Run your program

Privacy and consent

Consent mode, cookie banner snippets, privacy policy text for your site, and erasure requests.

The overview for founders is on Privacy and GDPR. This page is the setup. It isn't legal advice.

What the script stores

A first-party cookie and a localStorage entry, both named sf_ref, on your own domain, for your attribution window (60 days by default). They hold a click id, the affiliate code, a timestamp and an AI source if any. Only visitors from an affiliate link or an AI assistant get them.

Add data-consent="required". Until you call referralmeter.consent(), the script reads nothing, stores nothing and makes no request, apart from the browser loading the script file from us. To avoid even that, add the tag only after the visitor accepts. The referral in the URL is still there when consent arrives on the same page, so a visitor who accepts straight away is credited.

<script src="https://referralmeter.com/t.js" data-key="pk_…" data-consent="required" async></script>

Call	When
`referralmeter.consent()`	The visitor accepted
`referralmeter.revoke()`	The visitor withdrew: stops tracking and removes the cookie and localStorage entry

Call consent() on every page load for a visitor who accepted earlier. Your banner remembers that choice; we don't.

Any banner works, because all it has to do is call one function. Paste the stub from the tracking script page above the tag if your banner can fire first.

Cookiebot:

<script>
  window.addEventListener("CookiebotOnConsentReady", function () {
    if (Cookiebot.consent.marketing) window.referralmeter?.consent();
    else window.referralmeter?.revoke();
  });
</script>

CookieYes:

<script>
  document.addEventListener("cookieyes_consent_update", function (e) {
    if (e.detail.accepted.includes("marketing")) window.referralmeter?.consent();
    else window.referralmeter?.revoke();
  });
</script>

Your own banner:

acceptButton.onclick = () => { saveChoice("yes"); window.referralmeter?.consent(); };
declineButton.onclick = () => { saveChoice("no"); window.referralmeter?.revoke(); };
if (loadChoice() === "yes") window.referralmeter?.consent();

List it as marketing, not as strictly necessary.

Visitors who decline

They aren't tracked, so their click earns nothing. Promo codes still work: a sale using an affiliate's code is credited at checkout, with no cookie. Give affiliates a code as well as a link.

Text for your privacy policy

Adapt this with your lawyer.

Affiliate program. We run an affiliate program using Referralmeter, a service of Loistava Holding UG (haftungsbeschränkt), Germany, which processes data for us under a data processing agreement. If you reach our site through a partner's link or an AI assistant and agree to marketing cookies, we store a cookie and a local storage entry (sf_ref) for our attribution window, and send the page address, referrer and a hashed IP address to Referralmeter. If you then sign up or buy, we share your email or user id and the payment amount so we can credit and pay that partner. Legal basis: your consent (Art. 6(1)(a) GDPR) for the cookie, and our legitimate interest in paying partners correctly (Art. 6(1)(f) GDPR) for the rest. You can withdraw consent at any time in our cookie settings. Some service providers involved are outside the EU; transfers rely on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

Deletion requests

curl -X POST https://referralmeter.com/api/v1/customers/erase \
  -H "Authorization: Bearer $REFERRALMETER_SECRET_KEY" \
  -H "content-type: application/json" \
  -d '{"email":"customer@example.com"}'

The key needs the payouts scope, which an owner creates in Settings. Or, as the owner, use Settings → Privacy & data. For an affiliate, use their page or POST /api/v1/affiliates/{id}/erase. Amounts stay on your books; they no longer point at a person. Later payments from an erased customer earn no commission.

Testing on a preview site

Verification normally opens your program's website. To run it elsewhere, enter the address on the Install page, or send {"test_url":"https://your-preview.example"} when you start it. The certificate names the address it tested. Use a preview with no real visitors, and run it again on your real domain before launch.