Privacy Policy
1. Who we are
referr.io ("we") operates the referr.io referral platform.
2. Roles — controller and processor
- For Business account data (email, name, billing info, location): referr.io is the data controller.
- For Referrer and Friend data generated through the referral flow (tokens, redemption records, channel data): referr.io acts as a data processor on behalf of the business customer, who is the controller for that data.
3. What we collect
From Businesses (we are controller)
| Data | Purpose | Basis |
|---|---|---|
| Email, password (hashed), business name | Account operation | Contract |
| Created date, billing status, billing reference | Subscription/trial management | Contract / Legitimate interest |
| Location name, address | Operating your promotion | Contract |
| Promotion details (rewards, dates) | Running your referral program | Contract |
From Referrers and Friends (business is controller, we process on their behalf)
| Data | Purpose | Basis |
|---|---|---|
| Referrer token (private), share token (public) | Identify referrer for reward, enable friend link | Legitimate interest (of business) |
| Redemption record, timestamp | Confirm friend redeemed offer, unlock reward | Legitimate interest |
| Channel used to share (WhatsApp/SMS/copy) | Understand which sharing channels work | Legitimate interest |
| Reward fulfilment timestamp | Record reward given | Legitimate interest |
We do not collect referrers' or friends' names, emails, or phone numbers. Their only identifier is a randomly generated code stored in their browser and in shared links.
4. Cookies
| Cookie | Set when | Duration | Necessary? |
|---|---|---|---|
pf_session |
Business staff log in | Session | Yes — required to keep you logged in |
rf_token |
Referrer link is opened | Up to 1 year, cleared once the related promotion ends | Treated as strictly necessary — see below |
rf_token: used solely to detect self-referral — a referrer opening their own friend link and claiming a reward intended for someone else. We treat this as strictly necessary to the integrity of the referral function, not as tracking: it is checked only against the promotion it was issued for, and once that promotion is no longer active or has passed its end date, the check is no longer performed and the cookie is cleared on your next visit to that link.
5. Retention
| Data | Kept for |
|---|---|
| Business account data | Length of contract + 6 years |
| Location/promotion data | Length of relationship + 3 years |
| Referrer tokens | 24 months after reward given, or after promotion ends |
| Redemption records | 24 months after redemption |
| Webhook logs | 90 days |
6. Who we share data with
- Stripe (our payment processor) — handles billing. Governed by Stripe's own privacy policy.
- Business customers receive referrer/friend data relevant to their own promotions (this is inherent to the product — a business sees its own redemption activity).
- We do not sell personal data.
7. Where data is stored
Hosted within the European Economic Area. No international transfer outside the EEA currently takes place.
8. Your rights
Under GDPR, you have the right to access, correct, delete, restrict, or port your data, and to object to processing based on legitimate interest.
If you're a Referrer or Friend: you don't have an account with us, so we can only identify your data using the unique code in your browser cookie or shared link. Contact us with that code/link if possible. We may not be able to act on requests if we can't verify which record is yours.
9. Processing on behalf of businesses
Where we act as a processor, we process referrer/friend data only on the instructions of the relevant business, under a data processing agreement.
10. Children
Our service is intended for use by businesses and their adult staff. Referral and friend rewards may be received by people under 16 in some retail contexts.
11. Changes to this policy
We'll post updates here and, where required, notify business customers directly.
