Privacy

Last updated 3 November 2026. Short version: we collect what we need to run affiliate programs, we never sell data, and the data your affiliates and customers generate belongs to you, the merchant. We process it only on your instructions.

Who we are

Referralmeter is operated by Loistava Holding UG (haftungsbeschränkt), Asternring 9, 15732 Schulzendorf, Germany (see the legal notice). Privacy questions: privacy@referralmeter.com.

Two roles: controller and processor

• We are the controller for our own website, for the accounts of merchants who sign up for Referralmeter, and for our billing.
• The merchant is the controller for the data of their affiliates, the customers those affiliates refer, and the creators the Recruiting Agent researches for them. Referralmeter processes that data as their processor under our data processing agreement. If you are an affiliate or a customer of one of our merchants, the merchant's own privacy notice applies, and requests about your data are best sent to them. We help them answer.

What we collect as controller, and why

• Merchant accounts: name, email, password (stored hashed) or Google sign-in, and the programs you create. Legal basis: contract (Art. 6(1)(b) GDPR).
• Billing: handled by Stripe. We store your Stripe customer and subscription IDs, your plan and its status. We never see or store card numbers. Legal basis: contract; invoices are kept as tax law requires (Art. 6(1)(c)).
• Security and abuse prevention: a salted hash of IP addresses for rate limits, and an audit log of changes made in your account. Legal basis: legitimate interest in a secure service (Art. 6(1)(f)).
• Account emails: confirmation, password reset, and a few short emails that help you finish setup (install, verification, first affiliate). Each has an unsubscribe link, and we log only which email was sent and when, never its content. Legal basis: contract and legitimate interest; you can opt out of the setup emails at any time.

What we process for merchants (as processor)

• Affiliates: name, email, referral code, status, website and promotion plan, payout method and payout details, tax forms (W-9/W-8), and a hash of the last login IP for self-referral checks. Payout details and tax forms are encrypted at rest.
• Referral tracking: for each affiliate click, the landing page, the referring website's host name, the country, and a salted IP hash. For referred customers: email, the merchant's customer ID, the billing provider's customer ID, and payment amounts, refunds and dates from the billing provider's webhooks.
• Recruiting Agent research: publicly available information about creators who cover the merchant's category, such as a channel or newsletter name, its URL, audience description, public business contact, and links to the content that makes them a fit. If you are a creator and want us to delete what we hold about you, write to privacy@referralmeter.com.

The tracking script runs on the merchant's own website, and the merchant decides whether and how to use it and informs their visitors. Merchants who connect a billing provider give us a restricted key or a webhook secret, which we store encrypted.

Analytics on our website

Basic, cookieless reach measurement (always on): we count page views and unique visits with PostHog (EU-hosted) without storing anything on your device: no cookies, no local storage, no persistent identifier, no session recording. Legal basis: our legitimate interest in knowing how the site is used (Art. 6(1)(f) GDPR); because nothing is stored on your device, § 25 TDDDG does not apply.

Persistent analytics (only if you click “Accept”): PostHog may then store an identifier in a cookie and local storage to recognize you across visits, connect your visits to your account and record sessions so we can improve the product. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time by deleting the “sfl_consent” cookie, after which we ask again. If you click “Decline”, we stop analytics entirely.

Who processes data for us

• Hetzner Online (Germany): servers and database.
• Cloudflare: content delivery, DNS and protection against attacks.
• Resend: sending email (account emails, and affiliate emails sent on a merchant's behalf).
• Stripe: payments for Referralmeter plans.
• PostHog (EU Cloud): website analytics, as described above.
• OpenAI: research and drafting for the Recruiting Agent. We send the merchant's product description and category and public web results; we never send affiliate or customer personal data. Data sent through OpenAI's API is not used to train their models.
• Google: optional “Sign in with Google”, only if you choose it.

Where a provider processes data outside the EU (Cloudflare, Resend, Stripe, OpenAI, Google), the transfer is covered by the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.

How long we keep it

Account and program data are kept until you delete them or your account. Rate-limit records are deleted after two days. Billing records are kept as long as tax law requires (in Germany, up to ten years). When a merchant deletes a program, the affiliate, referral and commission data in it is deleted with it.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and to withdraw consent at any time. Write to privacy@referralmeter.com. You can also complain to a data protection authority, for example the one where you live.

Cookies

Without your consent we use only strictly necessary cookies: your login session, the program you last opened in the dashboard, an affiliate's portal session, and the cookie that remembers your analytics choice. Analytics cookies are set only after you click “Accept”. No advertising or cross-site tracking cookies.