Skip to content

Legal

Partner Portal Privacy Policy

Last updated: 14 October 2026

1. Scope

This policy covers the BlueBirdAds Partner Portal at partners.bluebirdads.com and its Google Ads and Meta integrations, operated by BlueBirdAds ("we", "us"). It applies to the affiliate partners who use the Portal and to people who apply for a partner account. Our general Privacy Policy covers this website and our other services. Contact: hi@bluebirdads.com.

2. Data we collect from partners

  • Account data — name, email address, login name and the settings you choose (time zone, click ID field).
  • Conversion data — for each sale attributed to you: the offer, time, status and your commission, and the sub-IDs and click IDs you add to your links.
  • Postback settings and send logs — the postback URLs you configure and the result of each send.
  • Meta dataset settings — the dataset IDs and Conversions API keys you add; keys are stored encrypted.
  • Payment details — the payout method you set up, stored encrypted.
  • Technical data — sign-in records and security logs.

Partner applications

When you apply for a partner account on the Portal's application page, we collect:

  • your name or company name, email address, and Telegram or WeChat contact;
  • your traffic sources, and who referred you if you tell us;
  • the language you applied in;
  • the version of the Partner Terms you agreed to, and when.

Security check. The application page uses Cloudflare Turnstile to make sure it is filled in by a person. Cloudflare processes technical data such as your IP address and browser for this check, as described in its own privacy policy. To limit repeated submissions we count applications per IP address in a short-lived counter that keeps only a hashed form of the address and is deleted after about a day; we do not store your IP address with your application.

Who sees it. Only BlueBirdAds administrators can see an application. We use it only to decide on the application and to contact you about it; it is not shown to merchants or other partners.

How long we keep it. If we open an account for you, your name, email address and language become your account data, and the application stays with your account. If we decline it, the application is deleted 90 days after our decision. You can ask us to delete an application at any time.

3. Google user data (Google Ads integration)

If you connect Google Ads, you sign in with Google and grant BlueBirdAds three scopes: https://www.googleapis.com/auth/datamanager (Google's Data Manager API, to send conversions to Google Ads), openid and email.

What Google user data we access

  • The email address and account ID of the Google login you connect.
  • The authorization Google issues for the Data Manager API (a refresh token and short-lived access tokens).
  • Google's processing result for each conversion we upload: whether Google accepted it and, if not, the reason.

We do not read anything else from your Google account: no campaigns, ads, keywords, audiences, reports or billing. We do not create aggregated or anonymized data sets from Google user data.

How we use it

  • When a sale you referred is confirmed, we send one conversion event to the Google Ads account and conversion action you chose: the Google click ID that came with the ad click, the time of the sale, your commission and its currency, and a transaction ID. These values come from our own records, not from your Google account.
  • We read Google's processing result for each upload. If Google reports a problem, we show the reason in your send log and, where Google allows, send the conversion again later.
  • We show the connected email address so you know which Google login is in use, and use the account ID to recognise the same Google login across partner accounts.

We use Google user data only to provide this feature to you. We do not use it for advertising, to build profiles, for credit or lending decisions, or to train artificial-intelligence or machine-learning models.

Sharing and transfer

We do not sell, rent or share Google user data. Conversion events are sent only to Google, to the Google Ads account you chose. Our hosting provider (Cloudflare) stores the encrypted data on our behalf under its data processing terms and does not use it for its own purposes. We transfer Google user data to no one else, except where required by law.

How we protect it

The authorization Google gives us (a refresh token) is encrypted at rest (AES-GCM) and is never shown in the Portal or written to logs. Short-lived access tokens are held in memory only. Data is transmitted over HTTPS. Only systems that send your conversions use these credentials; our staff do not access them.

Retention and deletion

We keep the authorization, email address and account ID until you disconnect Google Ads in the Portal, which you can do at any time. Disconnecting deletes them from our systems and revokes the authorization at Google; if the same Google login is still connected to another BlueBirdAds partner account, we leave the authorization at Google so that account keeps working. You can also remove BlueBirdAds' access at any time from your Google Account at myaccount.google.com/permissions, or email us to have your Google user data deleted. Google's processing results are deleted after 30 days; the record that a conversion was sent (time and status) stays with your conversion history.

Limited Use

BlueBirdAds' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Meta (Conversions API)

If you add a Meta dataset in the Portal, you give BlueBirdAds the dataset's ID and a Conversions API key that you generate for it in Meta's Events Manager. We use them only to send the sales you refer to that dataset.

What we send to Meta

When a sale you referred through a Meta ad is confirmed, we send one Purchase event to the dataset you chose. It carries:

  • the Meta click ID that came with the ad click (as fbc) and the time of the click;
  • the IP address and browser (user agent) of the visitor who clicked the ad;
  • the city, state, ZIP code and country of the click, each hashed with SHA-256 before it is sent;
  • the time of the sale, your commission and its currency, and our conversion ID;
  • the address of the merchant's website.

The click details come from the affiliate network's record of the click and are read at the moment we send. We do not store the visitor's IP address, browser, place or Meta click ID. We send nothing for a click without a Meta click ID, for a sale more than 7 days old, or for later changes to a sale.

Your key

Your Conversions API key is encrypted at rest (AES-GCM), never shown in the Portal or written to logs, and sent to Meta only inside the request body, over HTTPS. You can replace or delete it at any time on the Postbacks page; deleting it removes it from our systems and pauses sending to that dataset. Meta processes the events it receives under its own terms for business tools; we send this data nowhere else.

5. How we use partner data

  • To run the affiliate program: attribute sales, calculate commissions, show reports.
  • To send conversions to the trackers, Google Ads accounts and Meta datasets you configure.
  • To pay commissions and keep accounting records.
  • To secure the Portal and prevent fraud and abuse.
  • To meet legal obligations.

6. Sharing

The sub-IDs and click IDs you add to your links travel to the merchant's pages with each click, as in any affiliate program. We send your conversions to the trackers, Google Ads accounts and Meta datasets you configure. We use service providers for hosting, email and bot protection (for example Cloudflare), bound by their data processing terms. We do not sell personal data.

7. Retention

Conversion, commission and payout records are kept for as long as we work together and for the period required by accounting and tax rules. Send logs are shortened after 180 days. Declined partner applications are deleted 90 days after the decision. You can ask us to close your account and delete what we are not required to keep.

8. Security

Credentials and payment details are encrypted at rest, all traffic uses HTTPS, and access to the Portal's systems is restricted to the people who run it.

9. Your rights

You can see and update most of your data in the Portal. To access, correct or delete your data, or to ask anything about this policy, email hi@bluebirdads.com.

10. Changes

We may update this policy. Material changes are reflected in the date above.