Privacy policy

What we collect

• Account data — name, email and profile picture from Google sign-in.
• Click data — a first-party cookie with a random visitor id, the referral code, the country derived from the IP address, the referring host and a device class (desktop, mobile, tablet). We do not store the raw IP address alongside the click.
• Conversion data — the amount, currency, customer id and, when the SaaS sends it, the customer email of a referred sale.
• Payment data — handled by Stripe. Card numbers and bank details never reach Reffer's servers.

Cookies

• reffer_ref — the referral code, so a sale can be attributed to the partner who sent the visitor. Lifetime is the program's cookie window, 60 days by default.
• reffer_vid — a random visitor id used to tell repeat clicks apart. One year.
• reffer_session — your signed sign-in session. Thirty days.

The first two are set by the tracking script on the SaaS company's own site. There is no third-party advertising cookie, no cross-site profile and no data sold to anyone.

Who is the controller

For click and conversion data, the SaaS company running the program is the controller and Reffer is the processor. For your Reffer account, Reffer is the controller.

Sub-processors

• Stripe — payments, Connect onboarding and payouts.
• Google Firebase — authentication and the database.
• Resend — transactional email.

Retention

Clicks are kept for 24 months. Conversions, invoices and payouts are kept for as long as tax law requires. Delete your account and everything not required for accounting is removed.

Data processing agreement

Where Reffer processes click and conversion data on a SaaS company's behalf it does so as a processor: only on that company's instructions, only for the purposes above, and only through the sub-processors listed here. A signed DPA on those terms is available on request at support@reffer.site — ask for it before you integrate rather than after.

Your rights

Access, portability and erasure do not need to go through us: Settings → Your data in the product exports everything we hold about you as JSON, and closes your account.

Closing an account erases your name, email, profile picture and tax details, and ends every session. It does not erase invoices, commissions and transfers: tax law requires those records to be kept, and they form part of other companies' books as well as yours. What remains is an amount and a date that cannot identify you.

For anything else — correction, a restriction on processing, or a complaint — write to support@reffer.site and we answer within 30 days.