Privacy policy
Last updated 28 October 2026
What we collect, why, who processes it for us and what you can ask us to do with it.
Who we are
ReferSprout is run by Monty Digital Limited, company number 14388429. Our registered office is 11 Worboys Road, Worcester, WR2 4JJ, United Kingdom. Our VAT number is GB437112617. Questions about this policy go to [email protected].
We are the controller for data about people who visit this site or hold a ReferSprout account. For data about a merchant's own customers, the merchant is the controller and we process it on their instructions.
What we collect
- Account details. Your name, email address and the business you sign up for. You sign in with an emailed code, so there is no password to store.
- Billing. Stripe holds your card details. We keep your Stripe customer ID, plan and payment status.
- Your Stripe account. When you connect the Stripe App we store your Stripe account ID. We read customers, subscriptions and invoices to run your programme. We don't copy your whole customer list.
- Referral records. For your customers who refer or are referred: Stripe customer IDs, email address where they use the hosted page, referral codes, qualifying payments and rewards issued.
- Programme participation. Customer eligibility and participation status, moments you report, asks shown, copies, dismissals and referral visits. These records run your ask rules and participation reports.
- Site and product usage. Pages viewed, referring site, browser and device type, and actions in the dashboard. See analytics below.
- Messages. Anything you send us by email.
Why we use it
- To provide the service you signed up for, including billing (contract).
- To run referral programmes for merchants, on their instructions (processor).
- To keep the service secure and prevent fraud, such as self-referrals (legitimate interests).
- To understand how the site and product are used so we can improve them (legitimate interests).
- To send product updates or a newsletter, only if you opt in (consent).
- To meet tax and accounting duties (legal obligation).
Who processes it for us
We use these providers to run ReferSprout. Stripe also acts as an independent controller for some payment processing under its own terms. Our data processing terms cover the data we handle on a merchant's instructions.
| Processor | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | Project region: Ireland (eu-west-1) |
| Stripe | Our own subscription billing, and the Stripe App that reads and rewards on your Stripe account | US and EU |
| PostHog | Website analytics and product usage events | EU (eu.i.posthog.com) |
| Brevo | Account, sign-in and referral access emails, and our newsletter if you join it | EU (France, Germany and Belgium) |
| Vercel | Hosting and background jobs | Functions: Dublin, Ireland (dub1); global CDN |
| Google Workspace | Support email correspondence | Global |
Transfers from the UK to the EEA are covered by UK adequacy regulations. Where a provider processes data elsewhere, we use applicable adequacy decisions or contractual safeguards, including standard contractual clauses with the UK International Data Transfer Addendum where required. The hosting regions above do not mean all support access, delivery or onward processing stays in those regions.
The providers describe their transfer safeguards in their terms: Supabase, Vercel, PostHog, Stripe and Google Workspace. Brevo's data processing terms cover its EU hosting; [confirm safeguards for any Brevo onward transfers outside the UK or EEA]. You can ask us for information about the safeguards that apply to your data.
Analytics and cookies
We use PostHog in cookieless mode on this site. It doesn't set cookies or store anything in your browser. PostHog counts website visitors with a hash that changes daily rather than a persistent cookie identifier. Product events use internal account and record identifiers, not customer contact details or raw Stripe identifiers. We also use PostHog for error diagnostics. Session recording is off.
Signing in to ReferSprout sets cookies that keep you signed in. They are strictly necessary and expire when you sign out.
If you're a merchant's customer
If you reached a referral page through a business that uses ReferSprout, that business decides how your data is used. We only email you to confirm your address when you ask for your referral link. For anything else, contact the business directly. We'll pass on any request we receive.
How long we keep it
- Account and referral records: while your account is open, then deleted within 30 days of account closure.
- Billing records: six years, for tax.
- Analytics events: available for analysis in PostHog for seven years. Requests to delete this data are handled separately.
Your rights
You can ask to see, correct, delete or export your data, object to how we use it, or withdraw consent. Email [email protected] and we'll reply within a month.
You can also complain to the UK Information Commissioner's Office at ico.org.uk.
Changes
We'll update the date at the top when this policy changes, and email account holders about significant changes.