Privacy Policy
How Argus Grape handles personal data — for our own account holders and marketing contacts, and for the tracking data we process on behalf of our customers.
Effective June 17, 2026 · v2026.06.1
Who we are & our two roles
Argus Grape operates a B2B, server-side affiliate-tracking and viral-contest platform at argusgrape.com. Businesses run affiliate campaigns through us; their affiliates share tracking links; end users click those links and sometimes convert. Because of this structure we wear two different data-protection hats depending on whose data is in question.
For the personal data of our own account holders, team members, and marketing contacts (for example, the email address you sign up with or the contact details of people on your workspace), we are the controller — we decide why and how that data is processed.
For the click, conversion, and affiliate data generated by running a customer's campaigns, the customer is the controller and we act only as a processor on their documented instructions. Those processing terms are set out in our Data Processing Addendum. If you are an end user with questions about how a campaign uses your data, the merchant running that campaign is your first point of contact as the controller.
Argus Grape is operated by Levelthree saas-system LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA — the data controller for the account, team, and marketing data described above. Our privacy and data-protection contact is legal@argusgrape.com. We serve customers in the United States, the EU/UK and elsewhere; depending on where you are, US state privacy laws and/or the EU/UK GDPR may apply.
What we collect
The table below summarizes the categories of personal data involved across the platform, why we process each one, and how it is stored. A guiding principle runs through the tracking layer: we minimize what we keep and we never store a plaintext IP address.
| Data | Why | How stored |
|---|---|---|
| Account & team data — name, email, role | Create and operate your workspace, authenticate users, assign permissions, and contact you about the service. | Stored in our managed database against your workspace. Controller: us. |
| Billing data | Process subscription payments and issue invoices for paid plans. | Card data is handled by our third-party payment processor; we store only plan, invoice metadata, and a customer reference — never full card numbers. |
Click data — salted ip_hash, salted device_fingerprint, user-agent, accept-language, status, timestamp | Attribute clicks to affiliates and detect fraud. The edge tracker computes a 128-bit click id and 302-redirects to the campaign destination. | The plaintext IP is never stored. We keep only a salted SHA-256 ip_hash and a salted SHA-256 device_fingerprint, alongside the user-agent and accept-language string. No names or emails at this layer. Controller: the customer. |
| Conversion data — amount, external reference | Reconcile sales to clicks and calculate commissions. Idempotent on the external reference. | Received from signed webhooks (our payment processor and our partner conversion webhook). Conversions linked to shadow-banned clicks are auto-rejected. Controller: the customer. |
| Affiliate tree | Split commissions up a multi-level referral chain. | Referral relationships stored as hierarchical referral paths. Controller: the customer. |
| Signup anti-abuse signals — normalized email, email domain, website domain, hashed IP, device fingerprint, risk score & flags | Prevent fraudulent and duplicate signups and protect Free-plan limits. | Stored against the signup attempt. The IP is hashed; we do not retain a plaintext IP. Controller: us. |
| Newsletter — email + source | Send product and marketing updates you have opted into. | Stored with the source that captured the subscription, so you can unsubscribe at any time. Controller: us. |
The argus_cid identifier
When the edge tracker redirects a click, it appends a click identifier to the destination URL as argus_cid — a 32-character hex value derived from a cryptographic 128-bit click id. It is not a person identifier and carries no name, email, or IP. A merchant's own site may persist argus_cid client-side (for example in sessionStorage) so it can attach the identifier to a later purchase and let the conversion be reconciled.
The Argus Grape dashboard and marketing site set no third-party advertising cookies and use only strictly-necessary local storage for application state. Details are in our Cookie Policy.
Lawful bases
As a controller under the GDPR, we rely on the following lawful bases:
| Processing | Lawful basis |
|---|---|
| Creating your account, operating your workspace, and providing the service | Performance of a contract (Art. 6(1)(b)). |
| Billing and invoicing on paid plans | Performance of a contract; compliance with legal/accounting obligations (Art. 6(1)(b)/(c)). |
| Fraud prevention and anti-abuse — rate limiting, shadow-banning, signup risk scoring | Legitimate interests in protecting the platform from abuse (Art. 6(1)(f)). |
| Service-quality analytics and securing our systems | Legitimate interests (Art. 6(1)(f)). |
| Newsletter and marketing emails | Consent (Art. 6(1)(a)), withdrawable at any time. |
| Optional website analytics — our anonymous intention/funnel pixel | Consent (Art. 6(1)(a)); off by default, loaded only if you accept the cookie banner, withdrawable at any time. |
For tracking data processed on behalf of customers, the customer (as controller) is responsible for establishing the lawful basis; we process it under the contract described in the DPA.
How we use data
We use the data above to provide and operate the platform: authenticate users, attribute clicks to affiliates, reconcile conversions, calculate and split commissions, enforce plan limits, and detect and block fraud. We use account and contact data to send service-related communications (such as billing, security, and important changes) and — where you have opted in — product and marketing updates. We do not sell personal data, and we do not use it for cross-context behavioral advertising.
Sharing & sub-processors
We share personal data only with service providers that help us run the platform, each bound by a data-processing agreement and permitted to use the data solely to provide their service to us. We engage the following categories of sub-processor:
| Category of sub-processor | Location | Purpose |
|---|---|---|
| Hosting / database / cache / edge | European Union | The compute, database, cache, and edge infrastructure that run the platform. |
| DNS / CDN / edge routing | United States | DNS, CDN, and edge routing, plus inbound email routing for our @argusgrape.com addresses. |
| Email delivery | United States | Delivery of transactional emails (verification, password reset, team invites) and opt-in marketing emails. |
| AI provider (chat) | United States | Powers the in-app feedback chatbot: messages a visitor types into the chat widget are processed to generate a reply. |
| Payment processing | United States | Payment processing and subscription billing. Engaged once paid billing is active. |
The up-to-date named list of sub-processors is available on request at legal@argusgrape.com.
Feedback chatbot. The optional chat widget on our site sends the text you type into it to a third-party AI provider to generate a response. It is a support/feedback tool — please do not enter sensitive personal data into the chat. The widget loads only after you accept the cookie banner (see Cookie Policy).
We may also disclose data where required by law, to enforce our agreements, or to protect the rights, safety, and security of Argus Grape, our customers, and the public. The current list of sub-processors used to process customer (tracking) data is maintained as part of our DPA.
International transfers
Levelthree saas-system LLC is established in the United States. Our hosting runs in the European Union (Germany), but several sub-processors and the company itself are in the United States — so personal data of individuals in the EEA/UK may be transferred to the USA. For those transfers we rely on appropriate safeguards, principally the EU Standard Contractual Clauses (and the UK Addendum), together with any supplementary measures needed to ensure an equivalent level of protection.
Data retention
We keep personal data only for as long as needed for the purpose it was collected. Account and workspace data is retained for the life of your account and for a limited period afterward to meet legal, tax, and audit obligations. Click, conversion, and affiliate data is retained for as long as the customer's campaign requires it and per the customer's instructions as controller; on termination it is deleted or returned as set out in the DPA. Anti-abuse signals are kept only as long as necessary to detect and prevent abuse. Hashed values (ip_hash, device_fingerprint) are retained in place of any plaintext equivalent.
Your rights
Subject to the GDPR, you have the right to access the personal data we hold about you, to have it rectified, to have it erased, to receive it in a portable format, and to object to or restrict certain processing. Where we rely on consent — for the newsletter — you may withdraw it at any time without affecting prior processing.
To exercise any of these rights for data we hold as a controller, email us at legal@argusgrape.com. If your request concerns tracking data processed on behalf of a merchant, we will direct it to the relevant customer as controller. You also have the right to lodge a complaint with your local data-protection supervisory authority.
Your US state privacy rights (CCPA/CPRA and similar)
If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you specific rights over your personal information. Residents of states with comparable laws — for example Virginia, Colorado, Connecticut, and Texas — have similar rights. This section describes the personal information we handle as a business and how you can exercise those rights.
| CCPA category | Examples of what we process |
|---|---|
| Identifiers | Account name and email; a salted ip_hash and salted device_fingerprint at the tracking layer (never a plaintext IP). |
| Internet or other electronic network activity | User-agent and accept-language strings, and click events processed by the edge tracker. |
| Commercial information | Conversion records (amount, external reference) and your plan, subscription, and invoice metadata. |
| Geolocation | Coarse, network-level signals derived for fraud prevention; we do not collect precise location. |
Subject to the applicable state law, you have the right to: know and access the personal information we hold about you; delete it; correct inaccurate information; opt out of the sale or sharing of personal information; limit the use and disclosure of sensitive personal information; and not be discriminated against for exercising any of these rights.
Argus Grape does not sell personal information and does not share it for cross-context behavioral advertising. We also honor Global Privacy Control (GPC) signals as a valid opt-out request from your browser or device.
To exercise any of these rights, email us at legal@argusgrape.com. We will verify your request before acting on it, and you may use an authorized agent to submit a request on your behalf (we may ask the agent for proof of authorization). If your request concerns tracking data we process on behalf of a merchant, we will direct it to the relevant customer as the business responsible for that data.
Security
We protect personal data with technical and organizational measures including salted hashing of sensitive identifiers, signed and idempotent webhooks, workspace isolation, and least-privilege access. Our approach is described in our Security page, which also covers how to report a vulnerability.
Children
Argus Grape is a business tool and is not directed to children. We do not knowingly collect personal data from children under 13 (in the United States, consistent with COPPA) or under 16 (in the EU). If we learn that we have collected such data, we will delete it.
Changes
We may update this policy as the platform and the law evolve. When we make material changes we will update the effective date shown above and, where appropriate, notify you through the product or by email. Continued use of the service after an update means you have reviewed the current version.
Contact
For any privacy question or request, contact our privacy team at legal@argusgrape.com. For general legal matters, reach us at legal@argusgrape.com. Argus Grape is based in Albuquerque, New Mexico, United States.