Privacy

LastWord stores your account email, sign-in sessions and device information to manage access. Purchases keep the submitted Last Word, public attribution, destination, amount, payment references and the policies accepted for that order.

PayPal handles payment details for browser purchases. Last Word keeps provider references and financial evidence, which can include billing, tax and request-IP information. Last Word does not store card numbers or security codes.

For EU users, PayPal (Europe) S.a.r.l. et Cie, S.C.A. is the controller for PayPal's processing under its own privacy statement.

We use account, purchase and campaign information to provide the services you request: signing you in, publishing your Last Word, running your campaigns and accounting for payments and rewards. The legal basis for processing necessary to provide those services is performance of our contract with you.

We use security information and content-review records to prevent fraud, protect accounts, enforce the Content rules and resolve disputes. These are our legitimate interests; they must be weighed against your privacy and other rights. Where a law requires particular accounting, tax or transaction records, the basis for keeping those records is that legal obligation.

A campaign owner's or distributor's contract does not by itself authorise tracking another visitor. Last Word asks before detailed visitor analytics and cross-visit attribution. Accepting checkout terms is not consent to tracking.

Account information is needed to sign in, and payment information is needed to make a purchase or receive a payout. If you do not provide information needed for a service, we cannot provide that service. When publishing a Last Word, your public name and link are optional, and you do not have to upload a logo.

Last Words, public names, logos and published campaign information can be seen by other visitors. Avoid putting private information into these fields. Hiding content on LastWord cannot remove copies already held elsewhere.

LastWord records views, saves, Echo links, clicks and verified campaign results. Where the request provides them, reports use the referring site, approximate country and city, device, browser, operating system and time. Missing information is shown as unknown.

Campaign owners and distributors can see performance reports for their activity, including attributed revenue and rewards. Those reports do not expose a visitor's payment card details or request IP.

Cookies and browser storage keep you signed in, remember drafts, help prevent abuse and connect campaign results to earlier clicks. Sign-in sessions last up to 90 days and can be renewed during use. The device cookie lasts up to one year. Attribution cookies on LastWord and websites using its campaign tag last up to 30 days; a campaign's attribution window separately controls reward eligibility.

You can choose Essential only or allow optional tracking when you first visit, and change that choice later in My LastWord Settings. Essential storage keeps sign-in, security and the action you are taking working. Optional tracking measures visits and remembers attribution across visits. Choosing Essential only does not prevent sharing or payment. Clearing a cookie does not delete activity already stored by Last Word.

A connected shop or checkout supplies the catalogue objects and verified sale or action events needed for its campaigns. Payment and payout services receive information needed to process money and maintain transaction records. Sign-in, email and security services receive the information needed for the enabled feature.

Affonso receives your name, email and Last Word account reference to maintain affiliate membership and open payout setup. To account for campaign rewards, it receives sale amounts and currency, event and product/price references, subscription status, event times and reward information.

A Google or GitHub sign-in exchanges the information needed to authenticate your account. Our email service receives the address and content of messages it delivers. Cloudflare Turnstile receives the security challenge response and available request IP to check for automated abuse.

Hosting and backup services store application data. Merchants receive the referral information needed to attribute activity on their destinations. A shop, payment provider or sign-in provider may also process information for its own purposes under its own privacy notice. Visiting a linked destination takes you to that site's services and privacy practices.

Where a Base USDC payment is used, wallet addresses, amounts and transaction references are public on the Base network. LastWord cannot remove those public transaction records.

Content decisions use the submitted public text, name, campaign presentation, logo and destination. When automated moderation is enabled, OpenAI receives these intended public fields and the uploaded logo to apply our Content rules. Google Web Risk receives destination URLs to check for known malware, phishing and unwanted software. Account emails, payment details and account identifiers are not included in these requests.

Automated checks can delay or prevent publication. Inconclusive checks wait for operator review. Logos and destination safety require their own checks; text classification alone does not approve them. LastWord records review decisions and requests to reconsider them.

Financial evidence is marked for retention through the end of the tenth year after the transaction year, with longer retention where a recorded legal hold applies. This is the current financial-record schedule, not a claim that every piece of account or activity data needs to be kept for ten years. Removing a public Last Word does not erase its payment or decision records.

LastWord has no general automatic deletion schedule for account information, event-level analytics or completed email records. Expiring a session or attribution cookie does not delete the associated database records. Reaching a financial retention date does not itself trigger deletion.

Historical activity supports rankings, audience counts, campaign reporting and reward attribution. These records are not automatically deleted after a fixed number of days. The deployment configuration retains whole-database backups, with up to eleven yearly copies under its default settings.

PayPal retains relationship data for the relationship plus ten years, subject to local law and longer permitted holds. Affonso publishes purpose-based retention without a fixed deletion period. Those provider schedules are separate from Last Word's.

PayPal processes data in the US and other countries. For transfers outside the European Economic Area, it describes binding corporate rules within its group and adequacy decisions, contractual safeguards or permitted exceptions for other transfers.

Affonso states that its server infrastructure is in Frankfurt, Germany. Its current processing-agreement and subprocessor details have not been verified. Other connected services may also process data outside the European Economic Area; their applicable arrangements still require confirmation.

Under applicable data-protection law, you may have the right to access your personal information, correct it, request deletion or restrict its use. You may also have a right to receive certain information in a portable format and to object to processing based on legitimate interests. These rights have conditions and exceptions, including where records must be kept to meet a legal obligation or establish, exercise or defend legal claims.

Where processing relies on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal.

You can review your account information, revoke signed-in sessions and send support or privacy requests in My LastWord. Requests to access, export, correct, delete, restrict or object to use are reviewed securely in your signed-in account. A request does not automatically remove transaction, dispute or other records that Last Word must retain.

You can complain to a data-protection authority, including the authority where you normally live or work, or where you believe an infringement occurred. In Sweden, this is Integritetsskyddsmyndigheten (IMY).

PayPal privacy statement

Affonso privacy policy

Use the secure form in My LastWord to contact support or make a privacy request. Signing in verifies which account the request concerns and lets you see its progress and response.

If you cannot sign in or do not have an account, use the public request form. We verify the email before an operator can review the request.