Publisher Policy

Version 1.0 · Effective 4 August 2026

This Publisher Policy is part of the Terms of Service. If you breach it, you breach the Terms. It applies to you, to everyone who works for you, and to anything you build on top of the Capitis API.

Why this document is strict

Capitis does not own the merchant programmes you promote. We hold accounts with affiliate networks — Awin, Admitad, Rakuten Advertising, CJ, Skimlinks, FMTC and others — and those networks let us pass their programmes down to you. In their contracts we are a sub-network, and every one of them says the same thing in different words: the sub-network is responsible for everything its publishers do.

Awin puts it as an obligation to "ensure that its Subpublishers are made aware of, and are obliged to comply with, the terms of this Agreement", and to "remain primarily liable for the acts and omissions of all Subpublishers". Rakuten Advertising: "You will remain liable for all acts and/or omissions of any Subpublisher." FMTC: we "shall ensure their compliance with this Agreement".

So when one publisher stuffs cookies or bids on a merchant's brand name, the network does not suspend that publisher — it suspends us, and every other publisher on the platform loses their inventory. That is the reason this policy has teeth rather than good intentions.

1. The networks' rules bind you directly

By using inventory sourced from a network, you agree to comply with that network's publisher terms and codes of conduct, and with each merchant's individual programme terms, as if you had signed them yourself. Where this policy and a network's rules disagree, the stricter rule applies.

The network behind every offer, merchant and tracking link is shown in your dashboard and returned on every API response. Their published terms:

Networks change these documents without asking us. It is your responsibility to keep up with the ones that apply to the inventory you use. We will tell you about changes we are told about, but we cannot guarantee we hear about all of them first.

2. No onward distribution

You may use Capitis inventory to promote merchants on properties you control. You may not pass it further down the chain.

Specifically, you may not:

• Operate your own affiliate network, sub-network or publisher marketplace on top of Capitis inventory, or recruit other publishers to earn through your account.
• Give, sell, sublicense or syndicate Capitis tracking links, merchant data, offer data, commission rates or deeplinks to any third party.
• Share your API key with anyone outside your organisation, or let a third party call the API on your behalf without our written approval.
• Resell, republish or redistribute the merchant and offer catalogue, in whole or in part, including as a data feed, an export, a scraped copy or a derived dataset.
• Use Capitis data to build a product that competes with Capitis.

This is not us being territorial. Awin's terms state that "Subnetworks can only join the Network and participate in Advertiser Programmes directly, not indirectly through any other Subnetwork", and their Subnetwork Code of Conduct adds: "No Subnetworks are allowed to work as Subpublishers of your Subnetwork." FMTC's terms make the data compilation their intellectual property and limit us to our own use. A second layer of redistribution below you would put every network relationship we have in breach at once.

If you have a genuine sub-publisher model, tell us at legal@capitis.app before you build it. It may be possible with the networks' prior written consent. It is never possible without it.

3. Tell your audience the links earn you money

Every place a Capitis link appears, the person clicking it must be able to tell — before they click — that you may earn a commission. The disclosure must be:

• Close to the link. Not on an "about" page, not below the fold, not in a footer.
• In plain words. "We may earn a commission from links on this page" works. "Partner", "sponsored by", "sp" and bare "#affiliate" do not, on their own, in most markets.
• Impossible to miss. Same size and contrast as the surrounding text, and not hidden behind a tap, a hover or a "read more".

This is a legal requirement, not a courtesy: the US Federal Trade Commission's endorsement guides (16 CFR Part 255), the UK Advertising Standards Authority under the CAP Code, and the equivalent regulators in most EU markets all require it. Every network we work with requires it too.

AI-generated content. Where you use AI tools to generate or substantially write promotional content that carries Capitis links, you must disclose that use wherever the law or the platform you are publishing on requires it. Rakuten Advertising makes this an explicit network requirement; treat it as applying across all your Capitis traffic.

4. Your privacy notice

Every website, app or service where you use Capitis links must publish a privacy notice that:

• Is reachable from the home page or app entry screen, behind a link labelled "Privacy", "Legal", "Terms" or similar wording a normal person would recognise.
• Explains the tracking technology in use, including tracking enabled on your behalf through Capitis and through the affiliate networks.
• Describes what data you collect and, where relevant, that data is shared for advertising and attribution purposes.
• Tells visitors how to exercise the choices available to them, including how to opt out.

Those four requirements are lifted almost word for word from Rakuten Advertising's publisher agreement, and versions of them appear in every other network contract we hold. We treat a missing or inadequate privacy notice as a breach of this policy.

5. Consent, notices and opt-outs

You decide what personal data you send us and why. That makes you the controller of your end-users' data and us your processor — see the Data Processing Addendum.

You must:

• Have a lawful basis for every identifier you submit, and for the click and conversion data you send us. Where your market requires consent — most of the EU and UK for tracking, and any processing of card or bank identifiers anywhere — you must have obtained it before you send us anything.
• Serve any notice, consent prompt or opt-out link that a network specifies. Rakuten's agreement requires sub-networks to "require participants in Your subnetwork to provide the required notice, consent and opt-out links". When a network hands us a specification, we will pass it to you, and you must implement it.
• Pass opt-outs and erasure requests through to us promptly. You can revoke any identifier individually through the dashboard or the API, which removes it from cross-publisher matching.
• Not send us raw personal data where a hash is expected. The identity features take HMAC-SHA256 hashes. Sending raw email addresses or phone numbers into a hash field is a breach.

Children. Do not use Capitis links on any property directed at children under 16, and do not submit identifiers for anyone you know or suspect is under 16.

6. Promotional methods you may not use

These are prohibited everywhere, on every network, with no exceptions and no "unless the merchant said it was fine":

Tracking and attribution abuse

• Cookie dropping or cookie stuffing — firing affiliate tracking without a deliberate click.
• Forced clicks, auto-redirects, pop-unders or iframes that generate clicks the user did not make.
• Modifying, stripping or overwriting another publisher's tracking parameters.
• Manipulating, intercepting or replaying tracking calls, postbacks or conversion data.
• Generating clicks or conversions by automated means, including bots, click farms and scripts.
• Concealing or misrepresenting where your traffic comes from.

Brand and trademark

• Bidding on a merchant's brand name, trademarks, common misspellings of them, or brand-plus- keyword terms in paid search, unless the merchant's programme terms expressly permit it in writing.
• Registering or using domain names, subdomains, social handles or app names containing a merchant's trademark.
• Using a merchant's logo, name or creative in a way that implies you are them, are endorsed by them, or are their official channel.
• Direct-linking paid search ads to the merchant through an affiliate link where the programme prohibits it.

Software and browser interference

• Browser extensions, toolbars, desktop or mobile software that inject, rewrite or overwrite affiliate links.
• Adware, malware, spyware, or anything a reasonable person would call unwanted software.
• Any technique that applies a commission to a purchase the user was already going to make without your involvement.

Content and traffic

• Unsolicited email, SMS or messaging. If you email, you must own the consent and comply with UK PECR, the EU ePrivacy rules and the US CAN-SPAM Act as they apply to you.
• Incentivised traffic — cashback, points, rewards, competition entries, charity donations — unless the merchant's programme expressly approves incentivised publishers. Being a cashback business is fine; promoting a merchant who has not approved cashback is not.
• Coupon and voucher content that advertises codes which do not exist, have expired, or are not available to the audience being shown them.
• Fabricated reviews, ratings, testimonials or "best of" rankings that misrepresent your actual assessment. The UK's Digital Markets, Competition and Consumers Act and the FTC's rule on consumer reviews both make this unlawful, not merely against policy.
• Adult content, gambling where you are not licensed, illegal goods, weapons, counterfeit goods, or anything that breaches sanctions or export controls.
• Content that infringes anyone's copyright, trademark or other rights.

Structural

• Operating as a network beneath us (see §2).
• Holding multiple Capitis accounts to work around a suspension or an approval decision.
• Promoting a merchant's programme after that merchant or a network has removed you from it, whether directly or through any other route.

7. Takedown on request

If we ask you to remove or change specific content, a link, a page or a campaign, you must do it within 24 hours. We will tell you why. We ask only when a network or merchant has asked us, or when we believe the content breaches this policy.

Skimlinks' terms set the same 24-hour window on us; Awin's Subnetwork Code of Conduct requires us to acknowledge a violation notice within 24 hours and resolve it within 48. We cannot meet those deadlines unless you meet this one.

8. How we enforce this

We are contractually required to be able to show a network how we police our publishers. Here is what we actually do:

• We vet before we approve. Production access requires review of your properties, your traffic sources and your business. We may decline without giving a reason.
• We monitor. We look at click and conversion patterns for the signatures of tracking abuse, and we review the properties associated with accounts.
• We keep a blocked-properties list. Networks publish lists of banned domains — Awin issues one monthly. Properties on those lists cannot promote through Capitis.
• We keep records. We retain the click and conversion ledger, and a log of policy actions, so that a network audit can be answered with evidence rather than assurances.
• We name a contact. compliance@capitis.app reaches a person, not a queue.

What happens when you breach this policy. Depending on severity we may: warn you; require a takedown; suspend individual links, campaigns or merchants; suspend your account; withhold or claw back commission earned from the traffic in question; or terminate you. We will withhold commission where a network reverses or refuses to pay it — we cannot pass on money we are not paid, and under our network agreements we may be required to repay it.

Where your conduct causes a network or merchant to claim against us, you indemnify us. That is set out in the Terms of Service and it exists because the networks impose the identical term on us for your conduct.

9. Reporting a violation

If you believe another Capitis publisher is breaking these rules, or you are a network or merchant with a complaint, email compliance@capitis.app. Include the merchant, the network, the URL or link involved and what you observed.

We acknowledge within 24 hours and give you a resolution or a concrete remediation plan within 48 hours.

10. Changes

We will give 30 days' notice by email before a change to this policy takes effect, except where a network or a regulator gives us less time than that — in which case we will pass the change on as soon as we can and tell you why it was immediate.

Questions: legal@capitis.app · Compliance reports: compliance@capitis.app

Single.id Limited, 20 Wenlock Road, London, England, N1 7GU — Company Number 17044105