Affiliate privacy

What the API returns about affiliates, and what it never returns

​

On the network: channels, not affiliates

On the network, an affiliate works with many brands. The Brand API does not tell a brand who the affiliate is. It returns the affiliate channel: the place where the affiliate promotes the brand, such as a blog, a cashback site or a coupon site.

A channel in the API has only these fields:

Field	Example	Notes
id	3f6f1a52-8a55-4d0c-9a56-0c1f4f0b7e21	Stable. Use it to group orders by channel.
type	Blog	Channel type.
name	null	Returned only when your program shows channel names. Otherwise null.
categories	["Moda"]	Channel categories.
status	approved	Status of the channel in your program.

Network routes never return, in any field:

• The affiliate’s name, e-mail, document, phone, address or bank data
• The affiliate’s user id
• The channel’s description, links or contact data
• utm_campaign, because it contains the affiliate id
• Which channels belong to the same affiliate

Two channels of the same affiliate appear as two unrelated channels.

​

On the white label: your own affiliates

In a white-label program, affiliates sign up with your brand. With scope whitelabel:affiliates:read, the API returns:

Data	Fields	Returned
Identification	id, name, email, status, joinedAt, updatedAt	Yes
Document	document, documentType, legalName, tradeName	Yes
Contact	phone, birthDate, address	Yes
Program data	utm, clusters, additionalFields	Yes
Bank and payment data	—	No
PIS, password and login data	—	No

utm is the value that identifies the affiliate in utm_campaign. It is the affiliate id and your organization id joined by _:

{affiliateId}_{organizationId}

On a tracked link, utm_campaign is this value followed by _ and the link code, and utm_source is lomadee. To find the affiliate of a visit or an order in your own analytics, match the start of utm_campaign against utm.

additionalFields has one item for each additional field your program asks for at sign-up, identified by the key you set in the dashboard:

"additionalFields": [
  { "key": "store_code", "name": "Store code", "type": "text", "value": "SP-014" }
]

Without whitelabel:affiliates:read, white-label orders still show affiliate: { id, name }, and nothing else about the affiliate.

The affiliate routes return personal data protected by the LGPD. Create a separate key with whitelabel:affiliates:read only for the integration that needs it, and set an expiration.

​

Shoppers

The API does not return data of the person who bought: no name, e-mail, document, phone, shipping address, IP address or device. Use orderId to find the order in your own store.

​

Your responsibilities

Data you read from the API is covered by the LGPD and by your contract with Lomadee. Store only what you need, restrict who can access it, and do not try to identify network affiliates from channel data.