Privacy and GDPR
Referralmeter is run from Germany and hosted in the EU. This page says exactly what we do and what stays your job. It isn't legal advice, and no certificate called “GDPR compliant” exists, so we don't claim one.
Who is responsible for what
| Whose data | Responsible (controller) | Us |
|---|---|---|
| Your affiliates and your referred customers | You | Processor, under the DPA |
| Your own Referralmeter login and billing | Us | Controller, see the privacy policy |
The DPA is part of our terms, so it applies from your first day with no signature. Need a countersigned copy? Write to privacy@referralmeter.com. Your authority may see the roles in an affiliate setup differently, so ask your lawyer if that matters to you.
What the script stores
| Item | Where | Lifetime | Contents |
|---|---|---|---|
sf_ref cookie | Your own domain, first party | Your attribution window, 60 days by default | Click id, affiliate code, timestamp, AI source if any |
sf_ref localStorage | Your own domain | Same | The same values, a backup when cookies are cleared |
Only visitors who arrive through an affiliate link or from an AI assistant get these. When that happens, the script sends us the page address, the referrer and any sub-ID. Our server adds a country and a salted hash of the IP address, and never stores the IP itself. There is no fingerprinting and no profile across sites.
Without consent mode, the script also asks us for your program's settings on each page view. Our server sees the visitor's IP address for that request and doesn't keep it. To avoid every request before consent, add the tag only after the visitor accepts.
Consent
European guidance (EDPB Guidelines 2/2023) names affiliate tracking links as covered by the cookie rules, and German authorities don't treat a business need as “strictly necessary”. We know of no court ruling on affiliate cookies yet. So if you have visitors in the EU or UK, plan on asking for consent.
Consent mode is built in. Add data-consent="required" to the script tag and, apart from the browser loading the script file from us, it reads nothing, stores nothing and sends nothing until your banner calls referralmeter.consent(). referralmeter.revoke() withdraws it and removes the data from the browser. Setup and banner snippets are in the docs.
The trade-off is real: a visitor who declines isn't tracked, so their click earns nothing. An affiliate's promo code still credits the sale at checkout with no cookie at all, so give affiliates a code as well as a link.
Where the data lives
The app and database run on Hetzner servers in Helsinki, Finland. Encrypted backups stay in the EU. Some services we rely on, such as email delivery and network protection, involve companies outside the EU. Every one is listed, with what it receives, on the sub-processors page, and you get 30 days' notice of changes.
How long we keep it
Retention runs automatically every day. The full table is in the privacy policy: IP hashes go after 6 months, click details after 13 months, and deleted data ages out of backups within 90 days.
When someone asks you to delete their data
- A customer: Settings → Privacy & data → Erase a customer, or
POST /api/v1/customers/erase. - An affiliate: open them under Affiliates → Erase personal data, or
POST /api/v1/affiliates/{id}/erase. - Everything: Settings → Privacy & data lets you export it all and delete the program.
Amounts stay on your books after an erasure, because you must keep them. They no longer point at a person.
Security
- All traffic over TLS. Payout details, tax forms, webhook secrets and integration keys encrypted at rest with AES-256-GCM. API keys and IP addresses stored only as hashes.
- Every query scoped to your program, every billing webhook signature-checked, an activity log of changes.
- We tell you within 48 hours of learning about a breach affecting your data, where possible.
- We hold no SOC 2 or ISO 27001 certificate today.
What stays your job
- Turn on consent mode if you have EU or UK visitors, and connect it to your banner.
- Mention affiliate tracking and Referralmeter in your privacy policy. There's a template in the docs.
- Tell affiliates how you handle their data, in your program terms.
- Answer deletion and access requests, using the tools above.