LusyChat Affiliate Program Privacy Notice

Last updated: 28 August 2026

This Affiliate Program Privacy Notice explains how Tensoris Technology Limited ("Tensoris", "LusyChat", "we", "us", or "our") collects, uses, shares, and protects personal data in connection with the LusyChat Affiliate Program, including affiliate applications, the affiliate portal, tracking links, conversion reporting, commission review, and payouts (collectively, the "Affiliate Program").

This notice applies to individual affiliates, affiliate applicants, and representatives or personnel of corporate affiliates. It supplements the general LusyChat Privacy Policy. Referred visitors and LusyChat customers should also read the general LusyChat Privacy Policy and the cookie information presented on the relevant LusyChat landing page. If this notice and the general LusyChat Privacy Policy address the same Affiliate Program processing activity, this notice takes precedence for that activity.

Reading or acknowledging this notice does not constitute consent to optional marketing. Where consent is required, it will be requested separately through a clear, optional choice.

1. Who We Are

The controller of personal data processed for the Affiliate Program is:

Tensoris Technology Limited
Company registration number: C112969
Registered address: Villa Malitah, The Village, Triq Il-Mediterran, San Ġiljan STJ 1870, Malta
Website: https://lusychat.ai
Affiliate and privacy contact: [email protected]

We use the affiliate-management platform provided by Trackdesk s.r.o. to operate the Affiliate Program. For personal data processed within our Trackdesk tenant on our instructions, Tensoris acts as controller and Trackdesk generally acts as processor. Trackdesk's own processing and contact information are described in the Trackdesk Privacy Policy.

We require Trackdesk and other processors to be bound by written data-processing terms appropriate to their role. Those terms must address processing on documented instructions, confidentiality, security, assistance with data-subject requests and incidents, deletion or return of data, and the engagement of subprocessors. We review relevant processor terms, subprocessor information, processing locations, and transfer safeguards before material use and when material changes are notified.

2. Whose Data We Process and Where It Comes From

We may process personal data relating to:

• Individual affiliate applicants and approved affiliates.
• Directors, employees, contractors, or other representatives of corporate affiliates.
• Visitors who click an affiliate link or use an affiliate coupon.
• LusyChat customers whose eligible purchase is attributed to an affiliate.
• Persons who contact our affiliate, finance, privacy, legal, or compliance teams.

We collect information directly from affiliate application and payout forms, from use of the affiliate portal and tracking links, and from LusyChat transaction and account systems. We may also receive relevant information from Trackdesk, payment providers, banks, public blockchain networks, fraud-prevention or sanctions-screening services, analytics or security providers, and publicly available professional or business sources where reasonably necessary to verify an application or investigate suspected abuse.

Where Article 14 GDPR applies because we obtained personal data from another source, we will provide the required information at the first communication, when the data is first disclosed, or within one month of obtaining it, as applicable, unless an exemption under applicable law applies.

3. Personal Data We Collect

3.1 Identity, account, and contact information

• First name and last name.
• Email address, affiliate ID, account status, login and authentication information.
• Country or region and preferred language.
• Telephone number, Telegram handle or number, and Discord username or identifier, where voluntarily provided.

3.2 Business and professional information

• Company or trading name, business type, registered or business address, website URL, and relevant social or media profiles.
• Role, professional profile, affiliate type, and previous affiliate-marketing experience.
• Current and expected traffic, target countries or regions, audience description, and promotional methods.
• Declared traffic sources, such as native advertising, pop or redirect traffic, display advertising, paid social, organic content and SEO, influencers, email, push notifications, or other sources.
• Declared audience verticals, such as AI chat and companions, anime and gaming, dating and relationships, adult entertainment, mainstream entertainment, or other verticals. These answers describe the applicant's intended business audience and are not intended to reveal the applicant's own sex life or sexual orientation.
• Application answers, application status, approval or rejection records, assigned affiliate manager, tags, compliance notes, and review history.

3.3 Payment, billing, and tax information

• Preferred payout method, payout currency, and payment status.
• Bank-transfer details, PayPal account information, or a USDT wallet address and the blockchain network selected in the payout form.
• Billing name and address, invoices, credit notes, commission balances, payout history, payment references, and transaction identifiers.
• VAT number or tax identification number and, only where legally required for payment, tax reporting, or identity verification, an SSN or equivalent national tax identifier.

We will never ask for a cryptocurrency private key, recovery phrase, seed phrase, complete payment-card number, or online-banking password. You must not submit such information to us or through the Affiliate Program.

3.4 Affiliate tracking and conversion information

• Affiliate ID, Click ID or CID, External CID, coupon code, offer and campaign identifiers, and permitted AffS1-AffS5 or other tracking parameters.
• Referring URL, landing page, click time, conversion time, conversion type and status, and attribution record.
• Pseudonymous customer or transaction references, subscription plan and billing cycle, sale amount, commission amount, and refund, cancellation, or chargeback status.
• IP address, approximate location derived from IP, browser type, device type, operating system, time-zone information, cookie or similar-technology identifiers, and security logs.
• Fraud, duplicate-conversion, self-referral, bot, traffic-quality, sanctions, and other compliance signals.

We do not need and do not intentionally send a referred customer's name, email address, private chat content, prompts, generated content, account password, full payment details, precise sexual preference, sexual orientation, character or content tags, government identity document, or other special-category or unnecessary customer data to Trackdesk.

Affiliates must not place such information in tracking links, AffS1-AffS5 parameters, postbacks, support messages, coupon fields, or other custom tracking fields. Permitted tracking parameters should be limited to non-sensitive campaign information such as channel, campaign, ad set, placement, or creative identifier. If prohibited data is submitted, we may delete or restrict it and suspend the relevant integration.

3.5 Communications and compliance records

• Messages and attachments sent to our affiliate, finance, privacy, legal, support, or compliance teams.
• Records of notices, policy acknowledgements, disputes, appeals, complaints, investigations, and data-protection requests.

4. Why We Process Personal Data and Our Legal Bases

4.1 Affiliate applicants and affiliates

• Application review and onboarding: to assess an application, verify information, communicate a decision, and take steps requested before entering into an affiliate agreement. The legal bases are pre-contractual steps and our legitimate interests in selecting genuine and suitable partners.
• Operating the affiliate relationship: to create and administer an account, provide tracking links and reports, manage offers and promotional materials, provide support, and enforce the affiliate agreement. The legal basis is performance of the affiliate agreement.
• Commission review and payouts: to calculate and validate commissions, apply the review period and payout threshold, issue accounting documents, process payouts, and manage refunds, cancellations, chargebacks, and disputes. The legal bases are performance of the affiliate agreement, legal obligations, and our legitimate interests in maintaining accurate financial records.
• Tax, accounting, and regulatory compliance: to collect required tax or billing details, maintain financial records, respond to authorities, and comply with applicable tax, accounting, sanctions, anti-fraud, and other laws. The legal basis is compliance with legal obligations.
• Security and program integrity: to prevent invalid traffic, self-referrals, duplicate or test transactions, impersonation, account compromise, payment fraud, sanctions breaches, prohibited promotional methods, and other violations. The legal bases are our legitimate interests in protecting LusyChat, users, and legitimate affiliates and, where applicable, legal obligations.
• Transactional communications: to send application decisions, security alerts, payout updates, policy notices, and service announcements necessary to administer the Affiliate Program. The legal bases are performance of the affiliate agreement and our legitimate interests in program administration.
• Optional marketing communications: to send optional promotions or partner opportunities that are not required to operate an account. Where consent is required, we rely on a separate, optional consent. Consent may be withdrawn at any time without affecting program eligibility or payment.
• Legal claims and enforcement: to establish, exercise, or defend legal claims and enforce our terms. The legal bases are our legitimate interests and, where applicable, legal obligations.

4.2 Referred visitors and LusyChat customers

• Necessary affiliate attribution: to associate an eligible visit, coupon, or first qualified purchase with an affiliate, calculate the affiliate payout, prevent duplicate attribution, and resolve attribution disputes. We rely on our legitimate interests in operating and measuring the Affiliate Program, subject to the rights and reasonable expectations of visitors and customers.
• Non-essential cookies and similar technologies: where applicable law requires consent, we rely on the visitor's consent before placing or accessing the relevant non-essential technology. Consent can be refused or withdrawn through the LusyChat consent interface without losing access to essential website functions.
• Purchase, account, and customer-service processing: these activities are governed by the general LusyChat Privacy Policy and are not based on the affiliate agreement.

Where we rely on legitimate interests, we assess the necessity and proportionality of the processing and balance our interests against the rights and reasonable expectations of the individuals concerned.

5. Required and Optional Information

Fields marked as required are necessary to assess an application, enter into or perform the affiliate agreement, comply with applicable law, or process a payout. If required information is not provided or is inaccurate, we may be unable to approve or maintain an affiliate account or process a payout.

Telephone, Telegram, and Discord information is optional unless we clearly explain that a particular channel is required for a separately agreed support arrangement.

At the application stage, we normally collect only the information needed to review the application. We do not request an SSN as part of the general affiliate application. Tax information is requested after approval, normally when the affiliate approaches the first payout or when tax reporting otherwise requires it. The relevant field should be labelled "VAT / Tax ID / SSN (only if legally required)". We do not require every applicant to provide an SSN.

If an SSN or equivalent national tax identifier is legally required, we will identify the reason and provide a designated secure submission method. Affiliates must not send an SSN through ordinary email, Telegram, Discord, affiliate-manager messages, free-text application fields, or tracking parameters. Access is restricted to authorised finance, tax, compliance, privacy, security, or legal personnel with a work-related need. After verification, we will minimise, mask, or delete the full identifier where continued retention is not legally required. If a suitably secure collection method is not available, we will not request the identifier through the affiliate portal.

For USDT payouts, the affiliate must select a network currently shown as supported in the payout form and provide a wallet address valid for that network. The affiliate is responsible for checking network and address compatibility. We will not intentionally initiate a transfer on a network different from the selected network.

6. How We Share Personal Data and the Parties' Roles

We may disclose personal data only as reasonably necessary to:

• Trackdesk and its authorised subprocessors, which operate the affiliate portal, tracking, reporting, and related functions on our instructions as processors or subprocessors.
• Authorised Tensoris personnel, including affiliate operations, finance, compliance, security, privacy, legal, and support personnel, on a need-to-know basis.
• Payment and financial-service providers, including PayPal, banks, cryptocurrency payment providers, blockchain infrastructure providers, and relevant tax or accounting providers. Some of these recipients may act as independent controllers under their own legal obligations and privacy notices.
• Cloud, content-delivery, security, bot-prevention, fraud-prevention, sanctions-screening, analytics, email, and support providers used to operate and protect the Affiliate Program.
• Professional advisers, including accountants, auditors, lawyers, insurers, and consultants, subject to confidentiality obligations.
• Tax authorities, supervisory authorities, courts, law-enforcement bodies, and other public authorities where disclosure is required or permitted by law.
• A buyer, investor, lender, or successor organisation in connection with a proposed or completed merger, financing, reorganisation, sale, or transfer of all or part of our business, subject to appropriate safeguards.
• Other parties at your direction or with your consent.

If an affiliate configures a postback, we may send that affiliate's own tracking platform limited pseudonymous conversion information selected in the approved postback configuration. We do not authorise postbacks containing customer names, customer email addresses, chat content, full payment information, special-category data, or other unnecessary identifiers.

We do not sell affiliate personal data.

7. International Data Transfers

Some recipients may process personal data outside Malta or the European Economic Area, including in the United States and other jurisdictions. Where required, we use an applicable adequacy decision, the European Commission's Standard Contractual Clauses, and appropriate supplementary technical and organisational measures. Information about relevant safeguards or how to obtain a copy may be requested at [email protected].

We maintain records of relevant processors and transfer safeguards and review them when a material provider or processing location changes. Further information about the categories of processors and applicable safeguards may be requested at [email protected].

8. Cookies, Tracking Links, and Attribution

The affiliate portal uses strictly necessary cookies or similar technologies for login, authentication, session management, security, load balancing, and interface preferences. Without these technologies, the portal may not function correctly.

When a visitor follows a LusyChat affiliate link, Trackdesk may generate a pseudonymous Click ID and store or read an attribution cookie, such as a trakdesk_cid cookie or tenant-specific equivalent. LusyChat may also retain the CID or External CID in a server-side record so that an eligible conversion can be matched to the referring affiliate.

The current standard Affiliate Program configuration is:

• Attribution model: Last Touch.
• Browser attribution-cookie period: 30 days.
• Server-side attribution expiration: 30 days.
• Purpose: to attribute an eligible first qualified paid subscription to the appropriate affiliate and prevent duplicate attribution.

The setting in effect at the time of the click determines the applicable expiry for that click. Offer-specific settings may differ where clearly disclosed in the relevant offer terms.

Where consent is legally required, a non-essential affiliate-attribution cookie or similar technology will not be placed or accessed before valid consent is obtained. Visitors can refuse or withdraw consent as easily as they give it through the LusyChat consent interface. The live cookie declaration or consent interface identifies the technologies currently used, their providers, purposes, categories, and durations.

We maintain a cookie and similar-technology inventory and periodically test the LusyChat website, affiliate-link landing flow, and Trackdesk registration and portal surfaces. These checks are designed to confirm that non-essential technologies are blocked before consent where required, that refusal is offered as readily as acceptance, that consent can be withdrawn, and that the live names, domains, providers, purposes, and durations match the published information. If a scan identifies a material discrepancy, we will correct the configuration or update the relevant notice.

Each affiliate is independently responsible for providing notices and obtaining any consent required for technologies used on the affiliate's own website, app, email, advertisement, or other promotional property.

9. Public Blockchain and Cryptocurrency Payouts

If an affiliate chooses a USDT payout, the wallet address, selected network, amount, transaction hash, timestamp, and related transaction information may be recorded on a public blockchain. Public blockchain records may be visible worldwide, may be copied or analysed by third parties, may reveal relationships between wallet addresses, and generally cannot be altered or deleted by Tensoris.

Cryptocurrency transfers are normally irreversible after confirmation. Affiliates must verify the wallet address and network before submitting or changing payout details. We may use payment, fraud-prevention, or sanctions-screening providers to assess a wallet or transaction where reasonably necessary or legally required.

The currently supported network list, network-selection rules, fees, and transfer conditions are maintained in the Affiliate Payment Terms and the live payout form rather than in this notice, because availability may change. We do not intentionally write an affiliate's name, email address, postal address, tax identifier, identity document, login information, or LusyChat chat or content data to a public blockchain.

The rights to correction or erasure do not enable Tensoris to alter or erase data already recorded on a public blockchain. We will, however, apply those rights to the off-chain association between an affiliate and a wallet address and to other personal data within systems under our control, subject to applicable legal and accounting exceptions.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this notice and apply the following standard periods unless a longer or shorter period is required or justified:

• Incomplete, withdrawn, or rejected applications: normally 12 months after the last activity or decision, to document the decision, respond to queries, and prevent repeated abuse.
• Approved affiliate account, application, communication, and compliance records: for the affiliate relationship and normally up to 24 months after account closure or the last relevant activity.
• Click and conversion records: normally up to 24 months after the event, unless required for an unresolved payout, refund, chargeback, fraud review, audit, dispute, or legal claim.
• Invoices, credit notes, payout transaction records, and legally required tax or accounting records: for the applicable statutory period. Malta income-tax records are generally retained for at least nine years after completion of the relevant transactions, while VAT records are generally retained for at least six years from the end of the relevant year. A longer period may apply under another law, audit, or unresolved legal matter.
• Current bank-account, PayPal, and wallet payout instructions: for as long as needed to administer the payout method and normally deleted or masked after account closure or replacement, unless retention is required for an unresolved payment, fraud review, audit, or legal claim. Accounting evidence of a completed payment may be retained without retaining every reusable account credential in full.
• Security logs: normally up to 12 months, unless needed for an active security investigation or legal claim.
• Consent, notice, and policy-acknowledgement records: for as long as reasonably needed to demonstrate compliance or resolve a dispute.

We apply the retention schedule through periodic reviews and deletion or anonymisation procedures. A record may be placed on a documented legal hold where it is reasonably required for an unresolved payout, refund, chargeback, fraud or security investigation, audit, tax matter, dispute, or legal claim. The hold is reviewed and removed when the relevant need ends.

When a valid deletion request is received, we verify the requester's identity, identify the relevant systems and processors, separate records that must lawfully be retained, and delete or anonymise the remaining data. Where conversion or payout records must be preserved for accounting, fraud prevention, or dispute resolution, we may replace direct identifiers with anonymous or pseudonymous values while retaining the minimum necessary business record. We instruct relevant processors to take corresponding action where required. Copies in protected backups are isolated from ordinary use and deleted or overwritten in accordance with the applicable backup cycle, unless a legal hold applies.

We maintain a limited audit record of the request, the decision, the systems addressed, the action taken, the responsible person, and the date. That record is not intended to recreate personal data that has been erased. Public blockchain records are subject to Section 9 and are not under our unilateral control.

11. Security

We use administrative, organisational, and technical measures designed to protect Affiliate Program personal data, including role-based access, least-privilege permissions, encryption in transit, account protections, security logging, vendor review, and incident-response procedures. Access to tax and payout details is restricted to personnel who require it for finance, tax, compliance, privacy, security, or legal functions. We periodically review access rights and remove access when it is no longer required.

No online system is completely secure. Affiliates are responsible for protecting login credentials and payout-account information and for reviewing payout details before submission. Contact [email protected] promptly if you suspect unauthorised access, an incorrect payout address, or another security issue.

12. Fraud Screening and Automated Tools

We and our providers may use automated rules and risk signals to flag suspicious applications, invalid clicks, duplicate conversions, self-referrals, bots, chargebacks, prohibited traffic, sanctions concerns, or other potential abuse. A flag may temporarily place an application, conversion, commission, or payout on hold while it is reviewed.

We do not make a final decision to reject an application, terminate an affiliate account, permanently forfeit a commission, or deny a payout solely through automated processing where that decision would produce legal or similarly significant effects on an individual. A suitably authorised person reviews the relevant information before such a final adverse decision. The affected affiliate may request an explanation, provide relevant information, and contest the decision by contacting [email protected].

13. Your Data-Protection Rights

Subject to applicable law and relevant exceptions, you may have the right to:

• Obtain confirmation and access to personal data we process about you.
• Correct inaccurate or incomplete personal data.
• Request deletion of personal data.
• Request restriction of processing.
• Object to processing based on legitimate interests and object at any time to direct marketing.
• Receive certain personal data in a structured, commonly used, machine-readable format and request portability where applicable.
• Withdraw consent at any time where processing is based on consent, without affecting prior lawful processing.
• Request human intervention and contest a qualifying automated decision.
• Lodge a complaint with a competent supervisory authority.

To exercise a right, contact [email protected]. We may request information reasonably necessary to verify identity and protect the account from unauthorised disclosure. Requests are normally handled free of charge and within one month. Where permitted by law, this period may be extended by up to two additional months for a complex or numerous request, in which case we will explain the extension. We may charge a reasonable fee or refuse a manifestly unfounded or excessive request where applicable law permits.

You may lodge a complaint with your local data-protection authority or with:

Office of the Information and Data Protection Commissioner (Malta)
Floor 2, Airways House
High Street, Sliema SLM 1549, Malta
Telephone: +356 2328 7100
Email: [email protected]
Website: https://idpc.org.mt

14. Adults Only

The Affiliate Program is intended only for persons who are at least 18 years old and have legal capacity to enter into a business agreement. We do not knowingly accept affiliate applications from minors. If you believe a minor submitted personal data through the Affiliate Program, contact [email protected].

15. Changes to This Notice

We may update this notice to reflect changes in the Affiliate Program, providers, legal requirements, or processing practices. We will update the version and last-updated date. Where a change materially affects individuals, we will provide additional notice through the affiliate portal, the LusyChat affiliate page, or email as appropriate. Changes to this notice do not create consent for optional processing that requires a separate consent.

16. Contact Us

Questions, requests, or complaints about the Affiliate Program or this notice should be sent to:

Tensoris Technology Limited
Attn: Affiliate Privacy
Villa Malitah, The Village, Triq Il-Mediterran
San Ġiljan STJ 1870, Malta
Email: [email protected]