Privacy Policy

We collect only what a feature needs. Depending on how you use Refnivo, that may include:

• Account information — name, email address, optional phone number, your role (brand, creator or customer) and a hashed password. If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password.
• Profile information — brand details (name, logo, website, category, description), creator profile details (display name, username, bio, category, self-reported audience numbers) and anything else you choose to publish.
• Campaign and product information — products, offers, commission and reward rules, campaign dates and rules you create.
• Referral and transaction information — referral links and codes, link clicks and QR scans (recorded against a randomly generated visitor identifier stored in a cookie, with the IP address stored only as a salted hash, never in raw form), order confirmations, order references and values, commissions, rewards and payout requests.
• Order-confirmation details — when a customer confirms an order, the email or phone used for that order is stored as a salted hash plus a masked version (for example ar•••@example.com) so the brand can match the order without receiving the full contact details.
• Device and usage information — browser user agent and referring page for link clicks, and basic server logs needed to operate and secure the service.
• Information you provide voluntarily — messages you send us, campaign applications, notes on orders and support requests.

We do not ask for card numbers or bank credentials on Refnivo, and no payment processor is connected to the platform at this time.

• Create and manage accounts, and keep you signed in.
• Provide the platform: campaigns, referral links, QR codes, dashboards and the ledger.
• Facilitate collaboration between brands and creators, including applications and approvals.
• Track referrals, order confirmations and campaign performance, and attribute them to the right partner.
• Calculate and settle commissions, rewards and payout requests.
• Communicate with you — service emails and in-app notifications about applications, orders, payouts and account changes.
• Improve the platform and understand which features are used.
• Maintain security: rate limiting, session protection and abuse detection.
• Prevent fraud and abuse, such as self-referrals and duplicate order claims.
• Comply with applicable legal requirements and resolve disputes.

We do not sell personal information. We share it only where it is needed to run the platform:

• With other users, where the feature requires it — a brand sees the profile and self-reported audience details of creators who apply to its campaigns, and the masked contact plus order number on an order confirmation. Partners see the brand and campaign they joined. Public profile pages are visible to anyone.
• With service providers that operate parts of the platform on our behalf (see Third-party services).
• With payment providers, if and when online payments are enabled. Payouts are currently arranged by our team outside the platform, and this section will be updated before that changes.
• With authorities or advisers where we are legally required to, or where it is necessary to establish, exercise or defend legal claims.
• In a business transfer — if the business or its assets are acquired or reorganised, information may transfer as part of that transaction.

Refnivo uses a small number of first-party cookies. We do not run third-party advertising or analytics trackers on the site.

• Necessary — session. A sign-in cookie that keeps you authenticated and lets us end every session if a password changes.
• Necessary — referral attribution. A randomly generated visitor identifier and a last-click referral cookie, so a referral can be credited to the right partner. The referral cookie expires after the campaign’s attribution window (30 days by default); the visitor identifier lasts up to a year.
• Necessary — sign-up flow. A short-lived cookie that remembers which role you chose when signing in with Google (10 minutes).

You can clear or block cookies in your browser. Blocking the session cookie will prevent you from signing in; blocking the referral cookies means a purchase may not be credited to the person who referred you.

We use reasonable technical and organisational measures to protect information: passwords are stored only as bcrypt hashes, traffic is served over HTTPS, IP addresses and order contacts are stored as salted hashes, dashboards are protected by role-based access checks, sensitive actions are rate limited, and changes to money are written to an audit log.

No online service can be completely secure, and we cannot guarantee that unauthorised access will never occur. Please use a strong, unique password.

We keep information for as long as it is needed to provide the service, and afterwards where we must retain records to resolve disputes, enforce our agreements, prevent abuse or comply with legal obligations.

Referral, order and payout records are financial history for both sides of a campaign, so they are retained after an account is closed — attached to an anonymised account rather than to your personal details (see Account deletion).

Depending on where you live and which laws apply to you, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Request deletion of your personal information.
• Request a copy of information you provided to us.
• Manage communication preferences — email notifications can be turned off in your dashboard settings at any time.
• Withdraw consent where our use of information relies on consent.

Not every right applies in every jurisdiction, and some requests are limited by records we must keep. You can exercise most of these directly from your dashboard, or write to us at refnivo45@gmail.com.

You can delete your account yourself: sign in and open Dashboard → Settings → Delete account. You will be asked to confirm, and to re-enter your password if your account has one.

What deletion does:

• Removed: your name, email address, phone number, profile photo, password, Google link, notifications, queued emails and your public creator profile. Your email address is freed, so you can register again later.
• Kept, attached to an anonymised account: referrals, confirmed orders, commissions, rewards, payout requests and audit records, because the other side of each transaction — a brand’s ledger or a partner’s earnings — must not change when one party leaves.
• If you own a brand, its campaigns are ended and referral links disabled. An open payout request must be settled or cancelled before deletion.

If you cannot sign in, contact us at refnivo45@gmail.com and we will verify your identity before acting on the request.

Refnivo is built for businesses and adults, and is not directed at children. We do not knowingly collect personal information from children where that is prohibited by applicable law. If you believe a child has provided us with personal information, contact us and we will review and remove it where required.

We rely on a small number of providers to run the platform. Each processes only what its function requires:

• Vercel — application hosting and delivery.
• Supabase — database and file storage for uploaded images.
• Google — optional “Sign in with Google” authentication, when you choose it.
• Resend — delivery of service emails such as verification, notifications and payout updates.
• Upstash — rate limiting, which processes a hashed identifier for abuse protection.

We do not currently use third-party analytics, advertising or AI providers, and no payment processor is connected. If that changes, this section will be updated before the provider goes live.

We may update this Privacy Policy from time to time — for example when we add a feature or a provider. The latest version is always published on this page with an updated “last updated” date, and we will give notice of significant changes where required.

Questions about your privacy?