Privacy Policy

This Privacy Policy describes how ScaleUp Works LLC, a Florida limited liability company with its principal business address at 2351 W Atlantic Blvd, Unit 668144, Pompano Beach, FL 33069 (“Company,” “we,” “us,” or “our”), collects, uses, shares, and protects personal information in connection with the SocialMedia DMs Affiliate Program (the “Program”).

This Privacy Policy applies to personal information of affiliates, prospective affiliates, and visitors to the affiliate program web pages (including partners.socialmediadms.com, affiliates.socialmediadms.com, and the six industry-specific affiliate landing pages at dms.socialmediadms.com/for-agencies, /for-coaches, /for-ecommerce, /for-real-estate, /for-local-services, and /for-saas-founders). It does not apply to personal information of SocialMedia DMs subscribers, which is governed by the separate SocialMedia DMs Customer Privacy Policy.

Capitalized terms not defined in this Privacy Policy have the meanings given to them in the SocialMedia DMs Affiliate Program Terms and Conditions.

1. Information We Collect

We collect personal information from you when you apply to the Program, participate in the Program, communicate with us, or visit the affiliate program pages. The categories of personal information we collect are described below.

1.1 Information you provide directly

When you submit an affiliate application or otherwise interact with us:

• Identity information: first name, last name, business or trade name.
• Contact information: email address, business website URL, country of residence, and (for Tier 1 affiliates) Instagram handle or other social media identifiers, mailing address.
• Business information: role/title (agency owner, fractional CMO, coach, etc.), audience size estimate, audience platforms (Instagram, LinkedIn, etc.), industries served, and your description of how you intend to promote the Program.
• Communications: emails, messages, support tickets, and any other communications you send to us (including replies to program emails, direct messages, and Slack messages in private affiliate channels).
• Marketing source: optionally, how you heard about the Program (for our internal attribution).
• Agreement records: your agreement to the Terms and Conditions, this Privacy Policy, and any other program-related agreements, including the date, time, and IP address from which the agreement was submitted.

1.2 Information collected automatically

When you visit the affiliate program pages or interact with affiliate program emails, we automatically collect:

• Device and browser information: IP address, browser type and version, operating system, device type, screen resolution, language preference, and time zone.
• Usage information: pages viewed, links clicked, time spent on pages, referring URLs, exit pages, and similar interaction data.
• Cookies and tracking technologies: see Section 10 for details on cookies, including the affiliate tracking cookie used to attribute referrals.
• Email engagement: opens, clicks, bounces, and unsubscribes from program emails.

1.3 Information collected from third parties

We may receive personal information about you from third parties:

• Identity verification: fraud-detection and IP-reputation services we use during application review may share signals such as VPN usage, proxy detection, or known-spam IP indicators.
• Payment information: Tipalti, our payout processor, collects banking information, tax forms (Form W-9 or W-8BEN/W-8BEN-E), and payout preferences directly from you during onboarding and shares with us only the information we need to process payouts (such as payment status and confirmation of tax-form completion). We do not collect or store your banking credentials, full tax identification numbers, or payment account numbers ourselves.
• Referred customer data: when an individual signs up for SocialMedia DMs using your affiliate tracking link, our payment processor (Stripe) provides us with limited information about that conversion (such as plan purchased, subscription start date, and a masked customer identifier) so that we can attribute the referral and calculate your commission. We do not share the referred customer’s personal contact information with you.
• Professional networking data: publicly available information about you on platforms like LinkedIn, Instagram, or your business website, which we may review during application screening for high-audience-claim or manual-review applications.
• Sub-affiliate referrer attribution: if you were referred to the Affiliate Program by another affiliate (a “Sub-Affiliate Referrer”), we record the identity of that Sub-Affiliate Referrer at the time of your application. This referrer information is collected from the affiliate-program-management platform (or from the form input you provided naming your referrer) for the purpose of attributing the 5% Tier 2 Override commission described in Section 3.5 of the Affiliate Program Terms and Conditions to your Sub-Affiliate Referrer. The referrer record consists of your Sub-Affiliate Referrer’s affiliate account identifier and the timestamp of the attribution; we do not share your application or personal information with the Sub-Affiliate Referrer.
• If you do not provide the personal information necessary for us to review your application, provision your affiliate account, or process your payouts, we may be unable to accept your application or to continue your participation in the Program.

2. How We Use Your Information

We use the personal information we collect for the following purposes:

2.1 To operate the Program

• Process and review your affiliate application.
• Provision your affiliate account, tracking link, and access to the affiliate portal.
• Attribute referrals to you, calculate commissions, and process payouts.
• Manage clawbacks and reconcile commission records with payment events.
• Attribute Sub-Affiliate Referrer override: for affiliates who introduced you to the Program, calculate the 5% Tier 2 Override commission described in Section 3.5 of the Affiliate Program Terms and Conditions based on charges generated by your qualifying referrals.
• Provide affiliate program support, including responding to inquiries about commissions, payouts, attribution, or technical issues.

2.2 To communicate with you

• Send transactional emails (welcome sequences, new-referral notifications, payout confirmations, clawback notices, etc.).
• Send weekly performance digests with your activity statistics.
• Send program updates, policy changes, and other operational communications.
• Send re-engagement or feedback messages if your activity drops, with the goal of helping you succeed in the Program.
• For Tier 1 affiliates: communicate via the private Slack channel and direct outreach from the founder or BDR.

2.3 To improve and protect the Program

• Analyze application patterns, conversion rates, and affiliate performance to improve the Program.
• Detect, prevent, and respond to fraud, abuse, prohibited promotion methods, and other violations of the Terms and Conditions.
• Investigate disputes and enforce our agreements.
• Protect the rights, property, and safety of the Company, our affiliates, our customers, and the public.

2.4 To comply with legal obligations

• Comply with tax laws, including 1099-NEC reporting for US affiliates earning $600 or more in a calendar year.
• Respond to lawful requests from regulators, courts, or other governmental authorities.
• Maintain records as required by US federal, US state, and applicable international law.

2.5 Legal bases for processing (GDPR/UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR or UK GDPR:

• Contract performance (Art. 6(1)(b)): processing necessary to perform our Affiliate Program agreement with you, including tracking referrals, calculating commissions, and processing payouts.
• Legitimate interest (Art. 6(1)(f)): processing necessary for fraud prevention, security, program improvement, and direct marketing of program-related updates to existing affiliates. We balance these interests against your privacy rights and provide opt-out where appropriate.
• Legal obligation (Art. 6(1)(c)): processing necessary to comply with tax, accounting, and regulatory obligations.
• Consent (Art. 6(1)(a)): used for certain optional communications (such as marketing-style updates to prospective affiliates who have not yet been approved) and for non-essential cookies. You may withdraw consent at any time without affecting prior processing.

3. How We Share Your Information

We share personal information only as described in this Section 3. We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. Any personal information we make available to the service providers and sub-processors described in Section 5 is disclosed to them for a business purpose and is not sold or shared for cross-context behavioral advertising.

3.1 Service providers and sub-processors

We share personal information with third-party service providers (“sub-processors”) who perform services on our behalf. We require all sub-processors to: (a) process personal information only for the purposes we specify; (b) implement appropriate security measures; and (c) comply with applicable data-protection laws. Section 5 lists our current sub-processors by name and function.

3.2 Legal compliance and protection

We may disclose personal information when we believe in good faith that disclosure is necessary to: (a) comply with applicable law, regulation, or legal process (including subpoenas and court orders); (b) respond to lawful requests from public authorities, including national security or law enforcement requests; (c) enforce our Terms and Conditions or other agreements; (d) protect the rights, property, or safety of the Company, our affiliates, our customers, or the public; or (e) investigate, prevent, or take action regarding suspected illegal activity, fraud, or other wrongdoing.

3.3 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, sale of all or a portion of our assets, or bankruptcy or insolvency proceeding, personal information may be transferred to the acquiring or surviving entity. We will notify affected affiliates of any such transfer and any material change to this Privacy Policy by email to the address associated with your affiliate account at least 30 days before the change takes effect.

3.4 With your consent

We may share your personal information for other purposes with your consent or at your direction. For example, if you opt into a public affiliate leaderboard, your name and lifetime commission ranking may be visible to other affiliates.

3.5 Aggregated and de-identified data

We may share aggregated or de-identified information (information that cannot reasonably be used to identify you) for any purpose, including for marketing, business analytics, and research.

4. Information We Do Not Collect From Affiliates

In the course of operating the affiliate program, we deliberately do not collect:

• Government-issued identification documents (passports, driver’s licenses, national IDs). Tipalti collects tax forms (W-9, W-8BEN) directly from you for payout purposes; we do not access or store the underlying ID documents.
• Banking credentials, full account numbers, or payment card data. This information is collected and stored exclusively by Tipalti (for affiliate payouts) and Stripe (for referred-customer transactions). We do not have access to these credentials.
• Biometric data.
• Health information.
• Children’s personal information. The Program is not directed to and we do not knowingly collect personal information from individuals under the age of 18. If we learn that we have collected personal information from a person under 18, we will delete it.

5. Sub-Processors

As a matter of transparency, and although not required to do so, we voluntarily identify our sub-processors by name below. We engage the following sub-processors to provide services that involve processing affiliate personal information. This list is current as of the “Last updated” date above and may change from time to time; we will update this list and notify affiliates of material changes.

Affiliate-facing portal access. Our white-labeled CRM and affiliate-program platform (accessed by affiliates at login.scaleupworks.com) is operated for the Program by ScaleUp Works LLC through a parent account and a SocialMedia DMs sub-account, which have access to affiliate data as needed to operate the Program.

Authorized personnel within ScaleUp Works LLC who have access to affiliate data are limited to: the Founder, the Affiliate Program Manager, and (during onboarding) the platform implementation specialist. All such personnel are subject to written confidentiality obligations.

6. International Data Transfers

Because we are based in the United States and most of our sub-processors operate from the United States, personal information of affiliates located outside the United States (including in the European Economic Area, the United Kingdom, Switzerland, Canada, Australia, and the Philippines) is transferred to and processed in the United States.

For transfers from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the UK International Data Transfer Agreement (IDTA) or UK Addendum to the SCCs, executed with our sub-processors.
• Supplementary measures, including encryption in transit and at rest, access controls, and contractual confidentiality obligations.
• Where applicable, sub-processors’ certification under the EU-US Data Privacy Framework, the UK Extension to the DPF, or the Swiss-US DPF.

If you would like a copy of the SCCs or other transfer mechanism applicable to your data, contact us at

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention by category

• Active affiliate account information: retained while you are an active affiliate and for 12 months after termination of your participation, to facilitate reactivation if you choose to rejoin and to resolve any outstanding clawback or payout matters.
• Rejected applications: retained for 12 months after rejection, after which the application is deleted or anonymized. We retain limited information about rejected applications (such as email address) for the purpose of preventing repeated submission of substantially similar applications.
• Commission records and payout history: retained for 7 years after the calendar year in which the commission was earned, to comply with US tax-record retention requirements applicable to 1099-NEC issuers.
• Tax forms (W-9, W-8BEN, etc.): retained by Tipalti according to its own retention policy and by us in summary form (not the full form contents) for 7 years.
• Communications: retained for as long as we operate the Program, plus 3 years, for dispute resolution and operational records purposes.
• Cookies and tracking: see Section 10 for cookie-specific retention.
• Aggregated and de-identified data: may be retained indefinitely.

After applicable retention periods expire, we will delete or de-identify personal information, except where retention is required by law or where personal information is contained in our backup systems (in which case it remains there until the backup is overwritten in the normal course).

8. Your Privacy Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information. We honor these rights for all affiliates regardless of jurisdiction, except where doing so would conflict with our legal obligations or where verification of identity is not reasonably possible.

8.1 Rights available to all affiliates

• Right of access: request a copy of the personal information we hold about you.
• Right to correct: request that we correct inaccurate or incomplete personal information about you.
• Right to delete: request that we delete personal information about you, subject to legal retention requirements (such as tax records) and any ongoing contractual obligations.
• Right to object to marketing: opt out of program promotional emails at any time by clicking the unsubscribe link in any program email or by contacting Note that you cannot opt out of transactional emails (such as payout notifications) while you remain an active affiliate.
• Right to portability: receive a copy of your personal information in a structured, commonly used, machine-readable format.

8.2 Additional rights for EEA, UK, and Swiss residents (GDPR/UK GDPR)

• Right to restrict processing: request that we limit how we process your information in certain circumstances.
• Right to object: object to processing of your personal information based on our legitimate interests.
• Right to withdraw consent: where we rely on consent, withdraw that consent at any time without affecting prior processing.
• Right to lodge a complaint: file a complaint with your local data-protection supervisory authority.

8.3 Additional rights for California residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights:

• Right to know: request that we disclose what personal information we have collected about you, the sources, the purposes for which we use it, and the third parties with whom we share it.
• Right to delete: request that we delete personal information we have collected from you, subject to legal exceptions.
• Right to correct: request that we correct inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell personal information and do not share it for cross-context behavioral advertising. There is nothing to opt out of, but you may confirm this at any time by contacting us. Because we do not sell or share personal information, if your browser transmits an opt-out preference signal such as Global Privacy Control (GPC), there is no sale or sharing for us to stop; we do not sell or share personal information regardless of whether such a signal is present.
• Right to limit use of sensitive personal information: we do not use sensitive personal information for any purpose beyond what is necessary to provide the Program services you have requested.
• Right to non-discrimination: we will not discriminate against you for exercising your privacy rights. We will not terminate your affiliate participation, reduce your commissions, or otherwise penalize you for exercising rights granted by California law.
• Authorized agent: you may designate an authorized agent to make a request on your behalf. We may

require verification of the agent’s authority.

8.4 How to exercise your rights

To exercise any of these rights, contact us at with the subject line “Privacy Rights Request” and provide enough information for us to verify your identity (typically the email address associated with your affiliate account). We will respond within 30 days (or 45 days for CCPA/CPRA requests, with a possible 45-day extension where reasonably necessary).

We may need to verify your identity before responding to your request. If we cannot verify your identity, we may not be able to fulfill the request, but we will explain why and what alternative steps you may take.

9. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, and destruction. These measures include:

• Encryption of personal information in transit using TLS 1.2 or higher.
• Encryption of personal information at rest within our sub-processor systems.
• Access controls limiting personal information to authorized personnel with a need-to-know basis.
• Multi-factor authentication on all administrative accounts.
• Written confidentiality obligations for all personnel and contractors with access to affiliate personal information.
• Regular review of sub-processor security practices.

Despite these safeguards, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, but in the event of a data breach affecting your personal information, we will notify you and any applicable regulatory authorities as required by law.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on the affiliate program web pages. The categories of cookies we use and their purposes are described below.

10.1 Essential cookies

These cookies are necessary for the website and affiliate portal to function. They cannot be disabled without breaking core functionality.

• Authentication cookies: keep you logged in to your affiliate portal.
• Security cookies: detect and prevent fraudulent activity and security threats.
• Form-state cookies: preserve form inputs while you complete the affiliate application.

10.2 Affiliate tracking cookies

When an individual clicks an affiliate’s tracking link, we place a cookie on their browser to attribute the

referral if the individual subsequently signs up for SocialMedia DMs. This cookie:

• Stores: a unique identifier mapping to the affiliate’s tracking code, the timestamp of the click, and the

referring page.

• Duration: ninety (90) days from the time of the last click, applicable to all commissionable products.
• Purpose: enabling commission attribution under the affiliate program; described in Section 4 of the Affiliate Program Terms and Conditions.

The affiliate tracking cookie is placed on the browsers of referred prospective customers, not on affiliates’ own browsers. The cookie does not collect or transmit personally identifiable information; it stores only the affiliate’s tracking code and a timestamp.

10.3 Analytics and performance cookies

We use first-party and third-party analytics tools to understand how visitors interact with the affiliate program pages. These cookies collect information such as which pages are visited, time spent on pages, and how visitors navigate between pages. The information is used in aggregate form to improve the program pages.

10.4 Cookie controls

You can control cookies through your browser settings. Most browsers allow you to: refuse all cookies, accept only first-party cookies, or be notified when a cookie is set. Disabling certain cookies may impair

functionality of the affiliate portal. EU/UK/Swiss affiliates and visitors are presented with a cookie banner that enables granular consent management on first visit.

11. Your Disclosure Obligations to Individuals You Refer

As an affiliate, when you promote SocialMedia DMs to individuals in your audience, you may collect or process their personal information (for example, when running an email campaign that links to your affiliate tracking URL). You are responsible for complying with all applicable privacy laws in your own promotional activities, including:

• Providing clear and conspicuous notice of your affiliate relationship with SocialMedia DMs (also required by the Affiliate Program Terms and Conditions, Section 8.1).
• Maintaining your own privacy policy on your website if you collect personal information from visitors.
• Complying with CAN-SPAM, CASL, GDPR, ePrivacy Directive, and other applicable communications and data-protection laws when sending promotional communications.
• Honoring opt-out and unsubscribe requests from individuals in your audience.

We are not responsible for your privacy or data-protection compliance in your own promotional activities. If you are uncertain about your obligations, consult qualified counsel.

12. Children’s Privacy

The Affiliate Program is not directed to, and we do not knowingly collect personal information from, individuals under the age of 18. Eligibility to participate in the Program requires being at least 18 years of age, as set forth in the Affiliate Program Terms and Conditions, Section 1.

If we learn that we have collected personal information from a person under 18 without verification of parental consent, we will take steps to delete that information. If you believe that a person under 18 has provided personal information to us, contact

13. Third-Party Links and Services

The affiliate program pages and the affiliate portal may contain links to third-party websites and services, including (but not limited to) our sub-processors’ websites, the main SocialMediaDMs.com customer marketing site, social media platforms, and external resources we link to in welcome emails or the resource library.

This Privacy Policy applies only to the affiliate program web pages and the affiliate program services we directly operate. We are not responsible for the privacy practices of third-party websites or services. We encourage you to review the privacy policies of any third-party site or service you visit through a link in our materials.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our service

providers, or applicable law. We will post the updated Privacy Policy with a new “Last updated” date at the

top of the document.

For material changes (those that affect how we collect, use, or share personal information, or that affect your rights under this Privacy Policy), we will notify affiliates by email to the address associated with the affiliate account at least 30 days before the change takes effect.

Your continued participation in the Program after the effective date of the updated Privacy Policy constitutes your acknowledgment of the change. If you do not agree to the updated Privacy Policy, your remedy is to terminate your participation in the Program before the effective date.

15. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our handling of your personal information, contact us:

Privacy and legal matters: Program operations: Mailing address:

ScaleUp Works LLC Attn: Privacy

2351 W Atlantic Blvd, Unit 668144 Pompano Beach, FL 33069

United States

By participating in the Affiliate Program, you acknowledge that you have read and understood this Privacy Policy.