Privacy Policy

Overview

This Privacy Policy explains how Referzen ("we", "us") handles information. We deal with three groups of people:

1. Our customers ("merchants") — people who create an account to run referral programs.
2. Affiliates — people who join a merchant's program through its affiliate portal.
3. Referred visitors and customers — people who click an affiliate's link or buy from a merchant.

We collect only what is needed to credit referrals and pay commissions.

Information about merchants

When you create an account we store your name, email address and a securely hashed password, plus what you set up: programs, commission rules, marketing assets, API keys and alert channels (for example a Slack webhook address).

If you buy a plan, payments are handled by the payment provider you choose. We receive a confirmation and the amount paid; we never see or store full card numbers.

Information about affiliates

When you join a program we store your name, email address, a securely hashed password, your referral code and the payout details you enter (for example your PayPal email or bank account). This information is shared with the merchant who runs the program, because they review applications and pay your commissions. We also store your clicks, referrals, commissions and payouts.

Information about referred visitors and customers

When someone opens a referral link, the merchant's website loads our small tracking script. The script:

• sets a first-party cookie named rz_ref on the merchant's own website, plus a copy in the browser's local storage, holding a random referral token. It lasts for the program's attribution window (60 days by default, set by the merchant, at most 365 days) and is used only to credit the right affiliate;
• sends us the referral code from the link, the landing page address, the referring website, an optional campaign id chosen by the affiliate and the browser's user agent.

From the request we also record the visitor's country (when the hosting platform provides it) and the device type (desktop, mobile or tablet).

What we do not store: the IP address. To spot duplicate and fraudulent clicks we keep a one-way hash of the IP address, user agent and a salt that changes every day, which cannot be turned back into an IP address. Raw clicks are deleted after 90 days; only daily totals are kept.

When a referred visitor signs up or buys, the merchant's systems (for example Stripe, WooCommerce, Shopify or the merchant's own server) send us what is needed to credit the affiliate: an order or payment id, the amount and currency, a customer or subscription id and the customer's email address. Merchants can choose to store customer emails as a one-way hash only. We never receive card numbers.

Who is responsible

Each merchant decides to run a referral program with Referzen and which data to send. For the data of their affiliates, visitors and customers we act on the merchant's behalf, as a service provider (processor). Merchants are responsible for informing their visitors and customers, for example in their own privacy policy, for showing a cookie notice or asking for consent where the law requires it before the rz_ref cookie is set, and for following the other laws that apply to them.

Cookies on this website

We only use the cookies needed to run this website: one keeps you signed in (merchant dashboard or affiliate portal) and one remembers your language. Your theme and cookie notice choices are saved in your browser's local storage. We don't use advertising cookies.

Sharing

We don't sell data and don't share it with advertisers. We only share what is needed with the services that help us run Referzen (hosting, email delivery, payments) and, for affiliates, with the merchant whose program they joined.

How long we keep data

Account, program and commission data is kept while the account exists, because merchants need their payout history. When a merchant deletes a program or their account, its affiliates, clicks, referrals and commissions are deleted too.

Security

Passwords are hashed, connections are encrypted and access to our servers is restricted. No system is perfectly secure, but we work hard to protect your data.

Your rights

You can see and change your details at any time from your account page or affiliate portal. Affiliates and customers who have a question about a program should contact the merchant who runs it first; we will help the merchant answer.

Changes

We may update this policy. For important changes we will let customers know by email.

Contact

For privacy questions contact us at support@example.com.