LEGAL

Privacy policy

Last updated 29 October 2026

Day 1 Partner is affiliate software for SaaS companies that bill through Stripe. This policy explains what personal information we handle, why, who we share it with, and the choices you have. It covers our website (dayonepartner.com), the app (app.dayonepartner.com) and the affiliate pages our customers' affiliates use.

“We”, “us” and “Day 1 Partner” mean CHGROUP - FZCO, a free zone company registered in the United Arab Emirates, with its registered office at IFZA Business Park, DDP, PO Box 342001, Dubai, United Arab Emirates. If you have a question, write to hello@dayonepartner.com.

Who this is about

• Customers: companies that run an affiliate program with us, and the people on their team.
• Affiliates: people who promote a customer's product through our affiliate pages.
• Referred visitors and buyers: people who arrive on a customer's website through an affiliate's link or code, and who may go on to buy.
• Website visitors: anyone browsing dayonepartner.com.

Our role

For our own accounts, billing and website, we decide how personal information is used (we are the “controller”). For the information a customer brings into its affiliate program, such as its affiliates, its customers' Stripe records and referral data, we process it on the customer's behalf and on its instructions (we are a “processor”). The customer is responsible for telling its affiliates and buyers how their information is used, and for any consent its website needs for referral tracking. If you're an affiliate or a referred buyer, the company whose program you're part of is the best first contact; we'll help them answer you.

What we collect

Accounts

Your name, email address and password (stored only as a one-way hash), or your Google profile name and email if you sign in with Google. Your company or workspace name, who is on your team and their roles. The email verification codes we send you.

Stripe data

When a customer connects its Stripe account, we get read-only access to the records we need to attribute sales and work out commissions: customers, subscriptions, invoices, payments, refunds, disputes, checkout sessions and promotion codes. These can include a buyer's name, email address and what they paid. We can't move money in a customer's Stripe account, and we never see full card numbers.

Affiliates

An affiliate's name, email address, the programs they join, their referral links and codes, the sales credited to them, commissions and payouts. If they choose to get paid, the PayPal or Wise email address and the name on that account.

Referral tracking

Customers add our tracking script to their website. When someone arrives through an affiliate link, the script stores the referral in a first-party cookie called dop_ref (with a copy in the browser's local storage) on the customer's own domain, for as long as the customer's program says, so a later purchase can be credited to the right affiliate. For each click we record the page landed on, the referring page, the browser's user agent and a keyed hash of the IP address. We keep the hash, never the IP address itself, to spot duplicate clicks and self-referrals.

Imports from other platforms

When a customer moves its program from Rewardful, FirstPromoter, Tolt or Dub, we read its affiliates, referrals, commissions and balances from that platform with the access key the customer gives us, or from the files it uploads. Those access keys are stored encrypted. If the customer asks for help matching an export's columns, we send the column names and a few sample rows to the AI provider it chooses (OpenAI, Anthropic or OpenRouter), using the customer's own key with that provider.

AI agents and API keys

Customers can connect AI tools to their account with API keys or by signing in from the tool. We store a one-way hash of each API key, never the key, and record when it was last used. Tools act with the access of the person who connected them.

Billing

For our own fees, Stripe holds your card and billing details. We keep a record of what we charged and when.

Security and service logs

IP addresses and browser details when you sign in or use the app, to limit repeated attempts, protect accounts and investigate problems. Our sign-up and sign-in forms may use Cloudflare Turnstile to tell people from bots.

Our website

We use Google Analytics to understand how people use dayonepartner.com, with Google signals and ad personalisation turned off. The site also saves which version of the homepage you saw, in your browser's local storage, so it stays the same on your next visit.

How we use it

• To run the service: tracking referrals, crediting sales, working out commissions and holds, flagging likely fraud, preparing payout files and keeping balances right.
• To send the emails the service needs: sign-in codes, invitations, new affiliate applications, commission and payout notices, and billing notices.
• To bill customers once they owe a fee.
• To keep accounts and the service secure, and to fix problems.
• To understand how people use our website, and improve it.
• To meet legal obligations, such as keeping financial records.

We don't sell personal information, and we don't use it to show ads.

Legal bases

Where the GDPR or similar laws apply, we rely on: performing our contract with you (running your account and the service); our legitimate interests in keeping the service secure, preventing fraud and improving it; legal obligations (financial records); and your consent where a law requires it, which you can withdraw at any time.

Who we share it with

Only with the services that help us run Day 1 Partner, each bound to protect it and use it only for us:

Customers see the information in their own programs, and affiliates see their own. Payout files go to PayPal or Wise only when a customer uploads them there itself. We may also share information if the law requires it, to protect people's rights and safety, or as part of a merger or sale of our business, in which case this policy keeps applying to it.

International transfers

Our providers may process information outside your country, including in the United States. Where personal information leaves the UAE or the European Economic Area, we rely on safeguards such as standard contractual clauses or an adequacy decision.

How long we keep it

We keep account and program information while the account is open. Commission, payout and billing records are financial records: we keep them as long as the law and the resolution of disputes require, even after an account closes. When information is no longer needed, we delete it or make it anonymous.

Your rights

Depending on where you live, you can ask to see the personal information we hold about you, correct it, delete it, limit or object to how we use it, or receive a copy to take elsewhere. Write to hello@dayonepartner.com; we answer within 30 days and may need to confirm who you are first. If your information is part of a customer's program, we'll pass your request to that customer and help them answer it. You can also complain to your local data protection authority.

Security

We encrypt connections, store passwords and API keys only as one-way hashes, and encrypt Stripe access and other platforms' keys at rest. No system is perfectly secure, but we work to keep your information safe and will tell you if a breach affects you, as the law requires.

Children

Day 1 Partner is for businesses. It isn't meant for anyone under 18, and we don't knowingly collect their information. If you think a child has given us information, contact us and we'll delete it.

Changes

We'll update this page when our practices change and change the date at the top. If a change matters, we'll tell customers by email or in the app before it takes effect.

Contact

CHGROUP - FZCO
IFZA Business Park, DDP, PO Box 342001
Dubai, United Arab Emirates
Email: hello@dayonepartner.com