Privacy

LastWord stores your account email, sign-in sessions and device information to manage access. Purchases keep the submitted Last Word, public attribution, destination, amount, payment references and the policies accepted for that order.

Payment providers handle payment details. LastWord keeps the payment-method references and limited card details needed to identify a saved method, such as its brand and last four digits. Financial evidence can include billing, tax and request-IP information.

We use account, purchase and campaign information to provide the services you request: signing you in, publishing your Last Word, running your campaigns and accounting for payments and rewards. The legal basis for processing necessary to provide those services is performance of our contract with you.

We use security information and content-review records to prevent fraud, protect accounts, enforce the Content rules and resolve disputes. These are our legitimate interests; they must be weighed against your privacy and other rights. Where a law requires particular accounting, tax or transaction records, the basis for keeping those records is that legal obligation.

A campaign owner's or distributor's contract does not by itself authorise tracking another visitor. LastWord does not currently offer a consent choice for visitor measurement and cross-visit attribution. Accepting checkout terms is not consent to tracking.

Account information is needed to sign in, and payment information is needed to make a purchase or receive a payout. If you do not provide information needed for a service, we cannot provide that service. When publishing a Last Word, your public name and link are optional, and you do not have to upload a logo.

Last Words, public names, logos and published campaign information can be seen by other visitors. Avoid putting private information into these fields. Hiding content on LastWord cannot remove copies already held elsewhere.

LastWord records views, saves, Echo links, clicks and verified campaign results. Where the request provides them, reports use the referring site, approximate country and city, device, browser, operating system and time. Missing information is shown as unknown.

Campaign owners and distributors can see performance reports for their activity, including attributed revenue and rewards. Those reports do not expose a visitor's payment card details or request IP.

Cookies and browser storage keep you signed in, remember drafts, help prevent abuse and connect campaign results to earlier clicks. Sign-in sessions last up to 90 days and can be renewed during use. The device cookie lasts up to one year. Attribution cookies on LastWord and websites using its campaign tag last up to 30 days; a campaign's attribution window separately controls reward eligibility.

Device and attribution cookies are set automatically. There is not yet a choice for optional tracking. You can block or clear cookies in your browser, but this may interrupt sign-in and attribution. Clearing a cookie does not delete activity already stored by LastWord.

A connected shop or checkout supplies the catalogue objects and verified sale or action events needed for its campaigns. Payment and payout services receive information needed to process money and maintain transaction records. Sign-in, email and security services receive the information needed for the enabled feature.

When enabled, Dodo handles card payments and saved payment methods, and Affonso handles affiliate payout setup and commission records. A Google or GitHub sign-in exchanges the information needed to authenticate your account. Our email service receives the address and content of messages it delivers. Cloudflare Turnstile receives the security challenge response and available request IP to check for automated abuse.

Hosting and backup services store application data. Merchants receive the referral information needed to attribute activity on their destinations. A shop, payment provider or sign-in provider may also process information for its own purposes under its own privacy notice. Visiting a linked destination takes you to that site's services and privacy practices.

Where a Base USDC payment is used, wallet addresses, amounts and transaction references are recorded on the public blockchain. LastWord cannot remove those public transaction records.

Content decisions use the submitted public text, name, campaign presentation and destination. When automated moderation is enabled, its configured provider receives the intended public text fields for classification. Account emails, payment details and account identifiers are not included in that moderation request.

Automated checks can delay or prevent publication. Inconclusive checks wait for operator review. Logos and destination safety require their own checks; text classification alone does not approve them. LastWord records review decisions and requests to reconsider them.

Financial evidence is marked for retention through the end of the tenth year after the transaction year, with longer retention where a recorded legal hold applies. This is the current financial-record schedule, not a claim that every piece of account or activity data needs to be kept for ten years. Removing a public Last Word does not erase its payment or decision records.

LastWord has no general automatic deletion schedule for account information, event-level analytics or completed email records. Expiring a session or attribution cookie does not delete the associated database records. Reaching a financial retention date does not itself trigger deletion.

Historical activity supports rankings, audience counts, campaign reporting and reward attribution. These records are not automatically deleted after a fixed number of days. The deployment configuration retains whole-database backups, with up to eleven yearly copies under its default settings.

Connected services may process information outside your country, including outside the European Economic Area. The provider arrangements, processing locations and applicable transfer safeguards have not yet been verified.

Under applicable data-protection law, you may have the right to access your personal information, correct it, request deletion or restrict its use. You may also have a right to receive certain information in a portable format and to object to processing based on legitimate interests. These rights have conditions and exceptions, including where records must be kept to meet a legal obligation or establish, exercise or defend legal claims.

Where processing relies on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal.

You can review your account information and revoke signed-in sessions in My LastWord. Revoking a session signs that device out; it does not delete your account or transaction history. Self-service account deletion and personal-data export are not currently available.

You can complain to a data-protection authority, including the authority where you normally live or work, or where you believe an infringement occurred. In Sweden, this is Integritetsskyddsmyndigheten (IMY).