Version: 1.0 · Last updated: 2026-08-13
This is an information notice, not a contract. The Program terms are separate. Nothing here is agreed to; it is told to you. The application form records only an acknowledgment that you have read this, never a consent.
1. Who is responsible for your data
KUME INC, a Wyoming corporation, 34 N Franklin Ave, Ste 687 2357, Pinedale, WY 82941, United States, trading as Estako Yarns, is the controller of the personal data described here.
Contact for any privacy question or request: info@estakoyarns.com. A person reads that address; it is not a ticketing queue.
If you are in the EEA or the UK: we have not yet appointed a representative under Article 27 of the GDPR or of the UK GDPR. We are arranging both. We are telling you this rather than staying silent about it, because until they exist the way to reach us is the address above, and you should not have to guess that. When they are appointed we will name them here and raise the version number of this notice.
2. What this notice covers
This notice covers the Estako Creator Program: applying to it, running a referral link, earning commission, and being paid. It does not cover shopping on estakoyarns.com as a customer, which is covered by our general store privacy policy.
3. What we collect, why, and on what basis
3.1 When you apply
| What | Why | Lawful basis |
|---|---|---|
| Your name and email address | to identify you and reply to you | steps at your request before entering a contract |
| Your country | to work out which tax and payout rules apply to you | steps before a contract; legal obligation for tax classification |
| Links to your public channels, and what you tell us about your audience | to decide whether the Program fits you | our legitimate interest in assessing applications |
| The version of the terms you accepted, and when | to be able to show what you agreed to | performance of a contract; establishing legal claims |
| The version of this notice you were shown, and when | to be able to show what you were told | our legitimate interest in accountability |
| A one-way hash of your IP address and a coarse browser category | to stop automated and duplicate applications | our legitimate interest in preventing abuse |
We never see or store your raw IP address for applications; it is hashed with a rotating daily salt before it is written.
3.2 While you take part
| What | Why | Lawful basis |
|---|---|---|
| Your referral link and its slug | to attribute orders to you | performance of a contract |
| Click records: a hashed IP, a coarse browser category, the landing page, the time | to count clicks and filter out bots | performance of a contract; legitimate interest in preventing fraud |
| Attribution records linking an order to your link | to calculate what you are owed | performance of a contract |
| Commission rows: order reference, amount, rate, status, and any refund adjustment | to calculate and evidence what you are owed | performance of a contract; legal obligation for accounting |
| Your tier, commission rates and store credit multiplier | to apply the right terms to you | performance of a contract |
| A private dashboard token | to let you open your dashboard without a password | performance of a contract |
| A record of each email we send you, its type and the time | to show what we told you and when | legitimate interest in accountability |
3.3 When we pay you
| What | Why | Lawful basis |
|---|---|---|
| Payout rows: amount, currency, method, status, our transaction reference, dates | to make the payment and evidence it | performance of a contract; legal obligation |
| For store credit: the link to your Shopify customer account | to place the credit on your account | performance of a contract |
| Your tax form status (W-9 or W-8BEN) and any expiry date | to determine our withholding and reporting position | legal obligation under US tax law |
| The signed tax form itself: your legal name, tax identification number, address and entity type | the same | legal obligation under US tax law |
How the tax form is stored. It is encrypted, under a key used for nothing else. Only four things about it can be read without decrypting: the form type, the country, the signature date, and the last four digits of your identification number. Those four exist so that ordinary work never requires opening it. There is one code path that decrypts; it requires a named person and a written reason, and it records that access before it decrypts, so an attempt that fails still leaves a trace. In practice it is opened once a year, one record at a time, when a 1099 is prepared.
Bank details. Our aim is not to hold them at all: where possible you will register your payout details directly with our payments provider, and we will never see your full account number, home address or phone number. If we ever do have to handle full bank details in order to make a payment, we keep them only for the short operational window in section 5 and then reduce the record to a masked one: provider, account holder name, the last four digits, currency, our transaction reference, the amount, the date and the status.
If you are in the EEA or the UK, we do not rely on US tax law as a legal obligation under EU or UK data protection law, because that basis has to come from EU, member state or UK law. Where we keep your name and tax identification in order to meet our US reporting duties, we rely on our legitimate interests in meeting and being able to demonstrate our tax obligations and in defending legal claims. We keep a written assessment of that balance and you can ask us for it at info@estakoyarns.com. It is a real document, not a form of words: it sets out why we cannot use "legal obligation" here, why the processing is the minimum that achieves the purpose, and what we do to reduce the impact on you.
4. Who else sees your data
We do not sell your data and we do not use it for advertising. These are the companies that process Creator Program data for us today:
| Provider | What it does | Where it processes |
|---|---|---|
| Shopify | the store itself, your customer account, store credit payouts | United States and other locations Shopify uses |
| Neon | the database that holds Program records | European Union (Frankfurt) |
| Render | the application that runs the Program | United States |
| Resend | the emails we send you about the Program | United States |
| PayPal, Payoneer, or a bank, if you take cash | making the payment you asked for | depends on the provider and your country |
| Our tax and legal advisers | advising us, and preparing tax filings | United States |
| Tax authorities | receiving what the law requires us to file | United States |
If a provider changes, we will update this table and raise the version number of this notice. We chose to put the list here rather than on a separate page so that it cannot quietly fall out of date while this notice still points at it.
Where your data goes. Our database is in the European Union; the company that controls it, and the application that reads it, are in the United States. We are a US company and we collect this data from you directly, so we are subject to the GDPR through Article 3(2) rather than as a company exporting data out of the EEA. We have not yet completed a written, provider-by-provider transfer assessment naming the instrument we rely on for each one. We are doing that with counsel, and this section will be updated with it. In the meantime, the table above tells you the thing that assessment is about: who processes your data and where.
Our customer chat assistant and its escalation channel do not receive Creator Program data. We verified this in the code rather than assuming it.
5. How long we keep it
| Data | How long |
|---|---|
| Application from someone we do not accept | deleted or anonymised after 12 months |
| Commission, refund and payout ledger | 7 years as a full financial record, then a minimal contract record for up to 10 years |
| Masked payout evidence | 7 years |
| Full bank details, if we ever hold them | 30 days after the payout, and at most 90 days where there is a dispute or a bank recall |
| Signed W-9 | 4 years from the end of the year it was given |
| Signed W-8BEN | 4 years from the end of the year it was given; its expiry as a tax form is a separate and earlier date |
| Attribution name on a published pattern | while the pattern is published; afterwards a minimal record of authorship for 10 years |
| Raw click and attribution records | 12 months, then anonymised or aggregated |
| Anything under legal hold | until the dispute or audit ends |
The 7 and 10 year figures reflect how long a claim on a written contract can be brought against us in Wyoming and how long we may need to evidence our tax position. They are our retention policy rather than a single period fixed by law.
6. What happens when you ask us to delete your data
We act on deletion requests, and we do not refuse one because we owe you money. But "delete everything" and "keep everything" are not the only two options, so we will tell you plainly what happens:
We delete or de-identify your profile details, what you wrote in your application, your social links, any notes we made, and operational logs that are no longer needed.
We keep, with restricted access and for the periods in section 5, the records we still need: the financial ledger, tax records where the law requires them, the record of which terms version you accepted, and, if we still owe you money, the minimum needed to actually pay you. In that situation your dashboard is closed immediately and your account is paused, but your name and email address stay until the balance is settled, because deleting them would close every route by which we could pay you.
Asking to be deleted does not cancel money we owe you. If we cannot reach you to pay it, we follow the applicable unclaimed property law rather than keeping it. That is also why we may keep your last known address: it can be the very thing that decides who the money must be sent to.
When we complete a deletion request we tell you what was deleted and what was retained, separately, rather than simply saying "done".
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable form. Where we rely on legitimate interests you can object, and we will stop unless we have compelling grounds that override your interests.
Write to info@estakoyarns.com. We will not charge you and we will answer within the time the law allows.
If you are in the EEA or the UK you also have the right to complain to your national data protection authority. You do not have to come to us first. As noted in section 1, we have not yet appointed Article 27 representatives, so for now info@estakoyarns.com is the route to us.
8. What you have to give us
To take part you must give us your name, email address and country, and, before any cash payout, a tax form. Without these we cannot enter the contract, pay you, or meet our tax obligations, so we would not be able to accept you into the Program. Everything else you tell us, such as what you say about your audience, is optional.
9. Changes to this notice
If we correct a detail we will publish the updated notice and raise its version number. If we start processing your data in a genuinely new way, for example holding payout details we did not hold before, we will show you the updated notice before that processing starts and ask you to acknowledge that you have read it. That acknowledgment is a record that you were told; it is not consent, and it does not change the legal basis we rely on.
We keep a record of which version of this notice you were shown, when you were shown it, and when you acknowledged it, separately from your acceptance of the Program terms.
10. What we are still completing
We would rather publish this and tell you what is unfinished than hold it back and tell you nothing. Three things are open:
- Article 27 representatives for the EEA and the UK. Not yet appointed. Section 1.
- A provider-by-provider transfer assessment. Not yet written. Section 4 names the providers and where they process; the legal instrument for each is being settled with counsel.
- Counsel's review of this notice. Not yet completed.
Each will be reflected here, with a new version number, as it is finished.
