Privacy Policy

Last updated: 28 September 2026

This policy explains what personal information ReferralCodes.com collects, why, who we share it with, how long we keep it and the rights you have. It applies to ReferralCodes.com and its apps, our WhatsApp service, our browser extension and our connector for AI assistants. It should be read alongside our Terms.

1. Who we are
2. Information we collect
3. How we use it and our lawful bases
4. What other people can see
5. Automated moderation and AI tools
6. AI assistants and connected apps
7. Cookies and similar technologies
8. Who we share information with
9. International transfers
10. How long we keep information
11. Your rights
12. Emails and how to unsubscribe
13. Children
14. Security
15. Complaints
16. Changes to this policy

1. Who we are

ReferralCodes and ReferralCodes.com are trading names of Referral Ventures Limited (UK company number 13281997), whose registered office is at 205 Lavender Hill, London SW11 5TB, United Kingdom (“ReferralCodes”, “we”, “us”). We are the controller of the personal information described in this policy.

We are registered with the Information Commissioner’s Office (ICO). Registration number: ZB805802.

For any privacy question or request, email info@referralcodes.com.

Referral Ventures Limited also operates ReferralLinks, a separate product for businesses. ReferralLinks has its own privacy notice, which applies instead of this policy when you use ReferralLinks.

2. Information we collect

Information you give us

• Account details: first name, optional last name, username, email address and password (we store only a secure hash of your password, never the password itself).
• Profile details you choose to add: profile photo and cover image, “about” text, country of residence and flags, social media handles and links, and optional details such as gender and age range.
• Content you post: referral codes and links (and the rewards, descriptions and terms you add), brand reviews, votes, “thanks” and other reactions, reports about referrals, saved favourites (including notes and any location you add), recommendations and messages you send us.
• Your network: the members you follow and who follow you.
• Invitations: if you invite a friend by email, we collect their email address (see “Invitations” below).
• WhatsApp and app submissions: if you link WhatsApp, your phone number and a verification code; the messages, links, images and voice notes you send us through WhatsApp or our app.
• Payments: when you buy RC Premium or a Boost, make a donation or pay an invoice, we receive your subscription and payment status, amounts and Stripe customer and subscription references. Card details are collected by Stripe, not by us.
• Cashback and payouts: your reward preferences and payout details, such as your PayPal email address or the other payout method you choose.
• Forms and enquiries: details you send through our contact, partnership, moderator, ambassador and data-feed forms.

Information from your use of ReferralCodes

• Activity: logins and how you signed up, the referrals and profiles you view while signed in, clicks on referral and shop links, daily and weekly activity streaks, leaderboard and “power score” calculations, and whether you have installed our browser extension.
• Cashback clicks: when you click through to a shop that pays commission, we create a click record (who clicked, whose referral or recommendation it was, the shop and network) and later receive transaction details from the affiliate network, such as order date, order value and commission.
• Technical information: IP address, browser and device information, and the cookies described below. Our servers keep standard logs for security and troubleshooting.
• Email information: delivery information from our email provider and, for some emails we send, whether you opened them.

Information from others

• Google or Facebook sign-in: if you sign up or log in with Google or Facebook, we receive your name, email address and account identifier from that service.
• Other members: a member may invite you by email, follow you, mention your referral or report content.
• Affiliate networks: Awin, Skimlinks, Digidip and FlexOffers tell us about purchases linked to our click references so that we can track commission and cashback.
• Payment providers: Stripe tells us whether payments and subscriptions succeed, fail or are cancelled.
• AI assistants you connect: when you connect an AI assistant (see section 6), it sends us your requests, such as searches and referrals you ask it to add.

Invitations

When a member invites a friend by email, we create a placeholder account for the invited person containing only their email address, the member who invited them and an “awaiting confirmation” status. We send one invitation email and record that the two people follow each other so that the connection is in place if the invitation is accepted. If you received an invitation and do not want to join, email info@referralcodes.com and we will delete the placeholder account.

3. How we use information and our lawful bases

UK data protection law requires a lawful basis for each use of personal information. The main ones we rely on are: contract (to provide the service you signed up for), legitimate interests (our reasonable business interests, balanced against your rights), consent (which you can withdraw at any time) and legal obligation.

Where we rely on consent, for example for optional features you switch on, you can withdraw it at any time. This will not affect anything we did before you withdrew it.

4. What other people can see

ReferralCodes is a public community. Search engines and other visitors, including people who are not signed in, can see:

• your username (which forms your profile address, for example referralcodes.com/yourname), first name, profile photo and cover image;
• your “about” text, country flags, and any social media handles and links you add;
• your active referral codes and links, reviews, recommendations and badges (for example Premium, Moderator or boosted referrals), and your position on leaderboards;
• your followers and the members you follow, and your saved favourites, unless you make these private in your settings.

Your last name, email address, phone number, payment and payout details are not shown publicly. When you are signed in and view another member’s profile or referrals, that member may be able to see that you viewed them. Premium members can choose to view profiles anonymously.

Public referral codes and links, with the brand and reward details, may also be made available to partners and developers through our data feed, APIs and AI assistant connector. These do not include your email address or other contact details. Where our AI assistant connector shows who shared a referral, it uses your first name and the initial of your last name.

5. Automated moderation and AI tools

Referral moderation. New referrals are checked before they go live. Some are approved or removed automatically using fixed rules, for example: whether the link matches the brand’s website, whether it duplicates a referral you already have, whether it contains blocked words, and, for some submission sources, your account’s activity score. Referrals that do not clearly pass or fail these rules are left for a person to review. An automatic decision only affects whether a particular referral is published; it does not affect your account. If you think one of your referrals was removed wrongly, email info@referralcodes.com and a person will review it.

AI processing of submissions. When you send us a voice note, image, message or link through WhatsApp or our app, we use OpenAI’s services to transcribe voice notes and to identify the brand or place and the details to save. Images and voice notes sent through WhatsApp are analysed in memory and not kept after analysis. Files sent through our app are stored on our servers only while they are processed: images are deleted once they have been analysed, and voice recordings once they have been transcribed (we keep the transcript). Any app upload left behind, for example because processing failed, is deleted automatically after 7 days. The results can be wrong, so you can edit or delete anything saved this way.

6. AI assistants and connected apps

You can connect third-party AI assistants (for example Muse) to ReferralCodes through our connector. Anyone can use an assistant to search public referrals without an account. To do more, you sign in on a ReferralCodes consent screen that shows exactly what the assistant is asking to do. The permissions are:

• Search and view referral offers (referrals:read);
• See referral offers shared by people you follow (contacts:read): the assistant can see the public referrals of members you follow on ReferralCodes, with their display name and username. “Contacts” means only people you follow on ReferralCodes; we never read your address book, emails or other accounts;
• Add referral codes to your profile (referrals:write): referrals added this way are reviewed before they are published, like any other submission, and you can edit or remove them. The connector never edits or deletes your existing referrals.

A connected assistant never sees your password or email address. Access tokens last 60 minutes and refresh tokens 30 days. You can disconnect an assistant at any time from Profile > Connected apps, which revokes its access immediately.

What we record. For each request an assistant makes, we keep a record of the tool used, the app, whether you were signed in, the outcome, the brand and category, up to 100 characters of public search text and the number of results. We do not record searches about people you follow, access tokens or passwords in these records, and we delete them after 90 days. When an assistant asks for a referral link, we create a ReferralCodes.com redirect link so that the member who shared the referral gets credit; it stops working after 30 days and we count clicks on it.

The assistant’s own policy. Information we send to an AI assistant, and anything you tell the assistant, is handled by the company that provides the assistant under its own privacy policy. We do not control how it uses that information.

7. Cookies and similar technologies

Cookies are small files stored by your browser. Essential cookies are needed to run the site, keep it secure and remember your choices, so they are always set. Analytics cookies are optional: when you first visit, our cookie banner asks whether you accept Google Analytics cookies, with equally prominent “Accept” and “Reject” buttons. Google Analytics is only loaded, and its cookies only set, if you click “Accept”. If you click “Reject” or do not make a choice, it is not loaded.

You can change your choice at any time using the “Cookie settings” link at the bottom of every page, or open Cookie settings now. If you withdraw your consent, we stop loading Google Analytics and delete the Google Analytics cookies set on our domain.

We use the following cookies:

When you click through to a shop, the affiliate network’s tracking link may set its own cookies to record that the visit came from ReferralCodes; these are controlled by the network and the shop. Our pages also load fonts and scripts from content delivery networks (Google Fonts, cdnjs and jsDelivr), which receive your IP address when your browser requests them.

You can also block or delete cookies in your browser settings; blocking essential cookies will stop sign-in and some features from working. The API endpoints used by AI assistants do not use cookies.

8. Who we share information with

We do not sell your personal information. We share it only as described in this policy, with:

• Service providers who process it for us:
  • Amazon Web Services: hosting, databases and file storage, including profile images;
  • Cloudflare: website delivery and security;
  • Mailgun: sending emails;
  • Twilio: sending and receiving WhatsApp messages;
  • OpenAI: transcribing voice notes and analysing submitted messages, images and links (see section 5);
  • Google: Google Analytics (only if you accept analytics cookies), reCAPTCHA and Google Fonts;
  • Geoapify: suggesting place names when you add a location to a saved favourite (only the text you type is sent).
• Companies that act as independent controllers under their own privacy policies:
  • Stripe: payments, subscriptions and fraud prevention;
  • PayPal: payouts, if you choose to be paid by PayPal;
  • Google and Meta (Facebook): if you sign in with them;
  • affiliate networks Awin, Skimlinks, Digidip and FlexOffers, and the shops they work with: when you click a tracked shop link we pass a click reference number (not your name or email) so that purchases can be matched to the click;
  • AI assistants you choose to connect (see section 6).
• Other members and the public: the information described in section 4.
• Professional advisers, such as lawyers and accountants.
• Authorities and others where required by law, or to protect our rights, our members or the public.
• A buyer or successor if our business, or part of it, is sold or reorganised; they would have to use your information in line with this policy.

9. International transfers

Some of our service providers, including several based in the United States, process personal information outside the UK. When information is transferred to a country without UK “adequacy” regulations, we rely on a recognised safeguard, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the recipient is certified. You can ask us for more information about the safeguards for a particular transfer.

10. How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy. In particular:

• Account and profile information is kept while your account is open. See “Deleting your account” below for what happens when you close it.
• Payment, invoice, cashback and payout records are kept for as long as UK accounting and tax law requires.
• AI assistant tool-call records are deleted after 90 days. Expired and revoked access tokens are purged regularly.
• WhatsApp and app submissions: images, voice notes and voice recordings sent through WhatsApp or our app are not kept after processing, as described in section 5; any app upload left behind is deleted automatically after 7 days. The text of your messages, voice-note transcripts and what was saved from them are kept with your account so that you can see and manage your saves.
• Debugging logs that may include request details are deleted routinely, usually within about a month.
• Placeholder accounts for unanswered invitations are kept so that the same person is not invited repeatedly, and deleted on request.
• Records needed for disputes, legal claims, fraud prevention or enforcing our Terms (for example after an account is banned) are kept for as long as reasonably necessary for that purpose.

11. Your rights

Under UK data protection law you have the right to:

• access the personal information we hold about you and receive a copy;
• rectification: have inaccurate information corrected (you can edit most of it yourself in your profile);
• erasure: ask us to delete your information;
• restriction: ask us to limit how we use your information;
• data portability: receive information you gave us in a machine-readable format, or have it sent to another organisation;
• object to our use of your information based on legitimate interests, and to direct marketing at any time;
• withdraw consent where we rely on it;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects, and to ask for a person to review an automated decision, such as the removal of a referral (see section 5).

To use any of these rights, email info@referralcodes.com. We may need to confirm your identity. We will respond within one month, or tell you if we need longer because the request is complex. There is normally no fee.

Deleting your account. You can permanently delete your account in the Settings section of your profile. This deletes your referrals, removes your profile from the site and replaces your email address so that it can no longer be used to contact you or sign in. We keep limited records afterwards where we need to, for example payment and payout records and information needed to prevent abuse. If you want us to erase anything else, email us.

12. Emails and how to unsubscribe

Members may receive our newsletter and site news, no more than twice a month, and notifications about activity on their account, such as new followers, new referrals and referral approvals. You can unsubscribe from the newsletter using the link in any newsletter email, and switch notifications on or off in the Settings section of your account. We will still send essential service emails, such as password resets and payment receipts.

13. Children

ReferralCodes is not available to anyone under the age of 12, as set out in our Terms. We do not knowingly collect information from children under 12. If you believe a child under 12 has created an account, contact us and we will delete it.

14. Security

We use appropriate technical and organisational measures to protect personal information, including encryption in transit (HTTPS), hashed passwords, restricted access to production systems, time-limited access tokens for connected apps, rate limiting and monitoring. No online service can be completely secure, so please use a strong, unique password and tell us straight away if you think your account has been compromised.

15. Complaints

If you have a concern about how we use your information, please contact us first at info@referralcodes.com so that we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk, telephone 0303 123 1113.

16. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new “last updated” date and, if the changes are significant, tell members by email or on the site.