Privacy Policy

Effective date: October 18, 2026

This Privacy Policy explains how Referly Technologies, LLC ("Referly," "we," "us," or "our") collects, uses, discloses, and protects personal data when you visit referly.so, create or use a Referly account, participate in a referral or affiliate program powered by Referly, use Referly Atlas (our ad attribution product), visit a website that uses Referly Atlas, or otherwise use our services (collectively, the "Services").

This policy should be read together with our Terms of Service. When we process personal data for a customer that operates a referral or affiliate program or uses Referly Atlas on its store, our Data Processing Addendum also applies between Referly and that customer. Instructions for deleting your data are on our Data Deletion page.

1. Who we are

Referly Technologies, LLC is a company established in the United States.

Referly Technologies, LLC
1207 Delaware Ave #3648
Wilmington, DE 19806
United States
support@referly.so

2. When Referly is a controller or processor

Referly's role depends on why personal data is processed.

Referly as a controller

Referly acts as a controller when we determine why and how personal data is processed. This generally includes processing for:

• Referly account administration and customer support;
• Referly's own subscriptions, billing, security, fraud prevention, legal compliance, and service improvement;
• Referly-wide affiliate accounts, profiles, marketplace or discovery features, and cross-program functionality;
• Referly Atlas accounts, workspaces, subscriptions, and the advertising accounts a customer connects to Referly Atlas; and
• Referly's own communications and marketing.

This Privacy Policy applies directly to those activities.

Referly as a processor

When a business, program owner, or agency uses Referly to operate a referral or affiliate program, or uses Referly Atlas to measure and report the advertising behind its sales, that customer generally determines the purposes of the processing and is the controller. Referly processes program and store data on the customer's instructions as its processor or subprocessor.

Program data can include affiliate applications and profiles, referral and conversion tracking, customer and transaction data, commissions, program communications, fraud-review signals, tax information, and payout information. Referly Atlas store data can include the visits, events, orders, and customer details described in section 6A.

If your personal data was collected through a particular customer's referral or affiliate program, or on a store that uses Referly Atlas, please review that customer's privacy notice and direct your privacy request to that customer. We will assist the customer with the request as required by our Data Processing Addendum and applicable law.

3. Personal data we collect

Depending on how you interact with the Services, we may collect the following categories of personal data.

Information you or a Referly customer provides

• Account and contact information: name, email address, login information, company name, role, website, and account preferences.
• Affiliate and profile information: profile details, social handles, program membership, application answers, uploaded files, and other information submitted through customer-configured forms.
• Support and communications: support requests, emails, feedback, and other messages sent to Referly or through the Services.
• Billing, payout, and tax information: billing address, transaction and payment status, payout destination, bank or payment account details, invoices, tax classification, tax identification information, and tax forms where the relevant feature is used.
• Business configuration information: program settings, integration settings, API and webhook configuration, and credentials a customer provides to enable an integration.

Please do not submit special-category or highly sensitive personal data through custom forms or support channels unless it is necessary, lawful, and expressly requested for an available feature.

Information collected from use of the Services

• Device and usage information: IP address, approximate location, browser, operating system, device type, language, screen or viewport information, pages viewed, timestamps, session identifiers, and diagnostic logs.
• Referral and attribution information: referral or affiliate identifiers, cookies or local-storage identifiers, landing and referring URLs, campaign parameters, advertising click identifiers, and click or conversion events.
• Network and fraud-review information: internet service provider or network information, proxy or VPN indicators, device signals, and information used to identify possible self-referrals, duplicate activity, abuse, or fraud.
• Program and transaction information: referred-customer identifiers and contact details, purchases, subscriptions, refunds, sales values, commissions, payout status, performance information, and related program events.
• API, integration, and webhook information: data received from or sent to customer-selected integrations and endpoints, together with delivery, retry, authentication, and audit logs.
• Advertising account information (Referly Atlas): the advertising accounts a customer connects, their campaigns, ad sets, ads, creatives, spend, and performance metrics, and OAuth access and refresh tokens, as described in section 6A.
• Connected-account information: social account identifiers and handles, profile information, account-verification status, OAuth access and refresh tokens, selected Google Analytics property identifiers, audience and performance metrics, and information derived from connected services.

Information from other sources

We may receive personal data from Referly customers and their websites, ecommerce and payment integrations, affiliates and other users, identity providers, publicly available sources, and service providers that help us operate the Services.

4. How we use personal data and our legal bases

Where the European Economic Area ("EEA") or United Kingdom data protection laws apply and Referly is the controller, we rely on the following legal bases:

Where Referly acts as a processor, the relevant customer determines the purpose and legal basis for the processing.

5. Referral and affiliate tracking

Referly enables customers to attribute visits, referrals, sales, subscriptions, refunds, and commissions to affiliates or referral partners. Tracking may use links, cookies, local storage, APIs, webhooks, or server-to-server integrations and may involve the technical, attribution, transaction, and fraud-review information described above.

The customer operating the program is responsible for providing appropriate notices, selecting a valid legal basis, and obtaining any consent required for tracking on its websites or services. Referly processes this data on the customer's behalf and according to the customer's configuration and instructions.

6. Google sign-in and connected Google accounts

Referly offers two distinct Google-related features: Google sign-in for affiliate dashboards and optional Google account connections for affiliate-profile verification and audience metrics.

Google sign-in

Program owners may configure Google sign-in for their affiliate dashboards by providing their own Google OAuth client ID and client secret. Referly stores these credentials so the configured sign-in feature can operate. A client secret is treated as a confidential integration credential and is not displayed to affiliates.

When an affiliate chooses to sign in with Google, Referly may receive limited authentication information made available by Google, such as a Google account identifier, name, email address, email-verification status, and profile image, depending on the scopes configured by the program owner. We use this information only to authenticate the affiliate, associate the sign-in with the relevant dashboard account, and protect the account.

Referly does not receive the affiliate's Google password through this sign-in feature.

YouTube and Google Analytics connections

An affiliate may separately choose to connect a YouTube channel or Google Analytics property to verify ownership of a channel or website and to add audience and performance information to the affiliate's Referly profile. Connecting an account is optional unless a particular program owner has made verified social or website information a condition of joining or participating in its program.

Depending on the feature selected, Referly requests read-only access to:

• YouTube (youtube.readonly): channel identifiers, name, handle, profile image, description, subscriber count, total views, and video count;
• YouTube Analytics (yt-analytics.readonly): aggregate channel performance and audience metrics, which may include views, watch time, and audience demographic or geographic percentages; and
• Google Analytics (analytics.readonly): Google Analytics properties available to the affiliate and data for the property the affiliate selects, which may include active users, page views, engagement, top countries and cities, traffic sources and referrers, top pages, and device, browser, and operating-system breakdowns.

Referly uses this Google user data only to:

• verify ownership or authorized access to the connected channel or website;
• create and maintain the connected social or website profile;
• display selected aggregate audience and performance information to businesses whose programs the affiliate joins or applies to; and
• refresh the profile information while the connection remains active.

To support these features, Referly stores the OAuth access token and, where Google provides one, the refresh token associated with the connection. Referly also stores the selected account or property identifier and the profile, audience, and performance information retrieved from or derived from Google APIs.

We retain these credentials and connected-account data while the account remains connected and the feature is being provided. If the affiliate removes the connected account or deletes the Referly account, the corresponding active record is deleted. Residual copies in backups are deleted within 30 days. An affiliate may also revoke Referly's access through the security settings of the relevant Google account.

Referly does not receive the affiliate's Google password and does not use these permissions to access Gmail, Google Drive, contacts, private videos, or Google data outside the scopes disclosed during the connection flow. We do not sell Google user data, share it with advertising platforms or data brokers, use it for targeted advertising, or use it to develop, improve, or train generalized artificial-intelligence or machine-learning models.

Referly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

6A. Referly Atlas (ad attribution)

Referly Atlas helps online stores see which advertising produced their sales. A store owner (our customer) installs the Referly Atlas tracking script, web pixel, plugin, or integration on its website or store, connects the advertising accounts it owns, and chooses where conversion events are sent. For the visitor and order data described in this section, the store owner is the controller and Referly is its processor.

Data collected on a store's website

When you visit or buy from a store that uses Referly Atlas, Referly may process, on the store owner's behalf:

• Visit and device information: a random visitor identifier stored in a first-party cookie or local storage, session identifiers, pages and products viewed, landing page and referring URL, campaign parameters (such as UTM tags), IP address, approximate location derived from it, browser, operating system, device type, language, screen size, and timezone;
• Advertising identifiers: ad-click identifiers in the page address (such as fbclid, gclid, or ttclid), affiliate or partner parameters, and identifiers set by advertising platforms on the store's website (such as Meta's _fbp and _fbc or TikTok's _ttp cookies);
• Shopping and conversion events: product views, add-to-cart and checkout events, sign-ups, form submissions the store chooses to track, and orders, including items, order value, currency, discounts, refunds, and the cart and checkout identifiers used to match an order to a visit;
• Customer details from orders and forms: name, email address, phone number, billing and shipping location, and the store's customer identifier, as provided by the store's checkout or its ecommerce platform; and
• A device fingerprint: a one-way hash of the IP address truncated to its network prefix, the browser family, and the screen, timezone, and language settings, used only to link visits from the same device when a cookie is missing. No canvas, audio, or similar probing is used. In regions where prior consent is required, the fingerprint is computed only after the visitor has given marketing consent, and a store owner can turn it off.

Referly uses this data to attribute each order or conversion to the visit and advertising that led to it, to report results to the store owner, and to send conversion events to the advertising platforms the store owner selects.

Conversion events sent to advertising platforms

When a store owner connects a destination, Referly sends conversion events (such as a purchase, add-to-cart, or sign-up, with its value) to that platform using the store owner's own pixel, dataset, or account credentials. Supported destinations include Meta (Conversions API), TikTok (Events API), Google Ads (conversions fired by a tag on the store's website), Pinterest, Snapchat, Reddit, Microsoft Advertising, X, Klaviyo, and Taboola.

Before an email address, phone number, name, or customer identifier is sent to an advertising platform, it is normalized and hashed with SHA-256, as each platform requires. Events may also include the IP address, browser user agent, and advertising identifiers described above so the platform can match the event to an ad interaction. Each platform processes the data it receives under its own terms and privacy policy, and the store owner is responsible for the legal basis and any consent required for sending it. Where a store owner enables consent handling, Referly withholds events or identifiers that a visitor's consent choices do not permit.

Advertising accounts connected to Referly Atlas

A store owner can connect advertising accounts it owns or manages so that Referly Atlas can show advertising spend and results next to the sales it tracked. Depending on the platform, Referly requests:

• Meta (ads_read): read-only access to the ad accounts the store owner selects;
• Google Ads (https://www.googleapis.com/auth/adwords): access to the Google Ads accounts the store owner selects, used only to read reports; and
• TikTok (Marketing API read scopes): read-only access to the selected advertiser accounts.

Referly retrieves account names and identifiers, campaigns, ad sets or ad groups, ads, creative content (headlines, text, images, video thumbnails, and ad previews), daily spend and delivery and performance metrics, and, for Meta, aggregated audience-segment and age and gender breakdowns. Referly never creates, changes, pauses, or spends on any campaign, and does not upload conversions through these connections.

Referly stores the OAuth access token and, where the platform provides one, the refresh token, encrypted at rest. We use advertising account data only to provide Referly Atlas reports and features to the customer who connected the account and to the members of that customer's team. We do not sell it, share it with data brokers, use it for our own advertising or for advertising to anyone else, or use it to develop, improve, or train generalized artificial-intelligence or machine-learning models.

Referly's use and transfer of information received from Google APIs, including the Google Ads API, adheres to the Google API Services User Data Policy, including its Limited Use requirements. Our use of data received from Meta complies with the Meta Platform Terms and Developer Policies.

Retention and deletion of Referly Atlas data

• Visit and event records are kept for 13 months, and logs of events sent to advertising platforms for 90 days, then deleted automatically.
• Orders, customer records, and reports are kept while the store remains in Referly Atlas.
• Advertising account data and tokens are kept while the account remains connected. Disconnecting an account deletes its campaigns, ads, spend, and breakdown data, and its token is deleted once no connected account uses it. The connection can also be revoked from the advertising platform's own settings.
• Deleting a store in Referly Atlas deletes its visits, events, orders, customer records, reports, destinations, and connected advertising accounts.
• Residual copies in backups are deleted within 30 days.

Step-by-step instructions, including how to remove the Referly Atlas app from your Facebook account, are on our Data Deletion page. If you are a shopper and want your data deleted from a store's Referly Atlas records, contact the store, or email support@referly.so and we will help the store respond.

7. Cookies and similar technologies

We use cookies and similar technologies that are necessary to authenticate users, remember settings, maintain security, and operate the Services. We may also use analytics technologies to understand and improve product use.

Where required by law, we obtain consent before using non-essential cookies or similar technologies. You can manage cookies through the choices we make available and through your browser settings. Disabling necessary technologies may prevent parts of the Services from working.

Referral, affiliate, and Referly Atlas tracking on a customer's website is controlled by that customer. Please consult the customer's privacy and cookie notices for information about its choices and legal basis.

8. How we disclose personal data

We may disclose personal data only as reasonably necessary for the purposes described in this policy, including to:

• Customers and authorized users: program owners, agencies, team members, and affiliates where necessary to operate a program or where the customer has configured that disclosure.
• Service providers and subprocessors: providers of hosting, databases, storage, analytics, email delivery, payment processing, and webhook infrastructure.
• Customer-selected integrations: ecommerce platforms, payment providers, APIs, and webhook endpoints selected or configured by a customer.
• Customer-selected advertising and marketing platforms: the Referly Atlas destinations a store owner connects, such as Meta, TikTok, Google Ads, Pinterest, Snapchat, Reddit, Microsoft Advertising, X, Klaviyo, and Taboola, which receive conversion events as described in section 6A.
• Payment and financial providers: to facilitate subscriptions, commissions, payouts, refunds, fraud controls, and legally required checks. A provider may act as its own controller for processing it independently determines, such as regulatory compliance.
• Professional advisers and authorities: auditors, lawyers, insurers, regulators, courts, law enforcement, or other authorities where necessary or legally required.
• Business transaction participants: prospective buyers, successors, or counterparties in connection with a merger, financing, reorganization, acquisition, or sale of assets, subject to appropriate safeguards.

Our principal infrastructure and service providers currently include:

Referly does not sell personal data.

9. International data transfers

Referly is established in the United States, and personal data may be processed in the United States, the European Union, or other countries in which Referly's service providers operate. Those countries may have data-protection laws that differ from those in your country.

Where EEA or UK personal data is transferred to a country that is not recognized as providing adequate protection, we use a legally recognized transfer mechanism where required, such as the European Commission's Standard Contractual Clauses and, for UK transfers, the applicable UK transfer addendum or agreement. We may also rely on another lawful transfer mechanism available under applicable law.

Contact support@referly.so if you would like more information about the safeguards relevant to your personal data.

10. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. The relevant period depends on the type of data, the relationship, legal requirements, and whether the data is needed for security or a legal claim.

Referly Atlas retention periods are described in section 6A. Customer Personal Data that Referly processes as a processor is deleted from active systems and residual backups within 30 days after the relevant Services end or after a valid deletion instruction, unless applicable law requires longer retention.

Account, billing, tax, security, and legal records that Referly processes as a controller may be retained for longer where needed for the purposes above. We may retain aggregated or de-identified information that no longer identifies an individual.

11. Your privacy rights

Depending on your location and applicable law, you may have the right to:

• request access to personal data about you;
• ask us to correct inaccurate or incomplete data;
• request deletion of personal data;
• restrict or object to certain processing, including direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time where processing relies on consent, without affecting earlier processing;
• lodge a complaint with the data-protection authority in the country where you live or work, or where you believe an infringement occurred; and
• not be discriminated against for exercising an applicable privacy right.

To exercise a right concerning processing for which Referly is the controller, email support@referly.so. Deletion instructions are also on our Data Deletion page. We may need to verify your identity and may ask for information needed to locate your data. You may also use an authorized agent where permitted by law.

If the request concerns data processed for a particular referral or affiliate program, or by a store that uses Referly Atlas, please submit it to the program or store owner. Referly will assist that customer in responding.

12. Automated processing

Referly may use automated rules or signals to support security, fraud detection, recommendations, matching, and program administration. Referly does not make decisions in its role as controller based solely on automated processing that produce legal effects or similarly significant effects for an individual.

A program owner may configure rules that flag, hold, or reject referrals or rewards. In that context, the program owner determines the rule and its consequences, and Referly processes the relevant data on the program owner's behalf. Questions or challenges about such a decision should be directed to the program owner.

13. Security

We use administrative, technical, and organizational measures designed to protect personal data. These measures include access restrictions, secure transmission, logging and monitoring, vendor controls, and measures intended to maintain the availability and resilience of the Services. No system can be guaranteed to be completely secure.

If you believe your interaction with Referly is no longer secure, contact support@referly.so promptly.

14. Children

The Services are not intended for use by anyone under 18 years of age, and we do not knowingly allow a child to create a Referly account. If you believe that a child has provided personal data to Referly, contact support@referly.so. We will investigate and take appropriate steps, including deletion where required.

Referly customers must not knowingly use the Services to collect or process children's personal data unless they have a valid legal basis, provide all required notices, obtain any required authorization, and have agreed the processing with Referly where necessary.

15. Third-party services and links

The Services may link to or integrate with third-party websites and services. Those third parties determine their own privacy practices when acting independently of Referly. Their privacy notices, not this policy, govern that independent processing.

16. Changes to this policy

We may update this Privacy Policy to reflect changes to the Services, our practices, or applicable law. We will post the updated policy on this page and revise the effective date. Where required, we will provide additional notice of material changes.

17. Contact us

For questions, complaints, or requests concerning this Privacy Policy or Referly's privacy practices, contact:

Referly Technologies, LLC
1207 Delaware Ave #3648
Wilmington, DE 19806
United States
support@referly.so