Data policy

How Castbridge fetches, stores and uses your affiliate data.

What we collect

When you connect a partner account (e.g. Wolfpack), we ask you to provide your read-only API token from that partner. We use it to fetch the following from your affiliate dashboard:

• Visits / clicks
• Registrations
• First-time deposits (FTDs)
• Deposit count and total deposit sum
• Net gaming revenue (NGR)
• Period: the most recent 3 months at time of connect; refreshed on demand

What we do not do

• We never modify any data in your partner account. Partner APIs we use (e.g. Wolfpack) are read-only by design.
• We don't share your token with third parties.
• We don't display your raw token back to you or anyone else after you submit it.
• We don't let creators self-edit their stats inside Castbridge. The whole point is that numbers come from the source, unaltered.

How we store your token

Your API tokens are encrypted at rest using AES-256-GCM with a server-side key. We decrypt only at the moment we make a partner API call, never to display.

How long we keep data

• Stats: kept as long as your Castbridge account is active.
• Tokens: stored until you disconnect the partner. On disconnect, the token is deleted and stored stats are removed.
• Account deletion: contact us and we delete everything within 7 days.

Verification & trust

Stats fetched via official partner APIs are labelled API verified on your public Castbridge profile. This is the strongest tier of verification on the platform — the numbers came straight from the partner's backend, with no possibility of manual editing.

Your rights (GDPR)

You can request access, correction or deletion of any data we hold on you at any time. Email privacy@castbridge.dev.

Questions

Reach out at support@castbridge.dev if anything is unclear. This page is updated whenever we add new partners or change handling.