Privacy information

Draft for publication review. The operating entity, privacy contact, subprocessors, retention schedule, and applicable jurisdiction notices must be confirmed before public launch.

What Frawl does

Frawl helps merchants operate affiliate and referral programs. Merchant workspace data and affiliate portal access have separate scopes. An affiliate can access its own enrollments, links, and earnings; merchant members need the appropriate workspace permissions.

Data used by the service

Frawl processes account and workspace identifiers, membership and security records, program settings, referral links, pseudonymous click signals, customer references, verified payment events, commissions, payout destinations, and approval/audit history. Connected payment-provider credentials and stored payout details are encrypted. Subscription card information is handled by Moyasar; Frawl stores an encrypted token, payment identifiers, and masked card details rather than card numbers or verification codes.

Referral tracking and consent

The embedded browser SDK waits for consent and respects Global Privacy Control. With consent, it uses a host-only first-party cookie for the configured referral window. If storage is blocked, it keeps attribution in memory for the current document. It does not use a device-fingerprint or hidden-storage fallback. Approved cross-domain transfers use a short-lived signed reference.

Server redirect links record a minimal navigation event without browser storage. Merchants that require consent before this event can use direct destination links with the consent-gated SDK instead. Merchants are responsible for presenting appropriate notices and configuring consent in their own properties.

Payments and integrations

Merchants choose which billing providers to connect. Provider events are used to verify sales, renewals, refunds, and supported disputes. Frawl subscription billing is separate from these merchant customer payments. Affiliate payouts are approved and exported for the merchant to pay; an exported batch does not itself move money.

Access, retention, and requests

Use workspace permissions, API-key scopes, and affiliate enrollment controls to limit access. Financial adjustments and sensitive operations are recorded in audit history. Retention and deletion requests must account for financial recordkeeping and security obligations; this draft does not promise an unimplemented deletion or backup schedule.

For privacy requests, use the contact page and identify the relevant workspace. Operator contact details and a verified request-handling policy will be published with the final notice.