We value your privacy and are committed to protecting your personal information.
This policy explains how we collect, use, and safeguard your data.
Effective Date: April 12, 2026
GDPR Compliant
EU Compliant
No Sensitive Data
1
Introduction
Welcome to Referaly's Privacy Policy. This policy describes how Referaly OÜ ("we," "us," or "our"), a Private Limited Company registered in Estonia (registration number 16957852), with its registered office at Tartu mnt 67/1-13b, 10115 Tallinn, Estonia, collects, uses, and shares your personal information when you use our referral management platform, accessible at app.referaly.fr, including our website, mobile applications, and related services (collectively, the "Services").
Referaly OÜ is the data controller for the personal data processed through the Services. By accessing or using our Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Services.
Important Notice
We are committed to transparency. Please read this policy carefully to understand our practices regarding your personal data.
2
Information We Collect
Personal Information
When you register for an account or use our Services, we may collect:
Identity information (first name, last name, date of birth)
Contact information (email address, phone number, postal address)
Professional information (company name, job title, industry, professional network)
Payment information (processed securely through Stripe; we do not store card details)
Usage Information
We automatically collect certain technical information about your device and how you interact with our Services:
Device information (type, operating system, browser type)
Log data (IP address, pages visited, timestamps)
Usage patterns and interaction metrics within the platform
Referral tracking data (referral links, conversions, commission records)
Cookies and Tracking Technologies
We use cookies, web beacons, and similar tracking technologies to collect information about your browsing activities and to personalize your experience. You can control cookie settings through your browser preferences.
3
How We Use Your Data
We use the collected information for various purposes, including:
Platform Operation
To provide, maintain, and improve our referral management platform, including referral tracking, commission calculations, and network management.
Communication
To send service updates, notifications, and respond to your inquiries and support requests.
WhatsApp onboarding support
During your first days on Referaly, we may message you on WhatsApp from our official line to help you create your program and invite your first referrers. These messages only concern your account and your first steps. You can stop them at any time by replying “STOP” or writing to hello@referaly.fr.
Referral Tracking
To track referral activity, calculate commissions, generate analytics, and provide insights to professionals and their referral networks.
Security & Compliance
To detect fraud, enforce our terms, and comply with legal and regulatory obligations.
4
Data Sharing and Disclosure
We do not sell your personal information. We may share your information in the following circumstances:
With Service Providers
We share data with trusted third-party service providers who assist us in operating our platform, including AWS (hosting), Stripe (payments), and analytics services. These providers are contractually obligated to protect your data and process it only on our instructions.
With Partner Businesses
When you participate in a referral program, we share relevant information with the subscribing professional and their business. These partner businesses are responsible for their own use of the data they receive and must comply with applicable data protection laws independently.
For Legal Compliance
We may disclose your information if required by law, court order, or governmental authority, or to protect our rights, property, or safety.
Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
5
Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.
Account data is retained while your account remains active.
Transaction records are retained for up to 7 years for tax and accounting purposes.
Marketing communication preferences are retained until you opt out.
Backup data is purged according to our secure deletion schedule.
6
Your Privacy Rights
Depending on your location, you may have certain rights regarding your personal information:
Right to Access
Request a copy of the personal information we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete information.
Right to Erasure
Request deletion of your personal information, subject to legal requirements.
Right to Object
Object to certain processing activities, including marketing communications.
Data Portability
Request a copy of your data in a structured, machine-readable format.
Right to Restrict
Request restriction of processing in certain circumstances.
To exercise these rights, please contact us at hello@referaly.fr. We will respond to your request within 30 days. You also have the right to lodge a complaint with a supervisory authority (such as the Estonian Data Protection Inspectorate or the CNIL in France).
7
Security Measures
We implement industry-standard security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. Our security practices include:
Encryption
All data transmitted between your device and our servers is encrypted using SSL/TLS protocols.
Secure Storage
Data is stored on secure servers with restricted access and regular security audits.
Access Control
Strict access controls ensure only authorized personnel can access personal data.
Important
While we implement robust security measures, no system is 100% secure. We cannot guarantee absolute security of your information.
8
Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance your experience on our platform. Here's how we use them:
Essential CookiesRequired for the platform to function properly, including authentication and security features.
Preference CookiesRemember your settings and preferences to provide a personalized experience.
Analytics CookiesHelp us understand how you use our platform to improve functionality and user experience.
Marketing CookiesUsed to deliver relevant advertisements and measure campaign effectiveness.
9
Children's Privacy
Our Services are not intended for individuals under the age of 18 (minors). We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a person under 18, please contact us immediately at hello@referaly.fr, and we will take steps to delete such information promptly.
10
International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from those in your country.
We ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.
We only transfer data to jurisdictions that provide an adequate level of data protection.
Where required, we obtain your explicit consent before transferring personal information.
11
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:
Posting the updated policy on our website with a revised "Effective Date."
Sending an email notification to registered account holders.
Displaying a prominent notice within the platform before changes take effect.
Your continued use of our Services after the effective date constitutes acceptance of the revised Privacy Policy.
12
Google Mailbox Access
If you choose to connect your Google mailbox to Referaly, you authorise us to send messages on your behalf, and nothing else.
What we request. A single Google scope is required, https://www.googleapis.com/auth/gmail.send, which only permits sending. We also request your email address (https://www.googleapis.com/auth/userinfo.email) so we can display which mailbox is connected and set the correct sender address.
What we cannot do. This scope grants no read access whatsoever. We cannot open your inbox, read your messages, view your drafts, contacts or attachments, nor delete or modify anything.
What we store. The access and refresh tokens issued by Google, encrypted at rest on our servers, together with the email address of the connected account. We do not retain the content of sent messages beyond what is needed to track your follow-ups inside your Referaly workspace.
What we never do. Data obtained through Google APIs is never sold, rented or transferred to third parties for advertising purposes, and is never used to train generalised artificial intelligence models. No human reads it, except with your explicit consent, for security purposes, to comply with applicable law, or as part of internal operations on aggregated and anonymised data.
How to revoke. At any time from the "My outbox" page of your Referaly workspace, or from myaccount.google.com/permissions. Revoking immediately deletes the tokens we hold.
Referaly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
13
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Privacy Inquiries
Email: hello@referaly.fr
Address: Referaly OÜ
Tartu mnt 67/1-13b
10115 Tallinn
Estonia
Data Controller
Referaly OÜ, represented by Arnaud Attencia (Board Member / Founder).
We're committed to transparency and protecting your personal information. If you have any questions about our privacy practices, don't hesitate to reach out.