Skip to main content

Privacy Policy

Effective Date: 11 July 2026

The Executive Summary

At Referrals Buddy, we treat your data with absolute respect. We only collect what we need to run a fair, transparent referral queue. We don't sell your personal data. We use industry-leading processors like Stripe to handle your payments securely. If you want your data gone, we delete it. No friction.

1. Who We Are

Referrals Buddy ("we", "us", "our") operates the fair-share referral code directory at referralsbuddy.com. We are the data controller for the information you share with us.

Contact: info@referralsbuddy.com

2. The Data We Collect

To keep the queue fair and secure, we collect specific data points when you use our platform:

  • Account Essentials: Your email, name, hashed password, member ID, and age/UK residency attestations.
  • Platform Contributions: The referral codes and links you submit. Note: These are displayed publicly when active in the rotation.
  • Referral Network: When you use an invite link or code to join, we record who invited you to properly award their Boost Credits.
  • Brand Requests: Information you submit to add new merchants (name, logo URL, offer details).
  • Security & Integrity: Anonymous browser fingerprints to ensure fair queue rotation, prevent voting fraud, and maintain system integrity.
  • Performance Analytics: Core Web Vitals and usage analytics (strictly with your consent).
  • Payment Metadata: We use Stripe for all Member subscriptions and Spotlight packs. We never store your raw credit card details on our servers.

3. Our Lawful Bases (UK GDPR)

We process your data under the following lawful bases:

  • Contract: Managing your account, processing code submissions, handling payments, and tracking referrals.
  • Legitimate Interests: Enforcing queue fairness, preventing fraudulent abuse, and displaying codes publicly.
  • Consent: Utilizing non-essential cookies for site performance analytics.

4. How We Use Your Data

Your data powers the engine. We use it to operate the referral queue, display your codes to shoppers, process your Spotlight pack and subscription payments, and aggressively prevent platform abuse. We do not, and will not, sell your personal data to third parties.

5. Trusted Processors

We partner only with elite infrastructure providers:

  • Stripe: For enterprise-grade payment processing.
  • Hosting & Email Providers: For secure server infrastructure and transactional communications.

6. Your Rights

Under the UK GDPR, you have the right to access, rectify, or erase your personal data. You can export your data or delete your account directly from your dashboard under Account → Privacy. Export includes your profile, referral codes, subscription and Spotlight history, consent records, email engagement summary, push device registrations, and support interactions. Erasure removes personal identifiers, purges email logs immediately, anonymises support tickets, and cancels Stripe billing; anonymised payment rows may be retained for accounting.

Retention schedule: Transactional email logs and delivery logs are purged after 18 months by automated retention jobs, or immediately on account erasure. Aggregate reveal and vote telemetry without personal identifiers may be kept up to 18 months for fraud prevention. Financial records remain with userId unlinked after erasure where required for tax and accounting compliance.

US Privacy Rights (CCPA/CPRA): If you are a resident of California or another applicable US state, you have the right to know what personal data we collect and to request its deletion. We comply with these regulations by default because we do not sell or share your personal data with third parties for their own commercial benefit.

If you have concerns about our data practices, you have the right to complain to the Information Commissioner's Office (ICO).