This Privacy Policy explains how Tolt, Inc. (“Tolt,” “we,” “us” or “our”) collects, uses and shares personal information when you visit our websites, use the Tolt platform, join a program on Tolt as an affiliate or otherwise deal with us, and the choices and rights you have.
1. Who we are and our role
Tolt, Inc. is a Delaware corporation at 2093 Philadelphia Pike #2726, Claymont, DE 19703, USA. You can reach us about privacy at compliance@tolt.com.
Businesses use Tolt to run affiliate and referral programs (we call them “Merchants”). Our role depends on whose information it is:
- We’re the controller of information about visitors to our websites, the people who use Tolt for a Merchant (account owners and their teams), people who contact us or book a demo, and affiliates when we pay them as their payment agent and carry out the checks the law requires for that, or screen them across programs to prevent fraud.
- We’re a processor, or service provider, for the information Merchants have us process in their programs: their affiliates’ profiles and activity, and the customers those affiliates refer. We process it on the Merchant’s behalf and instructions, and the Merchant’s own privacy policy applies to it. If you’re an affiliate or a referred customer with a question about that information, contact the Merchant. If you contact us instead, we’ll pass your request on.
2. Information we collect
Information you give us
- Account information: your name, email address, company, website and role, and those of the team members you invite.
- Billing information: your billing contact and address, plan and payment history. Card details go to our payment processor, Stripe, and we don’t store full card numbers.
- Communications: what you send us by email or in support chats, and what you give us when you book a demo, such as your name, email address, website and notes.
- Affiliate information: when you join a program as an affiliate, the details the program asks for, such as your name, email address, country and the websites or channels you promote on.
- Payout information: if you’re paid through Tolt, your payout details (such as your PayPal email address or bank account), your tax information (such as a W-9 or W-8 form and your tax identification number) and what we need to verify your identity and screen you against sanctions lists, such as your date of birth and, for some affiliates, a photo of an identity document and a selfie (see section 3).
Information collected automatically
- Usage and device information: your IP address, browser and device, the pages and features you use, the date and time, the page that sent you, and your approximate location, based on your IP address.
- Cookies and similar technologies: described in section 6.
Information we process for Merchants
- Affiliate activity: affiliates’ profiles, referral links and codes, clicks, referrals and commissions.
- Clicks on referral links: the visitor’s IP address, browser and device, the referring page and the time, recorded to attribute referrals and detect fraud.
- Referred customers: the email address or other identifier that the Merchant or its billing provider (such as Stripe, Paddle or Chargebee) sends us, and payment events such as subscriptions, payments and refunds. Merchants that use our API choose what they send, and can send anonymous IDs instead of email addresses.
Information from others
- Payment and payout providers tell us whether payments and payouts went through.
- Our identity verification provider tells us the result of an affiliate’s identity check and sanctions screening.
- On our own website, business information services may tell us which company, and sometimes which professional, visited, based on information they hold.
3. Identity checks and biometric information
Before paying an affiliate, we check their identity and screen them against sanctions and anti-money-laundering lists, through our identity verification provider, Didit. For some affiliates, the check also asks for a photo of an identity document and a selfie, and Didit compares the face in the selfie with the photo on the document using a scan of face geometry, which is biometric information.
Before that comparison, we tell you about it and ask for your written consent. We and Didit use biometric information only to verify your identity and prevent fraud, and never sell, lease or trade it or otherwise profit from it. We destroy it when the purpose for collecting it has been met or within three years of your last interaction with Tolt, whichever comes first, unless a warrant or subpoena requires us to keep it.
4. How we use information
We use personal information for the purposes below. If you’re in the European Economic Area, the United Kingdom or Switzerland, the second column gives our legal basis for each.
| Purpose | Legal basis |
|---|---|
| Provide, maintain and support the Service, including tracking, commissions, the affiliate portal and emails | Performing our contract with you; for information we process for Merchants, the Merchant’s instructions |
| Pay affiliates and meet our legal obligations, including identity checks, sanctions and anti-money-laundering screening, tax forms and record keeping | Performing our contract with the affiliate; complying with the law, and our legitimate interest in meeting the U.S. sanctions, anti-money-laundering and tax laws that apply to us; your consent, for comparing a selfie with an identity document |
| Keep Tolt secure and prevent fraud, including spotting accounts linked to abuse across programs on Tolt | Our legitimate interest, and that of Merchants and affiliates, in preventing fraud |
| Run the AI features you use, such as Tolt Agent and the translation of email templates | Performing our contract with you |
| Understand and improve how Tolt is used, and fix errors | Our legitimate interests |
| Send service messages, and market Tolt by email, in ads and on our website | Performing our contract with you, for service messages; our legitimate interests or, where the law requires it, your consent, for marketing |
| Comply with the law, enforce our terms and respond to lawful requests | Complying with the law; our legitimate interests |
We don’t use personal information to train AI models. You can unsubscribe from our marketing emails at any time with the link in each one.
5. How we share information
- Service providers that process information for us, such as hosting, email and analytics providers, under contracts that limit what they can do with it. Those that process information in the Tolt platform are listed on our subprocessor page; others, such as our scheduling tool, Cal.com, help us run our website and sales.
- Payment and payout providers, such as Stripe, PayPal and Airwallex, to take payments and pay affiliates.
- Merchants: an affiliate’s profile and activity, and the status and amounts of their payouts, go to the Merchant whose program they joined. Merchants don’t see affiliates’ tax forms, identity documents or payout account details, though they may see a flag if our fraud screening links an affiliate to abuse in another program.
- Affiliates: about the customers they refer, affiliates see only a partly hidden email address (or the identifier the Merchant sends us) and the amounts they earn.
- Advertising and analytics partners on our website, through the cookies and tags described in section 6.
- Authorities and others, when the law requires it or to protect the rights, safety and property of Tolt, our users or others.
- A buyer or successor, if Tolt is involved in a merger, acquisition or sale of assets, subject to this policy.
- Anyone else, with your consent.
We don’t sell personal information for money. Under some U.S. state laws, the advertising tags on our website may count as “selling” or “sharing” personal information; section 10 explains your choices.
6. Cookies and tracking
On our websites, we and our partners use cookies and similar technologies:
- to make the site work and keep it secure
- to measure how it’s used (Google Analytics, RudderStack, Mixpanel and ProfitWell)
- to measure and personalize our advertising (Google Ads, Meta, LinkedIn, X and Reddit)
- to learn which companies visit us (RB2B and Apollo)
- for support chat (Intercom)
- to credit the affiliate who referred you, if you arrive through a link in Tolt’s own affiliate program
In the Tolt dashboard, we use PostHog and RudderStack to understand how Tolt is used, Google Tag Manager for our marketing tags, Intercom for support and Sentry to catch errors.
On Merchants’ websites, Merchants add Tolt’s tracking script. When a visitor arrives through a referral link, it stores the referral and the IDs of the click, the affiliate and the program (and, once the visitor signs up, the customer) in two first-party cookies on the Merchant’s own domain, tolt_referral and tolt_data, which only that site can read. The script doesn’t read any other cookies. Merchants are responsible for telling their visitors about it and asking for consent where the law requires.
Your choices. You can block or delete cookies in your browser settings, though some parts of a site may not work without them, and you can turn off personalized ads in your ad settings with Google, Meta, LinkedIn, X and Reddit. Our websites don’t currently respond to Do Not Track signals.
7. International transfers
Tolt is based in the United States. We and our service providers process personal information in the United States and in the other countries where they operate, as listed on our subprocessor page. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards the law recognizes, such as the European Commission’s Standard Contractual Clauses (with the UK and Swiss addenda) or an adequacy decision, such as the EU-U.S. Data Privacy Framework for recipients certified under it.
8. How long we keep information
- Account information: while your account is open, and deleted within 30 days after it closes.
- Information we process for Merchants: as the Merchant instructs, and deleted within 30 days after the Merchant’s account closes.
- Raw events from billing providers about referred customers: kept for 7 days for debugging, then deleted automatically. The referrals and commissions created from them stay in the Merchant’s program.
- Payout, tax, identity check and screening records: as long as tax, anti-money-laundering and accounting laws require, which can be several years after the last payout. Biometric information is kept as described in section 3.
- Fraud prevention: we may keep limited information about accounts involved in fraud or abuse for longer, to stop it from happening again.
Backups are overwritten on a regular schedule. We may also keep information when we need it to resolve a dispute or enforce our agreements.
9. Security
We protect personal information with encryption in transit and at rest, access controls that limit it to the people who need it, monitoring, backups and regular independent penetration tests, and we give you two-factor authentication, single sign-on, team roles and an audit log for your account. No system is perfectly secure, so we can’t guarantee absolute security. If a breach affects your personal information, we’ll tell you and the authorities as the law requires. Please report security issues to compliance@tolt.com.
10. Your rights and choices
Everyone can update most account information in Tolt, and unsubscribe from our marketing emails at any time.
In the European Economic Area, the United Kingdom and Switzerland, you have the right to access, correct or delete your personal information, to receive a copy of it, to restrict or object to our use of it (including, at any time, for direct marketing), and to withdraw consent where we rely on it. If an automated check stopped your payout, you can ask a person at Tolt to review it. You can also complain to your local data protection authority.
In California and other U.S. states with privacy laws, depending on where you live, you have the right to know what personal information we collect, use and disclose, to access, correct and delete it, to receive a copy of it, and to opt out of its sale, its sharing for cross-context behavioral advertising and its use for targeted advertising. We won’t discriminate against you for using these rights.
In the past 12 months we’ve collected these categories of personal information, from the sources and for the purposes in sections 2 to 4, and disclosed them to the recipients in section 5: identifiers (such as your name, email address and IP address), customer records and financial information (such as billing and payout details), commercial information (such as plans and payments), internet activity, approximate location, professional information and, for affiliates paid through Tolt, sensitive personal information (tax identification numbers, financial account details and, where an identity check needs them, government identification and biometric information). We use sensitive personal information only to pay affiliates, verify their identity and meet our legal obligations, never to infer characteristics about anyone. Identifiers and internet activity from our website may be shared with our advertising partners, as described in section 6. We don’t knowingly sell or share the personal information of anyone under 16.
To use your rights, email compliance@tolt.com, including to opt out of the sale or sharing of personal information through our website’s advertising tags. We’ll verify your request, which may mean asking you to confirm who you are, and answer within the time the law sets. An authorized agent can make a request for you with proof of your permission. If we decline your request, you can appeal by replying to our answer, and if we decline your appeal, you can contact your state attorney general.
Information we process for Merchants. If your request concerns information we process for a Merchant, we’ll refer it to the Merchant and help them respond.
11. Children
Tolt is a service for businesses and isn’t directed to children. We don’t knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we’ll delete it.
12. Changes to this policy
We may update this policy. We’ll post the new version here with a new date and, for material changes, tell you by email or in the app before they take effect.
13. Contact us
Tolt, Inc. 2093 Philadelphia Pike #2726 Claymont, DE 19703, USA compliance@tolt.com
Questions about this document? Write to compliance@tolt.com.