Privacy Policy

1. Who we are and roles

Kortejo operates kortejo.com. For Creator data inside a Brand's program, the Brand is the controller and Kortejo processes on its behalf. For account and platform-usage data, Kortejo is the controller, handling personal information in accordance with the Australian Privacy Principles (Privacy Act 1988).

2. What we collect

Account: name, email, phone. Creators: social handles, payout details and address (for kits and Brand-paid commissions). Operations: coupons, attributed sales (order number, value, date — no end-customer data beyond what attribution requires), commissions, rankings. Technical: access logs and an audit trail of administrative actions.

We do not collect card data. Login emails use one-time codes.

3. Why we use it

To run the service (attribution, commission, kits, rankings), for security and fraud prevention, operational email, and product improvement using aggregates. AI content ideas use the brand's niche — not Creators' personal data.

4. Sharing

With integrated stores (Yampi/Shopify — coupon creation and the Brand's own orders), infrastructure (Supabase — database; Vercel — hosting; Resend — email; OpenRouter — idea generation, no personal data; PostHog — product usage measurement, with form fields masked and no name, email or payout details). We do not sell personal information. Cross-border transfers rely on our providers' contractual safeguards.

5. Your rights

Access, correction, deletion, portability and complaint — via contato@kortejo.com. We respond within 15 days. Australian users may also complain to the OAIC.

6. Retention and security

Sales and commission records are kept while the organisation is active and for applicable tax periods. Security: per-organisation database isolation (RLS), server-only store credentials, signed webhooks, audit trail. Notifiable data breaches are handled under the NDB scheme.