Partner Privacy Notice

01 · Collection

What we collect

When you apply to and take part in No Boring Partners, we collect:

• Your name and email, for your partner account and to reach you.
• Your channel: the website, social account, newsletter or other place you promote from, which you tell us when you apply.
• Your country, as a two-letter code, used for tax handling and to meet sanctions and anti-money-laundering rules.
• Your tax details, collected before your first payout: your Australian Business Number (ABN) and whether you are registered for GST, or a Statement by a supplier if the no-ABN exemption applies to you. Partners outside Australia will give us a short residency self-declaration instead.
• Your payout details, collected before your first payout: how you want to be paid (Wise, PayPal, PayID or direct bank transfer), and the handle or account details for that method.
• Your agreements: which version of the Partner Terms you accepted and when, and, before your first payout, your agreement to our recipient-created tax invoice (RCTI) arrangement.
• Your referral and commission data: the referral code assigned to you, the orders and plan subscriptions that came through your link, and the commissions you have earned, held, and been paid.
• A sign-in record: partner login is passwordless. When you log in we store only a one-way hash of a short-lived login link, never a password.

Card numbers never touch us. You are being paid here, not charged. What we hold depends on the payout method you choose: for Wise, your account details go to the rail and we store only an opaque recipient reference, not your account number; your PayID or PayPal handle is personal information we hold so we can send your money; and if you choose direct bank transfer we hold your account details, encrypted, for that purpose only.

02 · Purpose

Why we collect it

To run the program, and nothing beyond that: to attribute referrals to you, to work out and pay your commissions, to verify your tax status so we can pay you lawfully, to issue your recipient-created tax invoices, to send you program and payout email, to prevent fraud and self-dealing referrals, and to meet our obligations under Australian tax and anti-money-laundering law. We do not collect information we do not need for those jobs.

03 · Legal bases

Our basis for holding it

We handle your information in line with the Australian Privacy Act and the Australian Privacy Principles. We collect it because it is reasonably necessary to run the partner program you asked to join and to meet our legal obligations, in particular our tax obligations before money can move. We rely on your consent for anything optional, such as program marketing, and you can withdraw that consent at any time.

If you are in the EEA or the UK, our lawful bases under the GDPR and UK GDPR are: performing the partner agreement you asked to join, compliance with our legal obligations (tax law in particular), and your consent for anything optional. You also have the GDPR rights described in §10.

04 · Tax details

Your tax information, and why we need it

Because we pay you, Australian tax law makes us collect a little more than an ordinary signup would:

• ABN and GST status. A valid ABN lets us pay your commissions without withholding tax. Before your first payout we will check the ABN against the public ABN register and record the date we did.
• Statement by a supplier. If you are a hobbyist without an ABN, this on-file exemption lets us pay you without withholding.
• Residency self-declaration. Partners outside Australia will give a short declaration of where they are resident instead of an ABN.
• Recipient-created tax invoice (RCTI). With your written agreement, we issue the tax invoice for your commission on your behalf, so you do not have to raise one. We record that you agreed and when, and we keep each RCTI we issue.

We use this information only for tax compliance and for paying you.

05 · Payouts

How your payout details are handled

Before your first payout you choose a payout method and we collect what that method needs, nothing more. The methods we offer are Wise, PayPal, PayID and direct bank transfer. For Wise, your account details go to the rail and stay there; we store only an opaque recipient reference, never your raw account number. Your PayPal email or PayID handle is personal information we hold so we can send your money. If you choose direct bank transfer, we hold your account details, encrypted, for that purpose only. Wise and PayPal are overseas providers, so choosing one means your details are disclosed and processed outside Australia.

06 · Storage

Where it lives

Your partner record and the commission ledger are stored in Cloudflare D1, our database, which runs on Cloudflare’s global edge network. That means data can be processed on infrastructure outside Australia. The commission ledger is append-only: earnings and reversals are written as immutable entries and your balance is calculated from them, so your payment history cannot be quietly rewritten. Access on our side is limited to what running the program requires.

07 · Processors

Who else touches it

We use a small set of processors, each for one job:

• Cloudflare: hosting, database and security for the partner dashboard and the commission ledger.
• Stripe: processes the payments made by the customers you refer. Stripe tells us a referred order or subscription was paid, and that is what triggers your commission. It never holds your payout details.
• Resend: sends our program and payout email, like approval notices and payout confirmations.
• Umami (planned): if we add analytics to the partner pages, it will be privacy-first, self-hosted Umami. It is cookieless and does not build a profile of you. It is not yet deployed.
• Wise, PayPal, PayID and direct bank transfer: move your payouts. What we hold for each is set out in §05.

We do not sell personal information. Not to data brokers, not to advertisers, not to anyone.

Cloudflare, Stripe, Resend, Wise and PayPal process data outside Australia, mainly in the United States (Wise also in the United Kingdom and Europe). Before we disclose your information to them we take the steps the Australian Privacy Principles (APP 8) require: each is bound by its own privacy and security commitments under contracts that hold it to them.

08 · IP addresses

Rate limiting without raw IPs

To keep the application form, login and dashboard from being abused, we rate-limit by a salted hash of your IP address. The hash lets us count requests; it cannot be reversed into the address. We never store raw IP addresses.

09 · Retention

How long we keep it

We keep your program data while you are a partner and for as long afterwards as we need it to close out your account. Tax and payout records, including your ABN, the RCTIs we issue, and the commission ledger, are kept for at least five years as Australian tax law requires, and up to seven years where company record-keeping law requires it, after which they are deleted or de-identified. When nothing in the law needs it, it is deleted.

10 · Your rights

Access, correction, deletion

Email [email protected] to ask what we hold about you, to correct it, or to have it deleted. We answer in plain words and act on the request unless the law requires us to keep something, and tax records are the usual exception, in which case we tell you what and why. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC). If you are in the EEA or the UK, you also have the GDPR rights to access, rectification, erasure, restriction, portability and objection, and the right to complain to your local data protection authority. Partners elsewhere may have further rights under their local law, and we honour requests under them.

11 · Cookies

Cookies and local storage

Three small things: a first-party referral cookie (nbs_ref) that lasts 90 days so the partner who referred a buyer gets credit, and the most recent referral link wins; a preference that remembers your light-or-dark theme choice; and a short-lived sign-in session when you log into your dashboard. Any analytics we add will be cookieless (see §07). There is no third-party tracking and no cookie soup.

12 · Changes

Changes to this notice

We can update this notice. When we do, the date at the top of this page changes, and for a material change we will take reasonable steps to notify active partners by email before it applies to them. This notice sits alongside the Partner Terms, and the main site Privacy Policy covers the customers you refer and their own information.