platform and services. Legal basis: performance of contract (Art. 6(1)(b))
- Account Management: To create and manage your account, process transactions, and handle payouts. Legal basis: performance of contract (Art. 6(1)(b))
- Communication: To send you transactional updates and notifications, and to respond to your inquiries. Legal basis: performance of contract (Art. 6(1)(b))
- Analytics: To analyze usage patterns, track campaign performance, and generate reports. Legal basis: legitimate interests (Art. 6(1)(f)), improving platform quality and detecting fraud
- Security: To detect, prevent, and address fraud, abuse, and security issues. Legal basis: legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c))
- Legal Compliance: To comply with legal obligations, enforce our Terms of Service, and protect our rights. Legal basis: legal obligation (Art. 6(1)(c))
- Marketing: To send promotional communications. Legal basis: consent (Art. 6(1)(a)), where required by law; otherwise legitimate interests
Information Sharing and Disclosure
Information Sharing and Disclosure
We do not sell your personal information. We may share your information in the following circumstances:
3.1 Service Providers
We may share information with third-party service providers who perform services on our behalf, such as payment processing, data analytics, hosting, and customer support. These providers are contractually obligated to protect your information.
3.2 Business Partners
We may share aggregated, anonymized data with advertisers and partners for analytics and business purposes.
3.3 Legal Requirements
We may disclose information if required by law, court order, or government regulation, or to protect our rights, property, or safety, or that of our users.
3.4 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
3.5 With Your Consent
We may share information with your explicit consent or at your direction.
Data Security
Data Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit and at rest
- Secure authentication and access controls
- Regular security assessments and updates
- Employee training on data protection
- Compliance with industry security standards
Data Security — cont.
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
Your Rights
Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal information:
- Access: Request access to your personal information
- Correction: Request correction of inaccurate or incomplete information
- Deletion: Request deletion of your personal information (subject to legal and contractual obligations)
- Portability: Request transfer of your data to another service provider
- Objection: Object to processing of your personal information for certain purposes
- Restriction: Request restriction of processing of your personal information
- Withdraw Consent: Withdraw consent where processing is based on consent
How to exercise your rights
You can exercise your data export and account deletion rights directly in the ThreeStove dashboard. Navigate to Settings → Security to:
- Export your data: Download all your personal data as a JSON file, including your profile, conversions, clicks, payouts, messages, and more.
- Delete your account: Request permanent account deletion. Your personal profile and credentials will be removed. If your account has no transaction history, active payment details are deleted. If your account has transaction history (such as executed payouts, billing records, or self-billed invoices), statutory accounting and tax records are retained for 7 years to comply with Dutch tax law (AWR art. 52).
Your Rights — cont.
You can also contact us at privacy@threestove.com for any privacy-related requests. We will respond within the timeframes required by applicable law.
Cookies and Tracking Technologies
Cookies and Tracking Technologies
We use cookies, web beacons, and similar technologies to collect information about your use of our Platform. Cookies are small text files stored on your device that help us provide, protect, and improve our services.
Types of Cookies We Use
- Essential Cookies: Required for the Platform to function properly
- Analytics Cookies: Help us understand how visitors interact with our Platform
- Functional Cookies: Remember your preferences and settings
- Marketing Cookies: Used to deliver relevant advertisements and track campaign performance
Cookies and Tracking Technologies — cont.
You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of our Platform.
Data Retention
Data Retention
We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Factors that determine retention periods include:
- The nature of the information
- Legal and regulatory requirements (e.g., Dutch tax law requires financial records to be retained for 7 years)
- Business and operational needs
- Dispute resolution and enforcement of agreements
Account Deletion
When you request account deletion via Settings → Security, your personal profile, credentials, messages, and API keys are permanently removed. If you have never received payouts or incurred billing charges, your payment details are also deleted. If you have executed payouts or billing transactions, statutory tax and accounting records (including issued self-billed invoices and transaction records) are retained for 7 years as required by Dutch tax law (AWR art. 52). These statutory records are retained strictly for legal compliance and tax audits.
Data Retention — cont.
When we no longer need your information, we will securely delete or anonymize it in accordance with our data retention policies.
International Data Transfers
International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country. We take appropriate safeguards to ensure that your information receives adequate protection, including standard contractual clauses approved by the European Commission.
Named data processors
- Mollie B.V. (payment processing, Netherlands) processes payment data to execute affiliate payouts and advertiser billing; subject to PSD2 and GDPR
- Supabase / AWS (platform hosting and database, EU region) stores account, campaign, and transaction data in encrypted form within the EU
- Email delivery provider (transactional email), receives your email address to deliver account and platform notifications; bound by standard contractual clauses
International Data Transfers — cont.
We conduct regular security assessments of our data processors and update this list when processors change.
Children's Privacy
Children's Privacy
Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child without parental consent, we will take steps to delete that information promptly.
Changes to This Privacy Policy
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We may also notify you via email or through our Platform.
Changes to This Privacy Policy — cont.
You are advised to review this Privacy Policy periodically for any changes. Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.
Google User Data (YouTube API Services)
Google User Data (YouTube API Services)
Creators can connect their own YouTube channel to ThreeStove. This connection uses Google OAuth and YouTube API Services. By using this feature you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's handling of your data is described in the Google Privacy Policy (https://www.google.com/policies/privacy).
What we access
We request only the read-only scope youtube.readonly and use it for a single kind of API request: reading the connected creator's own channel. The data we receive is the channel ID, channel title, handle, avatar image, and public channel statistics (subscriber count, video count, and total view count), together with the OAuth tokens needed to keep those totals current. We do not access private video content, comments, messages, subscriptions, or watch history, and we cannot upload, modify, or delete anything on YouTube.
How we use it
This data is used to verify that the creator owns the channel, to show the channel identity and audience totals on the creator's ThreeStove profile, and to check whether the creator meets campaign requirements. It is not used for advertising targeting or credit decisions, and it is not used to develop, improve, or train machine learning or artificial intelligence models.
Who can see it
The connected channel's identity and audience totals are visible within ThreeStove to the creator, to advertisers reviewing that creator's campaign applications or collaborations, and to ThreeStove administrators. We do not sell Google user data and we do not transfer it to data brokers, advertising networks, or any other third party, except for the hosting processors named in section 8 that store it on our behalf.
Protection, retention, and deletion
Google user data is transmitted over TLS and stored encrypted at rest in the EU. OAuth tokens are held server-side only and are never exposed to the browser. We retain this data only while the YouTube connection is active: when a creator clicks Disconnect, we revoke our access with Google and permanently delete the stored tokens and channel data. Deleting your ThreeStove account removes the connection as well. You can also revoke ThreeStove's access at any time via your Google security settings (https://myaccount.google.com/permissions).
Limited Use
ThreeStove's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Contact Us
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Contact Us — cont.
Contact Us — cont.
We will respond to your inquiry within the timeframes required by applicable data protection laws.