1. Who we are

Splitbag Technology ("Splitbag", "we") operates splitbag.com. This policy explains how we handle personal information when you visit the site or use the Service. It is a Version 1 draft that takes effect on launch.

2. Information we collect

Account information. Name, email address, password hash (argon2id), sign-in method, role (builder, contributor or both), profile details, avatar or logo, location (city) you choose, and the legal and agreement acceptances we record with a timestamp and IP address.

Payment and tax information. Payments are handled by Stripe. Builders connect their own Stripe account to Splitbag. Contributors onboard to Stripe Express, where Stripe collects identity, bank and tax identification details. Splitbag does not store full card or bank numbers. We store Stripe identifiers, statement lines, debit and payout records and the status of tax forms.

Charge data from builders' Stripe accounts. To compute commissions we read charges, refunds, disputes, invoices and customer events from the builder's Stripe account. We store amounts, dates, status, country, price or product identifiers and attribution results. Customer identifiers such as email addresses are stored in hashed form where we only need to match or deduplicate them. We do not give contributors customer names or contact details.

Tracked link and attribution data. When someone clicks a tracked link we record the link, time, coarse location, referrer and technical details. We use a first-party cookie or local storage value to attribute a later purchase to the right engagement. Bot and prefetch hits are filtered out.

Device and network information for fraud signals. IP address, user agent, device signals and card fingerprints help detect self-referral, fake accounts and abuse.

Messages, applications and files. Content you send through the Service, and files you upload, such as logos and screenshots, which are stored with Cloudflare R2.

Usage and diagnostics. Product analytics through PostHog and error reports through Sentry, which may include page, device and performance information.

Support requests. What you send through the contact form or by email.

3. How we use information

• Provide the Service: accounts, listings, applications, agreements, attribution, statements, debits and payouts.
• Verify revenue and rank listings by Stripe-verified revenue.
• Detect and prevent fraud, abuse and security incidents.
• Send transactional email and, where you allow it, non-essential email. See the SMS and Email Policy.
• Meet tax, accounting and legal obligations, including Form 1099-NEC reporting for US contributors paid $600 or more in a year.
• Understand and improve the Service.
• Generate public pages and link previews from information you choose to make public.

4. Public information

Product pages, offers, builder cards and contributor profiles you publish are visible to anyone, and so are link previews of them. A contributor's verified results are shown only if the contributor opts in. Revenue is shown at the disclosure level the builder chooses: exact, range or hidden.

5. Who we share with

We do not sell personal information. We share it with:

• Service providers that process data for us: Stripe (payments and tax forms), Resend (email), Cloudflare (DNS, edge and R2 storage), PostHog (analytics), Sentry (error monitoring), and our hosting provider.
• The other party to an engagement, to the extent needed: builders see applicant profiles and results, contributors see the product, offer and attributed deal amounts without customer identities.
• Authorities and advisors where required by law, to protect rights and safety, or in a business transfer, with notice where required.

6. Cookies and similar technologies

We use essential cookies for sign-in and security, a first-party attribution cookie or local storage value for tracked links, and analytics identifiers. We do not rely on third-party cookies. You can block cookies in your browser, but sign-in and attribution may stop working.

7. Retention

We keep information as long as needed for the purposes above and to meet legal, tax and audit duties. Financial records, agreements and statements are kept for as long as the law requires. Retention periods for link clicks, sessions and other data are set in our settings and published here when set.

8. Your rights

If you are a US resident, depending on where you live you may have the right to know what we hold, access and receive a copy, correct inaccurate data, delete data, opt out of sale or targeted advertising (we do neither), and not be discriminated against for using these rights. Email [email protected] to make a request. We will verify your identity, respond within the period the law requires, and tell you if we must keep something for legal reasons. You may appeal a refusal by replying to our response.

9. Children

The Service is for people 18 and older. We do not knowingly collect information from anyone under 18, and we delete it if we learn we have.

10. Security

We use encryption in transit, hashed passwords, access controls, audit logs, rate limits and input checks. No system is perfectly secure. Tell us at [email protected] if you find a vulnerability or suspect a breach affecting your account, and we will notify affected people as the law requires.

11. International use

Splitbag is operated from the United States and contributors are US-based at launch. Builders elsewhere understand their information is processed in the United States.

12. Changes

We may update this policy. For material changes we will give notice in the product or by email before they take effect. The version and status are shown at the top.

Contact

Splitbag Technology, [email protected], splitbag.com.