Privacy Policy — Refgrow

1. Introduction

Refgrow ("we", "us", "our") respects your privacy and is committed to protecting the personal data we collect through our platform. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your data.

2. Data We Collect

Account Data

When you register for Refgrow, we collect your email address and, if you sign in with Google, your Google profile information (name, email, profile picture).

Program Data

We collect data related to your affiliate programs, including project names, tracking domains, commission settings, affiliate details, referral clicks, conversions, and payout information.

Usage Data

We collect information about how you interact with the Service, including pages visited, features used, and session duration.

Tracking Data

Our tracking script and embeddable widget collect referral cookies, click data, and conversion events on your users' behalf. This data is associated with your Refgrow project and processed according to your instructions.

Payment Data

Billing information is processed by Stripe. We do not store full credit card numbers. We store Stripe customer and subscription identifiers for billing management.

3. How We Use Your Data

To provide and maintain the Service
To process affiliate commissions and payouts
To track referrals and attribute conversions
To send transactional emails (account verification, payout notifications, billing updates)
To detect and prevent fraud
To improve the Service through analytics
To provide customer support

4. Data Sharing

We share data with the following categories of third parties:

Payment processors (Stripe, PayPal, Wise) for billing and affiliate payouts
Email service (Resend) for transactional emails
Your payment integrations (Stripe, Paddle, LemonSqueezy, Polar, Dodo Payments) to verify conversion webhooks

We do not sell your personal data to third parties. We do not share your data with advertisers.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, your personal data will be removed within 30 days. Aggregated, anonymized data may be retained indefinitely for analytics.

Conversion and referral data is retained for the lifetime of your project. Payout records are retained for 7 years for tax and legal compliance.

6. Data Security

We implement appropriate technical and organizational measures to protect your data, including encrypted connections (TLS), hashed API keys (bcrypt), HMAC webhook verification, parameterized database queries, and IP-based fraud protection.

7. Cookies

Refgrow uses session cookies to maintain your login state. Our tracking script sets referral cookies on your users' browsers to attribute conversions to affiliates. These cookies are first-party cookies scoped to your domain.

8. Your Rights (GDPR)

If you are in the European Economic Area, you have the right to:

Access the personal data we hold about you
Rectify inaccurate data
Request deletion of your data
Restrict or object to processing
Data portability
Withdraw consent

To exercise any of these rights, contact us at support@refgrow.com.

9. Data Processing Agreement

When you use Refgrow to track your users' referral activity, you act as the data controller and Refgrow acts as the data processor. We process this data only according to your instructions and as described in this Privacy Policy.

10. International Transfers

Your data may be processed in countries outside the European Economic Area. We ensure appropriate safeguards are in place for such transfers.

11. Children

Refgrow is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the Service.

13. Contact

For privacy-related inquiries, contact us at support@refgrow.com.