Last updated 2 October 2026 · Operated by an individual · Contact xuanhinh.affiliate@gmail.com
This policy covers affreedom.org, the Affreedom Research workspace on its subdomain, and the landing pages reached from my Google Search ads. All of it is operated by one individual, who is the data controller for the purposes of this policy. Write to xuanhinh.affiliate@gmail.com with any question or request.
1. Visitor data on my websites
| What | Why | Kept for |
|---|---|---|
| Server logs — IP address, user agent, page requested, timestamp | Keeping the sites running; investigating abuse | 12 months |
| Aggregated analytics — traffic totals and trends | Knowing which pages are read. Totals only, not individuals | Aggregates only; no individual records retained |
Google click identifier (gclid), carried in the URL when a visitor arrives from one of my ads | Telling which ad produced a result, and matching a confirmed affiliate sale back to the ad that caused it | 12 months, then deleted |
| Affiliate network identifiers, set when a visitor clicks through to a merchant | Crediting the referral. Set on the network’s side | Governed by that network’s own policy |
The click identifier is not combined with a name, email address or any other identifying detail, is not used to build a profile, and is not sold or shared with third parties beyond Google for conversion measurement.
I do not ask visitors to create accounts on the public pages, do not collect payment details, and do not run a newsletter. I do not sell or rent visitor data to anyone.
2. Google Ads data
This section exists because the workspace uses the Google Ads API, and it should be clear exactly what happens to that data.
- Scope. Performance and configuration data is read for Google Ads accounts I own, linked under my own manager account. No other advertiser’s account is accessed, and there is no mechanism to add one. A check that refuses any customer ID outside the reachable list is being built.
- Use. It is used by me to decide what to pause, what to bid on, and where spend is being wasted. Nothing more.
- Not shared. It is not sold, resold, licensed, published, or exposed through any public interface. The workspace pages are behind a login.
- Not mixed. Google Ads performance data is not combined with consumer personal data, because no consumer personal data is held alongside it.
- Where it sits. On a private server. Daily snapshots are kept for 12 months and then deleted.
- Credentials. The OAuth refresh token and developer token live in a file readable only by the account that runs the tool, excluded from source control, and never printed in output or logs. Account identifiers are redacted from error messages before those messages are stored or shown. If the server is decommissioned, access is revoked from the Google account’s permissions page.
3. Affiliate network data
The workspace reads affiliate network APIs with my own credentials to list the programmes I have been approved for, with their commission terms and permitted regions. That is information about businesses and their public offers — it contains no personal data about consumers. Any network credential stored in the workspace is encrypted, is used only for the account that saved it, and is never shown back to anyone.
4. The AI assistant
I operate the tool by describing what I want in plain language; an assistant (Anthropic Claude) translates that into calls to the tool. Aggregated account metrics and campaign settings are therefore processed by that assistant in order to answer my questions. No consumer personal data is sent to it.
5. Third parties
- Google — advertising delivery and conversion measurement. Google’s own privacy policy applies to data it processes.
- Affiliate networks whose merchant offers I promote — each has its own policy, which applies once a visitor is on their property or a merchant’s.
- Anthropic — as described in section 4, for aggregated metrics only.
There are no other processors. No data broker, no advertising network beyond Google, no analytics vendor receiving individual-level records.
6. Your rights
Write to xuanhinh.affiliate@gmail.com to ask what is held about you, to ask for a copy, or to ask for it to be deleted. I reply from one person, usually within a day or two, and will act on a deletion request within 30 days.
Because the public pages hold no accounts, the practical scope of such a request is server log and click-identifier data, which I will locate and remove. Google’s own advertising controls are at myadcenter.google.com; see also the cookie policy.
7. Changes
If this policy changes, the date at the top changes with it. Material changes will be described here rather than applied quietly.