Cookie and consent
The cookie magelan_aff is a marketing cookie. The script waits for the decision in the cookie banner (the cookie cookie_consent, as Swissup GDPR writes it):
- allowed: the cookie is set, the click is logged with a hashed IP and browser agent (90 days by default),
- refused: only an anonymous daily count is stored,
- not decided yet: nothing is stored; if the visitor leaves the page the click is lost.
A personal coupon code credits the order to the partner even if the visitor does not allow cookies. If the shop has no cookie banner, the default mode does not set the cookie. Under Stores › Configuration › Magelan › Affiliate Program › Advanced you can choose "Legitimate interest": that is your own legal assessment, speak to a lawyer. Add a sentence about the cookie and about partner data to your privacy policy.
Protection against abuse
The module flags a commission if the partner placed the order (same account or e-mail), the shipping address equals the partner's, or the order comes from the same IP as a click. In the settings choose the action for self-referral: flag, hold or cancel. Optionally limit the commissions per IP address per day (suggestion: 5).
Flagged commissions are under Commissions › Review flagged. Open one, write a comment and click Release or Reject commission. The decision goes to the partner's log.