Member data and privacy
What Cashback Tracker stores about your members, and how to remove it.
This page describes what the plugin holds and how to deal with it by hand. It is not legal advice, and what your jurisdiction requires of you is yours to establish.
What is stored
Members are ordinary WordPress users. Their name, email and password are WordPress's, not the plugin's.
What the plugin adds, keyed to that user:
Cashback entries — every credit, bonus, payout and adjustment
The ledger
Orders — what they bought, from which shop, for how much, and when
Orders
Payout requests — amount, method, and the payment details they typed
Payouts
Referrals — who invited whom
The ledger
Reviews — ratings and review text
WordPress comments
The part that deserves attention
Payout details. When a member requests a payout, they type where to send the money — a PayPal address, a bank account, an IBAN. That is stored with the request so you can act on it.
It is the most sensitive thing the plugin holds, and it is worth being deliberate about:
Only administrators can see it. Do not hand out admin accounts casually.
It stays on old requests, because a paid request is a record of what you paid and where.
It is in your database, so it is in every database backup you take. Store those the way you would store anything containing bank details.
What is not stored
No clicks. Nothing is recorded when a member presses Go to shop — no browsing history, no click log, nothing about which shops someone looked at. The plugin first learns of a member's activity when a network reports a purchase.
No card or payment credentials. The plugin never takes a payment, so there is nothing of that kind to hold. See What the plugin never does.
No tracking of visitors who are not signed in.
What the member can see themselves
Their account page shows their balances, their full cashback history, their payout requests and their referrals — everything the plugin holds about them, in the same detail you see.
For most requests to see their data, pointing them at their own account page is a complete answer.
Removing a member
The plugin does not connect to WordPress's privacy export and erasure tools. Deleting a user through Tools → Erase Personal Data removes what WordPress holds and leaves the plugin's records behind, still keyed to a user ID that no longer exists.
Removal is a manual job. Read this section before you start.
Before deleting anything, decide what has to survive.
Records you may be required to keep. A payout is a record of money you sent. Depending on where you operate, your accounting obligations may outlive the member's account. Check before deleting payout history — it is easier than reconstructing it.
The safer route is usually anonymising rather than deleting: clear the payment details, keep the amount and the date. You keep a usable financial record and hold nothing personal.
To remove a member completely:
Settle up first. If they have an available balance and are owed it, pay them and mark it paid. Deleting an unpaid member is deleting a debt, not resolving it.
Clear the payout details on their requests — that is the sensitive part.
Delete or reassign their reviews in
Comments, like any WordPress comment.Delete the WordPress user.
Remove their ledger and order rows, if you have decided nothing needs to be kept.
Steps 2 and 5 have no button. Ask support rather than editing the database yourself if you are not comfortable doing it.
Your privacy policy
Whatever your policy says, it should probably cover:
that purchases made through your links are reported back to you by the affiliate network, including what was bought and for how much
that payment details given for a payout are stored until the payout is complete
how long you keep records of paid cashback
that affiliate networks are separate companies with their own policies
Related
Last updated