Referaly OÜ, a Private Limited Company registered in Estonia (registration number 16957852), with its registered office at Tartu mnt 67/1-13b, 10115 Tallinn, Estonia, publishes the Referaly platform: the referaly.fr website, the app.referaly.fr web application, the Referaly mobile applications and the applications under our clients' brands (together, the "Services"). Contact: hello@referaly.fr.
Our role depends on the data:
- Controller. Referaly OÜ decides how the data of your account (Professional or Referrer), your exchanges with us, website visitors and the professionals we prospect is used.
- Processor. For the data a Professional manages in Referaly (the people referred to them, their contacts and the tracking of their business), the Professional is the controller and Referaly acts on their behalf, under the data processing agreement. Requests concerning this data should be addressed to the Professional first; if you write to us, we forward your request to them.
| Category | Data concerned | Source |
|---|
| Account | Last name, first name, email, phone number, language, profession, city, company, company registration number and address, photo or logo if you add one | You |
| Sign-in with Google or Apple | Identifier and email address provided by Google or Apple | Google, Apple, with your consent |
| Business referral agreements | Content of the agreement, commission, date, time, IP address, device, version of the text and SHA-256 digital fingerprint of the acceptance | You and your use of the Services |
| Referrals | Last name, first name, phone number, email and need of the referred person, notes, progress stages, associated commission | The Referrer, with the person's consent, or the person themselves when they fill in a form |
| Payments | Plan, invoices, amount and status of commissions paid in the app, status of your Stripe payout account. We never receive your card numbers | You, Stripe |
| Exchanges with us | Emails, WhatsApp messages, support requests, notification preferences | You |
| Options you enable | Connection tokens for your Google mailbox (article 12) or your CRM software (Pipedrive, HubSpot, Salesforce, Zoho, Odoo) | You |
| Technical data | IP address, device and operating system type, connection logs, notification token, identifier of the invitation link used | Automatic |
| Website visits | Pages viewed and source of the visit, only if you accept analytics (article 9) | Automatic |
| Prospecting | Company name, contact's name and role, business email and phone | Public websites and directories, app store listings, business data providers |
If you choose a person from your phone's contacts, the app reads the contacts on your device so that you can make your choice; only the chosen contact is sent to our servers. We do not request any sensitive data (health, opinions, origin): do not enter any in the notes.
Each processing operation is based on one of the legal bases provided for in Article 6 of Regulation (EU) 2016/679 (GDPR).
| Purpose | Legal basis |
|---|
| Creating and managing your account, providing the Services, sending you service notifications | Performance of the contract (our Terms) |
| Generating business referral agreements, recording their acceptance and keeping proof of it | Performance of the contract and legitimate interest (being able to prove acceptance) |
| Passing referrals on to the Professional and tracking their progress | Processing carried out on behalf of the Professional, on the legal basis they choose (article 4) |
| Collecting subscription payments, enabling the payment of commissions, invoicing, keeping our accounts | Performance of the contract and legal obligation |
| Supporting you on WhatsApp during your first days (creating your business referral agreement, inviting your first referrers) | Legitimate interest; you can stop it at any time by replying "STOP" |
| Calling you and messaging you on WhatsApp after a request you left on the website (call-back, guide, quiz) | Your request, or your consent given by ticking the box |
| Sending you our news and tips by email | Legitimate interest with regard to our users; unsubscribe link in every email |
| Prospecting professionals using their business contact details | Legitimate interest; you can object at any time via the unsubscribe link or by email |
| Drafting our replies and messages faster with an artificial intelligence tool, reviewed or supervised by our team | Legitimate interest |
| Measuring website traffic (analytics) | Consent, collected through the cookie banner |
| Ensuring security, preventing fraud and fake referrals | Legitimate interest |
| Responding to requests from authorities, handling reports of illegal content | Legal obligation |
Where processing is based on our legitimate interest, you can object to it at any time (article 7). We do not take any decision producing legal effects concerning you based solely on automated processing.
If a Referrer has referred you to a Professional, here is what you need to know.
- Who processes your data. The Professional to whom you were referred is the controller. Referaly hosts and transmits your contact details on their behalf, as a processor.
- Your consent first. Before sending your contact details, the Referrer certifies in the app that they have your consent to share them with that Professional. You can also fill in a contact request form yourself.
- How you are informed. The Professional informs you of the processing of your data at the latest at the time of their first contact with you, as provided for in Article 14 of the GDPR. This policy remains available at any time on referaly.fr.
- What is done with your data. The Professional uses it to get back in touch with you and follow up on your request, and the Referrer uses it to track the progress of their referral and their commission. Referaly does not contact you on its own behalf, does not use your data for its own prospecting and does not sell it.
- How long. As long as the Professional keeps the referral in their account, and no more than three years after the last exchange (article 6).
- Your rights. Contact the Professional. You can also write to hello@referaly.fr: we will forward your request to them and help you exercise your rights.
We do not sell or rent any data. Your data is accessible to:
- authorised members of the Referaly team, to provide the Services and assist you;
- the users you are connected with on the platform: the Professional sees the profiles of their Referrers and the referrals they send; the Referrer sees the Professional's agreement and the progress of their referrals; the profile you publish in the directory is public;
- authorities, where required by law;
- the following providers, which act on our behalf and are contractually bound to protect your data.
| Provider | Service provided | Place of processing |
|---|
| Amazon Web Services EMEA SARL (AWS) | Hosting of servers, database, files and backups | Paris, France |
| Amazon Web Services (Amazon SES) | Sending emails | Paris, France |
| Stripe | Payment of subscriptions and commissions, Referrers' payout accounts | European Union and United States |
| Google (Firebase, Google Analytics, Google Workspace) | Mobile notifications and sign-in, analytics with your consent, our team's email and calendar | European Union and United States |
| Apple | Sign in with Apple, App Store purchases | United States |
| Meta Platforms Ireland (WhatsApp Business) | WhatsApp onboarding and support messages, and messages after a request on the website | European Union and United States |
| Branch Metrics | Invitation links that open the app | United States |
| Supabase | Database for our internal client tracking and email sending tool | Frankfurt, Germany |
| Vercel | Hosting of our internal tool's functions | United States |
| Anthropic | Artificial intelligence tool that helps our team draft replies and messages | United States |
For identity verification and fraud prevention, Stripe also processes certain data on its own behalf. When you provide personal data to open a payout account, Stripe receives it and processes it in accordance with the Stripe Privacy Policy.
If you connect your CRM software (Pipedrive, HubSpot, Salesforce, Zoho, Odoo), we send it the data you have chosen to synchronise. That software then acts on your behalf, under your own contracts with its provider.
| Data | Period |
|---|
| Account | As long as your account is open. When the account is deleted, your agreements, referrals and contacts are erased; your name, email and phone number are kept for three years as evidence of our exchanges, then erased |
| Referrals and referred persons | As long as the Professional keeps them in their account, and no more than three years after the last exchange |
| Proof of acceptance of a business referral agreement | Term of the agreement, then five years |
| Invoices and accounting records | Seven years from the end of the financial year, as required by Estonian accounting law |
| Messages exchanged with us | Three years after the last exchange |
| Prospecting data | Three years after the last contact, or until you object |
| Server technical logs | 12 months |
| Backup copies | 12 months |
These periods may be extended for data needed to establish, exercise or defend legal claims, for as long as the proceedings last.
You have the right of access, rectification, erasure, restriction, objection and portability regarding your data, as well as the right to withdraw any consent you have given at any time and to set instructions regarding what happens to your data after your death.
- To exercise these rights, write to hello@referaly.fr. We may ask you to prove your identity. We reply within one month.
- You can delete your account at any time from the app.
- You can lodge a complaint with a supervisory authority: the Estonian authority (Andmekaitse Inspektsioon), the CNIL in France, the AEPD in Spain or the authority of your country of residence.
Exchanges between your device and our servers are encrypted (TLS). Passwords are stored in hashed form. Access to data is limited to authorised persons and protected by individual authentication. As no system is infallible, we will notify you, as well as the supervisory authority, in the event of a data breach likely to present a risk to you, as required by the GDPR.
- Necessary cookies. They enable sign-in, security and the recording of your cookie choice. They do not require your consent.
- Analytics. Google Analytics is only loaded if you accept it in the cookie banner. Refusing is as easy as accepting, and you can change your mind at any time.
- Advertising. If you accept in the banner, our Google Ads, Meta and LinkedIn tags measure how well our ads work and may be used to show them again to our visitors. Without your consent, they are not loaded.
- Source of your visit. Without your consent, we only keep in your browser, for the duration of the visit, the landing page and the source of your visit, to link them to the form you fill in or the account you create.
- Emails and proposal pages. Our emails contain no tracking pixel. Our proposal pages count visits and videos played, to know whether the page was useful to you.
Our Services are reserved for people aged 18 and over. We do not knowingly collect data concerning minors. If you believe that a minor has provided us with data, write to hello@referaly.fr: we will delete it promptly.
Our servers and our database are located in Paris. Some of the providers listed in article 5 process data outside the European Union, mainly in the United States. These transfers are based on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified companies, or on the standard contractual clauses adopted by the Commission. You can ask us for a copy of the applicable safeguards.
If you choose to connect your Google mailbox to Referaly, you authorise us to send messages on your behalf, and nothing else.
- What we request. A single Google scope is required,
https://www.googleapis.com/auth/gmail.send, which only permits sending. We also request your email address (https://www.googleapis.com/auth/userinfo.email) so we can display which mailbox is connected and set the correct sender address.
- What we cannot do. This scope grants no read access whatsoever. We cannot open your inbox, read your messages, view your drafts, contacts or attachments, nor delete or modify anything.
- What we store. The access and refresh tokens issued by Google, encrypted at rest on our servers, together with the email address of the connected account. We do not retain the content of sent messages beyond what is needed to track your follow-ups inside your Referaly workspace.
- What we never do. Data obtained through Google APIs is never sold, rented or transferred to third parties for advertising purposes, and is never used to train generalised artificial intelligence models. No human reads it, except with your explicit consent, for security purposes, to comply with applicable law, or as part of internal operations on aggregated and anonymised data.
- How to revoke. At any time from the "My outbox" page of your Referaly workspace, or from myaccount.google.com/permissions. Revoking immediately deletes the tokens we hold.
Referaly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We may change this policy. We will inform you of any material change by email or in the app before it takes effect, and the date of the latest update appears at the top of this page.
For any question about your data or this policy: