3 October 2026

Privacy policy

This privacy policy describes how Maxlead collects, uses, stores, and shares information when a publisher opens an account, when that publisher uses the desk, and when a visitor arrives through a tracking link. It also covers the offers API, postbacks, reports, messages, and payout details. Please read it with the Terms. The Terms govern the use of the desk. This policy governs the information those uses create.

Maxlead is an affiliate tracking desk. The information it holds is held so the network can identify a publisher, attribute a visit to an offer, record whether a conversion was approved, show the publisher their own results, and pay approved earnings to the destination the publisher saved. Information is not collected in order to be sold, rented, or used as an advertising audience.

This policy applies to publishers, to people who apply for an account, to account managers and network staff acting on the desk, and to visitors whose clicks are recorded because a publisher placed a tracking link. It does not control an advertiser’s own landing page after the visitor leaves the tracking link. That page has its own operator and its own rules.

Who to contact

Questions about this policy, a request to correct an account field, and a request to close an account go to the support address published on the homepage. Name the account and the field or the record you mean. The network will reply using the contact on the account, or through the account manager assigned to that account. This policy does not appoint a separate postal address and does not name a regulator. The contact above is the route the desk provides.

Information you give when you open an account

At sign-up the desk asks for the details needed to create a publisher account. That includes the company or personal name, the email address, a password, and any other contact field the form requests. The password is not stored as the characters you typed. It is stored in a protected form that can be checked at the next sign-in. Keep the password private. The desk treats a sign-in with that password as a sign-in by the account holder.

The desk also records the status of the application, for example pending or active, the internal account code, the payout terms label on the account, and the account manager assigned to you. If a referral link was used, the inviting publisher is stored so the referral can be attributed. If you reached the sign-up page from a search engine, a catalog, a social network, or another website, the desk can store that source as a label or an address. The source is kept so the network can see where new accounts began. It is not used to build a profile of your activity away from the desk.

You may later add payment details. The desk stores the payment method and the destination you entered, such as the account or wallet identifier the form accepts. Those details exist so an approved balance can be paid to you. Enter only a destination you are authorised to use. Payment details are visible to the staff who prepare payouts. They are not displayed on the public homepage, in campaign cards, or in another publisher’s report.

Information created while you use the desk

After sign-in, the desk records actions that belong to the account: offers you view or request, approval decisions, tracking links issued to you, postback URLs you save, report filters you run, and changes you make to payment details. This record lets the network show you the right offers, explain a later payout, and restore a setting you saved. It is tied to your account code, not to a device advertisement identifier.

If the network issues an offers API key, that key is stored against the account. Requests made with the key can be counted so the desk can apply a rate limit and can tell a working catalog from a failing one. The key can return offers that are approved for the account and offers that are still pending, so an external catalog can stay current. A pending offer in an API response is not permission to run the offer. Treat the key as a secret. Do not place it in a public page, a screenshot, or a message thread.

Information collected from tracking links

When a visitor opens your tracking link, the desk can store the offer, the time of the visit, the publisher account the link belongs to, the country indicated by the connection, the type of device or browser, the referring page if the browser sends one, and the sub IDs you added to the link. The desk supports several sub IDs so you can separate one placement from another. Those values are stored with the click, shown on your report, and can be passed to your postback when a conversion is approved.

Sub IDs are labels you choose. They should be placement codes, creative codes, or similar internal references. Do not put a person’s name, telephone number, payment number, or password into a sub ID. If you do, you have chosen to place that information inside the tracking record, the report, and any postback that repeats the token. The network does not require that kind of data in order to count a click.

A later visit that matches an earlier one can be stored as a duplicate. Duplicates are kept so your summary can show total clicks and duplicate clicks separately. A duplicate is not a second conversion. If a visit comes from a country the offer does not accept, the desk does not have to save it as a click on that offer. The visitor may be redirected to another offer on the network that accepts a broader set of countries. The refused country is then not added to the original offer’s click log.

The visitor does not need a Maxlead account for the click to be recorded. The record is an attribution record for the publisher who placed the link. If the browser does not send a referrer, that field is left empty. The desk does not ask the visitor to create a profile, and it does not set an advertising cookie on the visitor in order to follow them across other websites.

Conversions, caps, and reports

When a result is reported against a click, the desk stores the click it belongs to, the offer, the publisher, the status of the result, and the amount if the result is approved. Status can change. A result may be approved automatically or only after review, according to the offer. A result may be refused because it missed an offer rule, arrived after a cap, came from a country or source the offer does not take, or was a duplicate.

The publisher report shows the publisher’s own clicks, duplicate clicks, approved conversions, and approved earnings, including the sub IDs on those rows. Results that are still waiting, and results that did not qualify, are not shown on the publisher report and are not treated as a balance. Network staff can see a wider record because they have to apply caps, review quality, and prepare payouts. One publisher cannot open another publisher’s rows through the public site.

Postbacks

A global postback and an offer postback are URLs you choose. The desk stores the URL you save. When a conversion is approved, the desk can request that URL and replace the documented tokens, including the click identifier and the sub IDs from the visit. The request is sent from the desk to the server you named. From the moment it arrives, that server’s operator also holds the data, under that operator’s own practices. You are responsible for the URL you save and for the people who can read it. A failed or delayed request does not erase the conversion on the desk. The desk can keep a note of whether the call succeeded or failed.

Messages, files, and presence

Messages sent from the publisher desk are stored so the assigned account manager, and the network staff permitted to reply, can read them and respond. A reply is stored on the same thread. The thread can show who answered. If you send a photo, a video, or a voice note, that file is stored as part of the message. Send only material you are willing to keep on the account. Do not use the thread to transmit payment secrets when a payment field already exists for them.

A publisher may delete a message where the desk allows it. The thread can show that the message was removed. Network staff can remove a message from view without that removal being presented to the publisher in the same way. Either way, a copy can remain in operational storage for as long as the account record needs it, including to investigate abuse of the thread.

The desk can show whether an account manager appears online and can show a last-seen time, unless the network has hidden last-seen for the admin side. That signal is a working status for the conversation. It is not a precise location, and it is not a record of other apps on a phone.

Cookies and sessions

The desk uses a session cookie so a publisher who has signed in can remain signed in while moving between pages. A separate session cookie is used after an administrator passes the desk check, so the admin side is not left open to every visitor. These cookies identify the session. They are not used to advertise to you on other sites, and they are not sold to an advertising network. A browser that blocks cookies may be unable to stay signed in. The public homepage, the Terms, and this policy can be read without an account cookie.

The desk does not use this policy to describe a cookie on an advertiser’s landing page. After the tracking redirect, the advertiser’s site may set its own cookies. Those cookies are outside Maxlead.

How the information is used

Account information is used to create the account, to authenticate later visits, to assign an account manager, to decide whether an offer request is approved, and to pay approved earnings to the details you saved. Click and conversion information is used to attribute a result to the correct publisher and sub ID, to apply the country rules and caps written on the offer, to calculate the figures on your report, and to fire the postback you saved. Signup-source information is used to understand which page introduced a new publisher. Message information is used to conduct the conversation you started and to keep a record of what was agreed.

The same records may be used to detect clicks that are not genuine, to pause an offer or an account while a placement is checked, to separate duplicate visits from new ones, and to answer a question you or an advertiser raise about a specific click. That use stays inside the operation of the desk. It is not permission to read the records for an unrelated business.

Who receives information

Network staff who operate offers, publisher accounts, click logs, and payouts can open the records their work requires. An account manager can see the publisher they are assigned and the messages on that thread. Other publishers cannot. Advertisers, or the party responsible for an offer, receive the conversion information they need to approve or refuse a result. That notice can include the click identifier and the fact of the visit. It does not include your payment details.

A payment partner receives the destination and the amount when a payout is sent, because that is how the funds move. Your postback endpoint receives the tokens on an approved conversion because you instructed the desk to send them. A hosting or infrastructure provider that keeps the desk online may process the records as part of running the service. They are not authorised by this policy to use publisher lists for their own marketing.

Maxlead does not sell publisher lists and does not sell click logs. The desk does not share your payment details with other publishers or place them on the homepage.

How long information is kept

Account details are kept while the account is open. After closure they can be kept for as long as needed to finish a payout, to explain an approved conversion, to answer a dispute about a placement, or to record why an account was paused. Click and conversion rows are kept so a report for an earlier date can still be explained and so a duplicate or a country rule can still be checked. Postback URLs are kept until you replace them or the account is closed. Messages and files sent in a thread are kept with the account so a later reply has the earlier context.

A click that has already been recorded is a record of that visit. It is not rewritten to hide a placement. If an account field is wrong, you may correct the company name, the contact, or the payment details from the desk or by writing to the support address published on the homepage. Closing an account removes the sign-in. It does not require the network to pretend that a paid conversion never occurred. Rows still needed to explain a payout, or to prevent a repeated abuse of a link, can remain after the password stops working.

Security

The desk limits account data to the publisher who owns it and to the staff who operate the network. Passwords are stored in a protected form. Session cookies are set so that ordinary page scripts on another site cannot read them. API keys are secrets and should be rotated from the desk when the desk allows a new key to be generated. Payment details are shown to the people who need them to pay you, not to the public catalog.

These measures reduce risk. They do not make misuse impossible. A shared password, a lost device that is still signed in, or an API key pasted into a public page can expose the account. If you believe someone else is using the account, change the password and tell the account manager. Stop using a key that has been exposed and generate a replacement.

Your requests

You may ask what the account holds, and you may ask for a correction of the name, the contact, or the payment details. Payment details can also be edited on the desk after they have been saved. You may ask for the account to be closed. Write to the support address published on the homepage and identify the account. The network will respond on the account record or by the contact you provided. A request that would require the deletion of an approved payout record, or of a click needed to explain that payout, can be refused for that part of the record. The rest of the request will still be considered.

Publishers are expected to be able to enter a contract and to run offers. The desk is not directed at children, and an account should not be opened in a child’s name. Do not attach a child’s identity to a sub ID, a payment field, or a message. Offers carried on the network may themselves require an adult audience. That requirement is set on the offer.

Changes to this policy

The network may replace this policy by posting a new version on this page. The date at the top of the page is the date of the version you are reading. If you continue to use the desk after that date, you do so under the updated policy. A change to a single offer, including the countries it accepts or the fields a conversion needs, can take effect on that offer even when this policy is not republished. Check the offer before a new placement.

This policy describes the tracking desk. It does not describe every site a visitor reaches after the click, and it does not set the payout calendar. Payout timing and country rules remain on the offer. For a question about a specific record, use the support address published on the homepage.