Privacy Policy

Effective February 19, 2026

1. Who We Are

RefStack (“RefStack”, “we”, “us”, “our”) provides affiliate and referral program management software for SaaS companies. This Privacy Policy describes how we collect, use, and protect information when you use our platform at refstack.io (“the Service”).

2. Information We Collect

Account Information

When you register as a tenant (SaaS company) or affiliate, we collect your name and email address. Tenants additionally provide a company name and website domain for CORS and attribution configuration.

Tracking Data

To operate the affiliate attribution system, we collect: IP addresses (for fraud detection and geolocation), browser user-agent strings, referral codes, click timestamps, and UTM parameters. Customer email addresses submitted through conversion events are hashed (SHA-256) and never stored in plain text.

Usage and Analytics

We use two analytics tools: PostHog for product analytics (anonymized page views, feature usage, session data, and error tracking) and Plausible Analytics for privacy-friendly website traffic measurement (cookieless, no personal data stored, GDPR-compliant by design). Both help us understand how the Service is used and improve it.

3. How We Use Your Information

  • Providing and operating the Service (authentication, attribution, commission calculation)
  • Detecting and preventing fraud (duplicate clicks, self-referrals, conversion anomalies)
  • Sending transactional emails (affiliate approval/rejection notifications via Resend)
  • Improving the Service through anonymized usage analytics
  • Responding to support requests and legal obligations

We do not sell your data or use it for advertising.

4. Data Sharing and Sub-Processors

We share data only with the sub-processors required to operate the Service. Each is contractually bound to appropriate data protection standards. See our Sub-Processors page for the full list.

We do not share your data with third parties for marketing purposes, and we do not sell personal data.

5. Cookies

We use cookies for authentication (Supabase session cookies), affiliate attribution (a 30-day httpOnly tracking cookie), and analytics (PostHog). See our Cookie Policy for details.

6. Data Retention

  • Account data: retained until account deletion
  • Click and conversion records: retained for 3 years for commission and audit purposes
  • Email logs: retained for 90 days
  • Server logs: retained for 90 days

You may request deletion of your account and associated personal data at any time by emailing privacy@refstack.io.

7. Your Rights

You have the right to:

  • Access: request a copy of the personal data we hold about you
  • Correction: request that inaccurate data be corrected
  • Deletion: request that your data be deleted (“right to be forgotten”)
  • Portability: request your data in a machine-readable format

To exercise any of these rights, email privacy@refstack.io. We will respond within 30 days.

8. Security

We implement industry-standard security measures including HTTPS, encryption at rest, row-level database security, API key authentication, and rate limiting. See our Security page for details.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the effective date and, where appropriate, notifying registered users by email. Continued use of the Service after changes constitutes acceptance of the updated policy.

10. Contact

For privacy-related questions or to exercise your rights, contact us at privacy@refstack.io.