Privacy Policy

ReferX ("ReferX", "we", "us", or "our") provides referral and review software to businesses. This Privacy Policy explains how we collect, use, share and protect personal information in connection with our website at referx.app, our referral and review pages, and the ReferX software service (together, the "Service").

This policy covers two kinds of information. The first is information about the businesses that use ReferX and the people who visit our website or contact us, which we handle for our own purposes. The second is information about a business's customers and the people those customers refer ("Customer Data"), which we handle on behalf of that business, as described in Section 4.

Information from businesses that use ReferX

• Account information, such as your name, email address, business name, business address, phone number, website and industry, and the login credentials you create.
• Program settings, such as the referral offers, reward amounts, campaigns and message content you configure.
• Billing information. Payment card details are entered into and processed by our payment processor, Stripe. We do not receive or store full payment card numbers. We receive limited information such as the card type, the last four digits and the billing status of your subscription.
• Agreement records. When you accept our service agreement, we record your name, email address, the date and time of acceptance, your IP address, your browser's user agent, and a cryptographic fingerprint of the exact document you accepted.

Customer Data that businesses provide

• Customer records a business imports or enters, such as names, email addresses, phone numbers, and optional details such as city, tags and job values.
• Referral information, including the name, email address, phone number, address, company and notes for a person being referred, which may be submitted by the referring customer, by the referred person, or by the business's staff.
• Program activity, such as the status of each referral, the rewards calculated and paid, and a record of every text message and email sent through the Service along with its delivery status.
• If a business connects its Jobber, ServiceTitan or QuickBooks account, the name, email address and phone number of each client or customer it adds there. With QuickBooks, we also read the payment and invoice total when a referred customer pays, to mark that referral as won.
• Appointment emails a business forwards to its ReferX forwarding address, from which we take the client's name, email address and, where one is clearly present, phone number. We keep only the sender, subject and outcome of each forwarded email, not its contents.

Information from website visitors and people who contact us

• When you request a demo or contact us, the information you provide, such as your name, work email, phone number, business name, industry, approximate customer count, your message, and whether you consented to receive text messages.
• The IP address from which a demo request or contact form was submitted, which we use to prevent spam and abuse.

Information collected automatically

Like most websites, our servers and hosting provider automatically receive technical information when you use the Service, such as your IP address, browser type and the pages requested. Our forms are protected by Cloudflare Turnstile, which processes information about your browser and device to distinguish people from automated bots.

We use the information we collect to:

• provide, operate and maintain the Service, including sending the campaigns a business creates, attributing referrals and delivering the rewards it approves;
• create and manage accounts, process subscription payments and fund reward payouts;
• respond to demo requests, questions and support requests;
• send service, account, security and billing notices;
• register businesses and phone numbers with mobile carriers where required to send text messages;
• detect, prevent and investigate spam, fraud, abuse and security incidents;
• maintain records of agreements, consents and opt-outs, and comply with our legal obligations; and
• improve the Service using aggregated information that does not identify any individual.

We do not sell personal information, and we do not use personal information for targeted advertising.

When a business uses ReferX, that business decides whose information is uploaded and how its customers are contacted. For Customer Data, the business is the controller and ReferX acts as its processor and service provider. We process Customer Data only to provide the Service to that business and on its instructions.

We do not market to a business's customers on our own behalf, and we do not sell, rent or share a business's customer list with anyone. We do not combine one business's Customer Data with another's, and we do not use Customer Data to build products or lists for other businesses.

If you are a customer of a business that uses ReferX, or someone who was referred to one, and you have questions about your information or wish to exercise your privacy rights, please contact that business directly. We will assist the business in responding to your request. If you contact us, we will forward your request to the relevant business where we are able to identify it.

We share personal information only as described below.

Service providers

We use the following categories of service providers to operate the Service. Each receives only the information it needs to perform its function on our behalf.

• Text message delivery (Twilio), which receives the recipient's phone number and the message content.
• Email delivery (Resend), which receives the recipient's email address and the message content.
• Payment processing (Stripe), which processes subscription and reward-funding payments.
• Reward payouts, through the payout provider in use for the Service, which receives the recipient's name, email address and the reward amount.
• Hosting and infrastructure (Vercel) and database hosting (Neon).
• Bot and spam protection (Cloudflare Turnstile).

Legal and safety

We may disclose information where we believe in good faith that it is required by law, subpoena or other legal process, or is necessary to protect the rights, property or safety of ReferX, our users, or others, or to investigate fraud or abuse.

Business transfers

If ReferX is involved in a merger, acquisition, financing or sale of all or part of its assets, information may be transferred as part of that transaction, subject to the commitments in this policy.

If you check the SMS consent box when you request a demo, ReferX may send you text messages about your demo request and your account, including scheduling, onboarding help, replies to questions you have asked us, and account or billing notices.

Mobile numbers collected for text messaging are never sold, rented, or shared with third parties for their own marketing purposes. They are shared only with the messaging provider that delivers the message on our behalf, and only to deliver it. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

Message frequency varies. Message and data rates may apply. Reply STOP to any message to opt out, or HELP for help.

Consent to receive text messages is optional and is never a condition of requesting a demo or of using ReferX.

Text messages that a business sends to its own customers through ReferX are sent under that business's name, and that business is responsible for obtaining any consent required to send them. Any recipient may reply STOP to opt out, and opted-out recipients are excluded from that business's future campaign messages.

Inside the Service, ReferX uses only the cookies that are strictly necessary to operate it, such as the cookie that keeps you signed in to your account.

On our public marketing website (not the client or staff portals), we use Google Analytics to understand how many people visit and which pages they read. Google Analytics sets cookies and collects information such as pages viewed, approximate location, device and browser type, and how you arrived at the site. You can opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout. We do not use third-party advertising cookies. Cloudflare Turnstile, which protects our forms, may process browser and device information for security purposes as described in Cloudflare's own privacy policy.

We keep account information and Customer Data for as long as the business's account is open. A business may delete customers from its account at any time. Deleting a business account removes its customers, referrals, rewards and message history.

After an account is terminated, we retain its data for thirty days so the business can request an export, and then delete it, except where we are required to keep records for legal, accounting or fraud-prevention purposes.

We keep records of accepted agreements for as long as needed to evidence the agreement, and we keep demo requests and correspondence for as long as needed to respond and follow up, or until you ask us to delete them.

We maintain reasonable administrative, technical and physical safeguards designed to protect personal information. Passwords are stored as salted hashes rather than in readable form, and credentials we hold for third-party providers are encrypted before they are stored.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you as required by applicable law.

Depending on where you live, you may have the right to request access to the personal information we hold about you, to request that we correct or delete it, to receive a copy of it in a portable format, and to object to or restrict certain processing. We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of in that respect.

To make a request, email support@referx.app. We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law. We will not discriminate against you for exercising any of these rights. If your request concerns Customer Data, please see Section 4.

Businesses can export their data at any time while their account is open.

The Service is intended for businesses and is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

ReferX is operated from the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, processed and stored in the United States, where data protection laws may differ from those in your country.

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" at the top of this page. If we make material changes, we will notify account owners by email or through the Service before the changes take effect.

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

• By email: support@referx.app
• By mail: ReferX, 1815 S State St #410, Orem, UT 84097