Privacy Policy

This Privacy Policy applies to commish.sh, app.commish.sh, and the websites, applications, APIs, referral tools, emails, and services that link to it (collectively, the Service). It does not apply to third-party websites or services that have their own privacy policies.

Oftring Ventures LLC, doing business as Commish, is the controller or business responsible for personal information used to administer accounts, operate and secure the Service, communicate with users, provide public creator and program features, and improve our products. When a Program Owner submits or directs us to process end-customer, referral, transaction, or other personal information through its workspace, Commish generally acts as a processor or service provider on that Program Owner's behalf. The Program Owner determines why that information is processed and is responsible for its own notices and instructions.

We process that customer-directed information only to provide and secure the Service, follow the Program Owner's documented instructions, and comply with law. We do not use it for our own advertising or sell or share it for targeted advertising.

If your information was submitted to Commish by a business or other organization, contact that organization first about its privacy practices or a request concerning that information. We will support its response as required by law and our agreement with it.

The information we collect depends on how you interact with the Service. The following describes the categories we collect, examples, and the business purposes for using them.

• Account and identity information: name, email address, user ID, display name, organization, workspace membership, role, invitation status, authentication records, and multi-factor-authentication status. We use this to create and secure accounts, control access, administer workspaces, and communicate with you.
• Creator and profile information: handle, bio, categories, avatar, social links, audience details, application responses, discoverability settings, and program memberships. We use this to provide profiles, marketplace and discovery features, program applications, and collaboration between Program Owners and Creators. Information you designate as public is visible to anyone.
• Business and program information: workspace and application names, websites, product and program details, eligibility rules, commission and refund terms, invitations, API configuration, and webhook endpoints. We use this to operate programs, integrations, attribution, and reporting.
• Referral and end-customer information: referral and capture identifiers, referral source and destination, timestamps, country, hashed IP address and user-agent values, external customer identifiers, and hashed email addresses. We use this to attribute eligible activity, prevent duplicate or fraudulent claims, troubleshoot integrations, and report program results.
• Transaction and financial information: order and conversion identifiers, amounts, currency, commission calculations, refund and dispute status, ledger entries, funding and payout status, Stripe connected-account identifiers, capabilities, and related provider events. We use this to calculate and reconcile commissions, administer refund windows, process permitted instructions, maintain financial records, and prevent fraud. Stripe collects complete card, bank-account, identity-verification, and tax details directly when those details are required; Commish does not receive complete card or bank credentials.
• Communications and support information: account-access requests, support messages, feedback, moderation reports, email delivery events, and other information you send us. We use this to respond, provide notices, manage access, moderate the Service, and improve support.
• Device, usage, and approximate-location information: IP address, country or region derived from IP, browser, device and operating-system details, referring and visited pages, clicks, scrolling, and other page interactions (including session recordings), timestamps, performance measurements, and errors. We use this to deliver and protect the Service, understand feature usage, diagnose problems, measure site performance, and prevent abuse.
• Security and compliance information: audit events, sign-in and access events, rate-limit identifiers, fraud signals, consent or acceptance records, and records needed to investigate misuse or comply with law. We use this to protect users, enforce our terms, and meet legal obligations.

We do not use sensitive personal information to infer characteristics about you. Please do not submit sensitive information unless the Service or a payment provider expressly requests it for a stated purpose.

We collect personal information from:

• you, when you register, configure an account, publish a profile, join a program, contact us, or use the Service;
• Program Owners, Creators, workspace administrators, and other users who invite you, submit transactions, or otherwise interact with you through the Service;
• your browser or device through requests, cookies, local storage, session storage, logs, and similar technologies;
• Stripe and other integrations you connect, including account status, transactions, refunds, disputes, and payout events; and
• service providers that help us host, secure, analyze, and communicate through the Service.

We use personal information to:

• provide accounts, workspaces, profiles, programs, referrals, attribution, commissions, APIs, webhooks, reporting, and payment-related workflows;
• authenticate users, manage permissions, protect credentials, detect abuse, and maintain the security and integrity of the Service;
• process instructions, reconcile records, administer refunds and disputes, and maintain audit and financial records;
• send authentication, invitation, transaction, security, policy, support, and other service communications;
• provide support, investigate problems, measure performance, and develop or improve features;
• enforce our Terms of Service and program requirements, protect rights and safety, and prevent fraud or other unlawful activity;
• comply with legal, tax, accounting, reporting, and regulatory obligations; and
• carry out another purpose disclosed to you with your consent.

We may disclose personal information to the following recipients:

• Workspace and program participants. Workspace owners and administrators can access workspace data. Program Owners and Creators receive the profile, program, attribution, conversion, commission, and related information needed to manage their relationship. Public profiles and listings are available to anyone.
• Service providers. We use providers to host data and applications, authenticate users, prevent abuse, deliver email, provide analytics, and support our operations. They may process information only to perform services for us under applicable contractual restrictions.
• Payment and financial providers. We disclose information to Stripe, banks, payment networks, and other financial providers as needed for connected accounts, transactions, identity verification, fraud prevention, refunds, transfers, payouts, and compliance. Stripe also processes personal information under its own agreements and privacy policy.
• Legal and safety recipients. We may disclose information when reasonably necessary to comply with law or legal process, respond to lawful requests, investigate fraud or security incidents, enforce agreements, or protect the rights, property, or safety of Commish, our users, or others.
• Business transaction recipients. Information may be disclosed to advisers, counterparties, or a successor in connection with a financing, merger, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate confidentiality protections.
• Recipients you choose. We disclose information when you direct us to connect an integration, publish content, or otherwise give consent.

We may use and disclose aggregated or deidentified information that cannot reasonably be linked to an individual. We maintain deidentified information in deidentified form and do not attempt to reidentify it except to test our deidentification processes where permitted by law.

The Service currently relies on:

• Supabase for authentication, database, and storage infrastructure;
• Vercel for application hosting, request processing, performance measurement, and web analytics;
• Stripe for connected accounts, payment-related functionality, identity and financial compliance, and fraud prevention;
• Resend for transactional email delivery;
• Cloudflare for Turnstile bot detection and abuse prevention; and
• PostHog for product analytics, session recordings, and error reporting.

These providers may process information in the United States and other countries where they or their subprocessors operate. Their own policies describe the information they process as independent controllers for their accounts or services.

We use cookies and browser storage that are necessary to authenticate users, maintain sessions, remember security and recovery state, redeem invitations, prevent abuse, and attribute referrals. For example, a HttpOnly referral cookie may preserve an eligible referral for up to 30 days. Session or local storage may hold a random capture identifier or temporary sign-in, invitation, and account-recovery state.

Cloudflare Turnstile evaluates browser and request signals to distinguish people from automated abuse. Vercel Web Analytics and Speed Insights measure pages viewed, referrers, approximate geography, device and browser characteristics, and performance. Vercel Web Analytics is designed not to use third-party cookies or create cross-site profiles.

PostHog provides our product analytics, session recordings, and error reporting. It sets a first-party cookie and browser storage on commish.sh and app.commish.sh to recognize a visitor across visits and between our website and the application. It receives pages viewed, clicks, scrolling and other interactions, browser and device characteristics, IP address and the approximate location derived from it, and errors. We remove invitation, sign-in, and recovery secrets from captured page addresses. When you sign in, we link this activity to your account by an internal user ID and the roles the account holds; we do not send your email address or name to PostHog. PostHog processes this information on our behalf as a service provider.

Session recordings help us understand usability problems by showing pages, clicks, scrolling, and the text on screen, including names, email addresses, profile content, and the account and financial details the Service displays to you. Anything typed into a form field is masked before it leaves your browser, and passwords, authentication codes, setup QR codes, and secret keys are masked or excluded. We remove invitation, sign-in, and recovery secrets from captured links and, in the application, keep only the domain of links to other sites. We do not collect console logs or request or response headers or bodies through session recording.

If you visit from the European Economic Area, the United Kingdom, or Switzerland, or we cannot tell which country you are visiting from, session recordings start only after you choose “Allow.” Elsewhere, they are on unless you turn them off. We decide this from the country derived from your IP address. You can turn recordings off and still use Commish, and change your choice at any time through “Privacy choices” on the website or in the application. We remember the choice for up to six months using a preference cookie shared by commish.sh and app.commish.sh, and keep the country decision in session storage until you close the tab. This choice is separate from accepting our terms and acknowledging this Policy. Turning recordings off stops future recording and does not change processing already performed. Recordings are retained for 30 days.

You can block or delete cookies and storage through your browser, but essential account, security, referral, and recovery features may stop working. We do not use third-party advertising cookies and do not track you across unrelated services for targeted advertising.

Commish does not sell personal information for money or other valuable consideration. We also do not share personal information for cross-context behavioral advertising or process it for targeted advertising. We have not done so during the preceding 12 months. Because we do not engage in these practices, there is no need to opt out of them. If our practices change, we will update this Policy and provide legally required choices before using information in that manner.

Where European, UK, or similar law requires a legal basis, we process personal information as necessary to perform our contract with you or take requested steps before entering a contract; to comply with legal obligations; with your consent; and for our legitimate interests in providing, securing, supporting, and improving the Service, managing business relationships, preventing fraud, and enforcing our terms. We balance those interests against your rights and expectations. You may withdraw consent at any time, without affecting processing already performed.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain security and business continuity, comply with legal, tax, accounting, and reporting obligations, resolve disputes, and enforce agreements. The period depends on the type of information, the relationship and feature involved, legal requirements, and whether the information is needed to protect users or the Service.

• Account, workspace, profile, and program information is generally retained while the account or program is active and for a reasonable period afterward for recovery, support, security, and dispute resolution.
• Referral cookies generally expire within 30 days. Attribution, conversion, commission, refund, ledger, payout, audit, and provider-event records may be retained longer because they support reconciliation, fraud prevention, contractual rights, and financial or legal obligations.
• Support, moderation, security, email-delivery, and technical records are retained for periods appropriate to resolving the issue, preventing abuse, and operating the Service.
• Backups are deleted or overwritten on their regular lifecycle. When immediate deletion from a backup is impractical, the information remains protected and is removed when the backup expires or is restored.

When information is no longer needed, we delete or deidentify it. Program Owners may set their own lawful retention periods for data they control, and we follow their instructions where we act as their processor.

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, credential hashing, encryption in transit, row-level authorization, signed requests and webhooks, audit records, and security monitoring appropriate to the Service. No system is completely secure. You are responsible for using a strong password, enabling available multi-factor authentication, securing API and webhook credentials, and promptly reporting suspected unauthorized access to security@commish.sh.

Depending on where you live and subject to applicable exceptions, you may have the right to request access to or a copy of personal information; correction; deletion; portability; restriction or objection to processing; and information about categories, sources, purposes, and recipients. You may also withdraw consent and appeal a denied request where local law provides that right. We will not discriminate against you for exercising a privacy right.

You can update certain account and profile information in the Service. To make another request, email privacy@commish.sh. Describe your request and the email address or workspace involved. We may verify your identity and authority before acting. An authorized agent may submit a request where permitted by law, but we may require proof of authorization or direct identity verification.

If Commish holds information solely on behalf of a Program Owner, we may direct your request to that organization. We may retain information where an exception applies, including to complete a transaction, maintain security, exercise legal rights, or comply with law.

The categories of personal information collected in the preceding 12 months are described in Section 2. They correspond to identifiers; customer-record information; commercial information; internet or electronic-network activity; approximate geolocation; professional or business information; user content that may constitute sensory information; and sensitive information limited to account login and authentication data handled for permitted operational purposes.

We collect these categories from the sources in Section 3, use them for the purposes in Section 4, and disclose them for business purposes to the recipient categories in Section 5. In the preceding 12 months, we may have disclosed each applicable category to workspace and program participants, infrastructure, analytics, and communications providers, payment and fraud providers, professional advisers, authorities, or recipients you directed, as described above. We do not sell or share these categories for cross-context behavioral advertising.

Residents of states with applicable privacy laws may exercise the rights described in Section 12, including any right to appeal our response. We recognize browser-based opt-out preference signals, such as Global Privacy Control, when required for a processing activity in which we engage. We do not currently sell, share, or use personal information for targeted advertising, so such a signal does not alter our present practices.

Commish and its providers operate in the United States and other countries. Your information may therefore be processed in a country with laws different from those where you live. Where required, we use recognized safeguards for international transfers, such as adequacy decisions, data-protection agreements, and standard contractual clauses. Contact us to request more information about applicable safeguards.

If you are in the European Economic Area, United Kingdom, or Switzerland, you may lodge a complaint with your local data-protection authority. We encourage you to contact us first so we can try to resolve your concern.

The Service uses rules and calculations to attribute referrals, determine program eligibility, calculate commission states, enforce rate limits, and identify potential fraud or security events. These tools support service operations and human review. Commish does not use solely automated processing to make decisions about individuals that produce legal or similarly significant effects.

The Service is intended for business users age 18 or older. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact privacy@commish.sh.

We may update this Policy to reflect changes to the Service, law, or our practices. We will post the updated version and change the “Last updated” date. If a change materially affects your privacy rights, we will provide additional notice through the Service or by email where required and obtain consent where applicable law requires it.

For privacy questions, requests, or complaints, email privacy@commish.sh, or write to: