HelloSafe

What's your country of residence?

Privacy Policy

Last updated: September 30, 2026

This Privacy Policy is a courtesy English-Canadian adaptation of the policy of our French operating entity, HELLO SAFE (SAS). It is provided for convenience, is pending Canadian legal review, and is not a tailored Canadian legal notice. Where applicable, your personal information is also handled in accordance with Canadian privacy law (the federal PIPEDA) and, in Quebec, Law 25 (Loi 25).

HELLO SAFE (hereinafter "HelloSafe", "we") attaches particular importance to the protection of your personal data. This policy describes the processing operations we carry out on your data in the context of the HelloSafe partner program.

1. Data Controller

The data controller is HELLO SAFE, whose contact details are available in our legal notice.

2. Data Collected and Purposes

We process the following categories of data:

  • Registration data (email address, name, hashed password, company name, website, audience, country): to create and manage your partner account. Legal basis: performance of the contract.
  • Profile data (logo, tagline, persona): for the personalization of your partner space and the Coach deliverable. Legal basis: performance of the contract.
  • Affiliate tracking data (hashed IP address, user agent, referrer, approximate country): to measure clicks on your tracking links. IP addresses are never stored in plain text. Only their salted SHA-256 hash is retained. Legal basis: legitimate interest in measuring program activity.
  • Conversion data (amount, commission, external order identifier, status): to calculate your commissions. Legal basis: performance of the contract.
  • Coach analytics data (client reference, age bracket, destination, etc.): to generate the coverage analyses you provide to your clients. Legal basis: performance of the contract.

3. Sub-processors

We use the following sub-processors, all of whom are contractually committed to comply with applicable data protection laws:

  • Cloudflare, Inc. (United States): hosting, CDN, and serverless function execution.
  • Supabase, Inc. (United States; database and authentication hosted within the European Union): PostgreSQL database, account management, and authentication.
  • Resend Inc. (United States): transactional emails.
  • Google LLC: optional authentication via OAuth 2.0 (only if you choose "Sign in with Google").
  • PostHog: product analytics, error monitoring and session replay on the login and sign-up pages and in the partner space, with data hosted in the European Union. Form fields are masked in recordings.

4. Retention Periods

  • Partner account: for the duration of the relationship, plus 3 years after the last activity (commercial limitation period).
  • Connection logs and tracking data: 13 months.
  • Billing and commission data: 10 years (statutory accounting requirement).
  • Coach analytics data: 3 years from creation.

5. Your Rights

You have the following rights over your personal data: access, correction, deletion, withdrawal of consent (where applicable), and, where the law provides for it, portability. Canadian residents may also ask how their personal information is collected, used, and disclosed; Quebec residents have additional rights under Law 25, including data portability and a right to be informed about automated decision-making. You may exercise any of these rights via our contact page.

You also have the right to lodge a complaint with the relevant supervisory authority: in Canada, the Office of the Privacy Commissioner of Canada (priv.gc.ca); in Quebec, the Commission d'acces a l'information du Quebec (cai.gouv.qc.ca).

6. Cookies

We use only essential cookies necessary for the operation of the Site (authentication session, attribution of an affiliate click to a partner). These cookies do not require your prior consent.

On the login and sign-up pages and in the partner space, our product analytics tool (PostHog) records how the pages are used, including session replays, so that we can fix errors and improve the product. It stores an identifier in your browser's local storage, sets no third-party cookies, and masks form fields in recordings.

7. Security

Passwords are hashed with bcrypt by our authentication provider, transfers are made over HTTPS, IP addresses are anonymized before storage, and the principle of least privilege is applied to administrator access. Major security incidents are notified to the relevant authorities and to the affected individuals without undue delay, in accordance with applicable Canadian privacy law (including the federal PIPEDA and, in Quebec, Law 25).