Privacy Policy
Last updated · Edition 2
Last updated: 2026-10-21
This Policy explains what personal data Referally processes and why. It covers our own account holders (merchants, their team members, and partners), readers of our documentation and community, and end users whose referral events flow through the platform.
Data we process
Account data: your name and email address, the organizations you belong to, and your role in each. We do not store passwords: you sign in through Atlas, our authentication provider (including “Sign in with Atlas”), which handles your password and passkeys and tells us your verified email and name. We store your account and session records, and partner two-factor (TOTP) settings where you turn them on.
Attribution data: clicks, referral tokens, coupon codes, hashed email identifiers, device and campaign context, and conversion events reported by a merchant’s billing provider or integration, used to credit partners.
Financial data: commission ledgers, payout profiles (the payout method and the account identifier you give us, such as a PayPal email or Wise recipient ID), and tax form data partners submit (name, address, and tax ID or country).
Community and docs data: if you sign in to our docs or community, your name and email are passed to our hosting provider so it can show who you are; posts, replies, and reactions you publish there are visible to other readers.
Usage and device data: IP address, user agent, request metadata, and logs used for security, fraud prevention, and reliability.
Why we process it
To provide the Service (attribution, commissions, payouts), secure it (sign-in, fraud detection, rate limiting), meet legal obligations (tax reporting, anti-fraud), and keep it reliable. For end-user attribution data, the merchant is the controller and Referally is a processor acting on its instructions; see our Data Processing Addendum.
Cookies and similar technologies
We use only the cookies needed to run the Service, plus analytics if you consent in the cookie banner.
Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
| Referally | Keeps you signed in to the app | 30 days |
| Referally | Protects the sign-in handshake with Atlas | 10 minutes |
| Forumulate, on our site | Keeps you signed in to the docs and community | 30 days |
| Forumulate, on our site | Counts visits to the docs without identifying you | 12 hours |
| A merchant’s site, using our tracking script | Remembers which partner referred a visitor so the referral is credited (also kept in that site’s local storage) | Up to 400 days |
Atlas sets its own cookies on its sign-in pages; its policy governs them. The referally_ctx cookie lives on the merchant’s website, and the merchant is responsible for any consent it needs there.
Who we share it with
We do not sell personal data. We share it only with service providers that help us run the Service, under contractual data-protection terms and only as needed:
Provider | What it does | Data involved |
|---|---|---|
Atlas | Sign-in, passwords, passkeys, “Sign in with Atlas” | Email, name, sign-in events |
Forumulate | Hosts our docs, guides, legal pages, status page, community, and blog | Reader name and email when signed in, community posts, visit logs |
Our cloud hosting provider | Runs the servers and database the Service uses | All data stored in the Service |
Email delivery provider | Sends sign-in, payout, and notification emails | Recipient email and message content |
Some providers are connected by the merchant with the merchant’s own account, not by us: billing providers that report conversions, payout providers that pay partners (such as PayPal, Wise, Stripe, Payoneer, Tremendous, or a crypto wallet), and any AI provider a merchant enables. When a partner is paid, we send the payout provider the amount and the payout details the partner gave us. Those providers act for the merchant, under the merchant’s agreement with them.
Retention
We keep data while your account is active and as long as legal, tax, and dispute obligations require. Financial ledgers are append-only and kept for statutory periods. Logs are kept for a limited period for security and then deleted.
Your rights
Subject to law, you may access, correct, export, or delete your personal data, and object to or restrict some processing. The platform supports data-subject export and erasure; erasure pseudonymizes your identity while keeping the financial ledger intact, as the law requires. If you are an end user of a merchant, contact that merchant first, since it controls your data. You may also complain to your local data-protection authority.
International transfers and security
Our providers may process data in other countries; where data crosses borders we rely on appropriate safeguards such as Standard Contractual Clauses. We use encryption in transit, tenant isolation at the database level, least-privilege access, audit logging, and secret redaction in logs. No method is perfectly secure, but we work to protect your data and will notify you of material breaches as the law requires.
Changes
We may update this Policy. We will change the date above and, for material changes, notify account holders.
Contact
For privacy questions or requests, message the Referally team privately through the community (do not post personal data in a public thread), or ask your merchant’s program contact if you are a partner or end user. We will reply within the time the law requires.
This document is a template provided for completeness. Have it reviewed by qualified counsel for your jurisdiction before relying on it.