Everything the plugin records stays in your own WordPress database, on your own domain. No referral data is sent anywhere, and no request leaves your site to us in order to track a visit.
What is stored
- Visits — the referrer, the landing URL, the campaign, a timestamp and a truncated IP.
- Referrals — the order reference, the amount, the affiliate and the status.
- Affiliates — the WordPress user, their payout preference and its details.
IP addresses are truncated on the way in, not on the way out. What lands in the table already identifies a network rather than a household.
Retention
Set a visit retention window under Settings → Privacy. Visits older than the window are deleted on a schedule; referrals are not, because they are financial records and you will need them longer than you need click history.
You are the controller
For your affiliates and their referred customers, you are the data controller — not us. The plugin registers WordPress’s own exporter and eraser, so an access or erasure request submitted through Tools → Export Personal Data or Erase Personal Data covers affiliate and referral records without you writing SQL.
Erasure and money owed
Erasing a person who is owed money is a genuine conflict: you have an obligation to pay them and an obligation to erase them. The eraser removes identifying detail and keeps the financial record, which is the position most regulators take — but if the request is contested, that is a question for your lawyer and not for a settings screen.
Cookies
The referral cookie is first-party and functional. Whether it needs consent where you operate depends on your jurisdiction and your reading of it; the cookie name and window are both visible in Settings so you can document them.