Legal

Partner Privacy Policy

Version: 1.0
Effective date: 9 October 2026

This Partner Privacy Policy explains how VERIFY SIA (“MrVIN”, “we”, “us”) processes personal data of people who apply to or take part in the MrVIN Partner Programme, use the MrVIN Partner Portal, or connect a social media account such as TikTok. It supplements our general Privacy Policy, which continues to apply to customers buying reports. The programme rules are in the Partner Terms.

1. Controller and contact

Controller: VERIFY SIA, registration number 40203713379, Roberta Hirsa 1, Riga, LV-1045, Latvia.
Privacy contact: [email protected] or the form at https://www.mrvin.com/contact/. Please identify your partner account and do not send passwords, access tokens or full banking details in a general message.

2. What data we process

Data you give us

  • Account and application data: name, email address, country, preferred language, partnership type (Influencer, Referral affiliate or Both), the channels you submit and your answers in the application.
  • Business, tax and payment data: legal or business name, address, registration and VAT numbers where applicable, invoices you send us and the bank account details needed for SEPA payment.
  • Communications: messages you send us, statement or attribution questions, complaints and closure requests.
  • Public profile choices: the alias or public name and the sharing options you select for the partner leaderboard.

Data created when you take part

  • Referral and attribution data: your partner links and assigned codes, who invited you and whom you invited, link visits and the orders attributed to you. For attributed orders we use the order reference, date, amount, currency, refund status and country. We do not give you the customer’s name, email address or payment details.
  • Commission and payment records: estimates, validated and approved commission, statements, corrections and payments.
  • Acceptance records: the version of the terms and any offer you accepted, and when.
  • Technical and security data: login times, IP address, device and browser information, and security logs for the Partner Portal.

Data from TikTok and other connected channels

If you choose to connect a TikTok account, TikTok shows you a permission screen and shares only the data covered by the permissions you approve. The connection is read only. We may receive:

  • Basic profile information: your TikTok account identifiers (open ID and union ID), display name, username, avatar and profile link.
  • Account statistics: follower count, following count, likes count and video count.
  • Public video information: for the videos you have published, the video ID, title or description, cover image, link, publication date, duration and view, like, comment and share counts.
  • Access credentials: the access and refresh tokens TikTok issues so we can read this data while the connection is active. Tokens are stored encrypted and are never shown to other users.

Where an Instagram connection is offered for a Business or Creator account, we process the equivalent profile, follower and media insight data that Instagram makes available under the permissions you grant. We never receive your social media password. We do not post content, send messages, follow accounts or change anything in your social media accounts. Missing or hidden metrics are not treated as zero.

We may also review publicly visible information about the channels you submit, such as public follower counts and published content, to assess a partnership.

3. Why we use your data and our legal bases

  • To review your application and evaluate your channels, including audience size and content performance, so a person at MrVIN can decide on a partnership and offer. Legal basis: steps taken at your request before entering a contract (Article 6(1)(b) GDPR). Connecting a social account is optional; without it we rely on the information you submit.
  • To run the programme: provide the portal, issue links and codes, attribute sales, calculate and validate commission, prepare statements and pay you. Legal basis: performance of a contract (Article 6(1)(b)).
  • To meet accounting, tax and legal obligations, including keeping invoices and payment records. Legal basis: legal obligation (Article 6(1)(c)).
  • To prevent fraud and protect the programme, for example detecting self referrals, fake sales or misuse of links and codes. Legal basis: our legitimate interest in a fair and secure programme (Article 6(1)(f)).
  • To show the partner leaderboard using only the alias or name and the information you choose to share. Legal basis: your choice under the sharing controls, which you can change at any time.
  • To send you optional programme news or marketing, only where you have opted in. Legal basis: consent (Article 6(1)(a)), which you can withdraw at any time.

We do not sell your data. We do not use TikTok or other connected channel data for advertising, to build audience profiles of your followers, or to train machine learning models. Channel evaluation supports a human decision; it does not automatically approve or refuse a partnership or set a commission rate.

4. Who we share data with

  • Hosting and security: DigitalOcean (hosting) and Cloudflare (CDN and security).
  • Email delivery: Amazon Web Services (Amazon SES).
  • Banks and payment providers used to send your payouts, and our accountants and auditors.
  • TikTok and Instagram (Meta), which provide the connection. They process your data as independent controllers under their own privacy policies.
  • Other partners see only what you choose to show on the leaderboard. A partner who invited you may see your alias and the commission amounts that relate to them, but not your contact or payment details.
  • Authorities and professional advisers where required by law or needed to establish or defend legal claims.

Some providers process data outside the European Economic Area. In that case we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

5. How long we keep data

  • TikTok and other connected channel data: access and refresh tokens are deleted as soon as you disconnect the account or the connection is revoked. Profile data, statistics and video data are refreshed while the connection is active and are deleted within 30 days after you disconnect, after you ask us to delete them, or after a decision not to proceed with a partnership. We keep only a short written evaluation note, without the raw platform data, for as long as needed to document that decision.
  • Applications that do not lead to a partnership: deleted 12 months after the decision unless you ask us to delete them sooner.
  • Active partner account data: kept while you take part in the programme and for 12 months after it ends, to handle final statements, refunds, chargebacks and questions.
  • Invoices, commission statements and payment records: kept for as long as Latvian accounting and tax law requires (generally at least five years after the end of the year concerned).
  • Security logs: kept for up to 12 months unless needed longer to investigate a specific incident.

6. Disconnecting TikTok and deleting your data

You can stop our access to your TikTok data at any time:

  • Use the disconnect option for TikTok in the MrVIN Partner Portal. This revokes the connection and deletes the stored tokens straight away.
  • Or remove MrVIN from the apps connected to your TikTok account in the TikTok app settings. We stop using the connection once TikTok tells us it has been revoked or our access fails.

To delete your partner data, including connected channel data, write to [email protected] or use https://www.mrvin.com/contact/ from the email address on your partner account. We confirm the request and complete deletion within 30 days. Records we must keep by law, such as invoices and payment records, are kept for the legal period and then deleted; we tell you if this applies. Disconnecting a channel does not close your partner account, and closing your account is handled under the Partner Terms.

7. Your rights

Under the GDPR you can request access to your data, correction, erasure, restriction, portability, and object to processing based on our legitimate interests. Where processing is based on consent you can withdraw it at any time without affecting earlier processing. Contact us at [email protected]. You can also complain to the Latvian Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv) or your local supervisory authority.

8. Security and age

We protect partner data with access controls, encrypted connections and encrypted storage of platform tokens. Only staff who need the data for the programme can access it. The programme is open only to people aged 18 or over, and we do not knowingly process data of anyone younger.

9. Changes to this policy

We will publish any change on this page with a new version and effective date, and tell active partners about material changes by email before they take effect.