Partner Privacy Notice — Storage Studio

This notice covers personal data about partners and the people who work for them. For customers, see our Privacy Policy.

Who is responsible. Techtonic Systems Media and Research LLC (Wyoming, United States) runs the Partner Program and is the controller (and the Data Fiduciary under India's DPDP Act, 2023). DNS Stack Private Limited (India) runs the Program's systems and partner support for us, as our processor. Contact: <privacy@storagestudio.us>. Grievance Officer (India): Rajneesh Maurya, DNS Stack Private Limited, 2nd Floor, Kalkat Bhawan, Punjab Innovation Mission, GMADA Aerocity, SAS Nagar, Mohali 140306, Punjab, India — <privacy@storagestudio.us> with "Grievance" in the subject.

What changed in this version

Version 2.0.1 (29 October 2026):

Names both companies, the privacy contact and the Grievance Officer for India.
Lists what we actually collect, including the knowledge base, co-branding, messages and the browser details recorded with your application and sign-ins.
Corrects who we share data with, and how long we keep it.

What we collect

When you apply: your legal and trading name, entity type, contact name and title, email, phone, postal address, country, website and LinkedIn, tax residency and tax identifiers (for example a tax ID, VAT number, GSTIN or PAN), any tax form you upload, a description of your business and its size, why you want to partner, and the IP address and browser you applied from. A one-time code confirms your email address.

While you take part: your partner type and Terms of Partnership; your tax profile (tax country and region, tax identifier, rates and any withholding); your payout method and currency and payout records; your referral codes and links; the customers attributed to you, commissions, codes, orders and invoices; the Stripe customer record used when you pay us; portal sign-ins (one-time codes and sessions, with the IP address and browser used); and, if you use them, your branding, partner messages, contact details and knowledge-base entries, and the messages customers send you through the app.

About your links: each visit through your referral or partner links, with a keyed one-way hash of the visitor's IP address (never the address itself), the browser, the referring page and the landing page; and downloads and installs linked to you.

We don't collect bank passwords or card details (card payments are handled by Stripe), or sensitive personal data such as health, religion or political opinions.

Contract — reviewing your application, running the Program, paying you, partner support.
Legal obligation — tax, accounting and sanctions checks.
Legitimate interests — preventing fraud, security, measuring the Program.
Consent — marketing emails about the Program, which you can withdraw at any time.

DNS Stack Private Limited — our processor (above).
Stripe — when you pay us for codes, renewals or invoices.
The bank or payment service we use to pay you — only what it needs for the payment.
Brevo — sends our emails to you.
Cloudflare — hosts the Partner portal and our systems.
Google — hosts our mailboxes.
Your customers — see your business name and, if you publish them, your branding, messages, contact details and knowledge-base answers.
Tax authorities, regulators and law enforcement, where the law requires.
Professional advisers (accountants, lawyers) bound by confidentiality.

We do not sell partner data or share it with advertising networks.

How long we keep it

Applications we decline, or you withdraw: 12 months. A short entry recording that the application was made and declined or withdrawn — with your email address, organisation name and country — is part of the permanent audit log below.
Unfinished application drafts: deleted when they expire.
Partner records, tax forms, payouts, transactions and invoices: while you are a partner, and afterwards for as long as tax and accounting law requires — 8 years after the partnership ends. After that we remove what identifies you; the amounts, dates and tax totals stay as an anonymous accounting record.
Link visit records: 24 months.
Sign-in codes and portal sessions: codes expire within minutes; expired code and session records are deleted within 30 days.
Audit log of actions taken on your account: kept as a permanent security record.

International transfers

Your data is processed in the United States, in India (by DNS Stack) and by our providers worldwide. Transfers from the EU/EEA and the UK rely on Standard Contractual Clauses or the UK equivalents.

Your rights

Access, correction, deletion (where the law allows), restriction, objection, portability, withdrawing consent, nomination (India) and complaint to a data-protection authority — as described in §8 and §11 of our Privacy Policy. Email <privacy@storagestudio.us> from your registered contact address. We reply within 30 days, or tell you why we need longer where the law allows.

Security

TLS in transit and encryption at rest by our providers; sign-in by one-time code or link — we store no partner passwords; sessions expire after 7 days and can be ended at any time.