Privacy Policy
Last updated: October 8, 2026
Introduction
RefRef is operated by Exa Labs LLC (“we,” “our,” or “us”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.
Information We Collect
We collect information that you provide directly to us, including:
- Name and contact information (email address, phone number)
- Company information
- Messages you send through our contact forms
- Usage data and analytics
How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our services
- Respond to your comments, questions, and requests
- Send you technical notices and support messages
- Communicate with you about products, services, and events
- Monitor and analyze trends, usage, and activities
Information Sharing
We use service providers to host and operate RefRef, process Workspace payments, and deliver service communications. Connected stores receive the referral and coupon information needed to operate their Programs. We may also disclose information when required by law. We do not sell personal information.
Data Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.
Your Rights
You have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information
- Object to processing of your personal information
- Request restriction of processing your personal information
Shopify Referral Data
When a merchant installs RefRef, we process store and shopper data to operate the merchant's referral Program. This includes store and installation identifiers, connection credentials, customer identifiers, names and email addresses, order and refund identifiers, amounts, currency, timestamps, purchase history, referral activity, discounts, and reward records. We use this data to attribute referrals, check eligibility, prevent duplicate rewards, and provide discounts and store credit. We also process app subscription records to manage the merchant's RefRef plan.
Referral tracking uses cookies and checkout events to connect a referral visit with a purchase. Storefront capture requires marketing consent through Shopify's privacy controls. The checkout pixel requires analytics and marketing consent. Shoppers can manage these choices through the store's privacy controls. Withdrawing consent does not erase previously recorded purchases or rewards.
Shoppers can contact the merchant to request access to or deletion of their data. We process customer data requests forwarded by Shopify and shop data deletion requests after the merchant uninstalls RefRef. Customer requests concern the individual shopper; shop deletion concerns the connected store and its shoppers. These requests affect data held by RefRef, not the merchant's records in Shopify. You can also contact help@refref.ai for assistance.
WooCommerce Referral Data
Merchants choose to connect their store to RefRef and configure its referral Program. We process referral records to provide that service for the merchant. Contact the store about its purchases, customer records, and privacy practices.
After a merchant approves a connection, the plugin exchanges the store URL, installation identifier, environment, currency, and connection credentials with RefRef. It synchronizes paid order and refund identifiers, timestamps, amounts, currency, paid-history evidence where available, referral attribution, and coupon information. It uses WordPress customer IDs for signed-in shoppers and opaque session identifiers for guests. The WooCommerce connector does not send shopper names, email addresses, postal addresses, or payment-card details to RefRef. Other integrations may provide different data. Service logs may contain request metadata needed for operations and security.
The plugin asks visitors for referral-tracking consent before saving a referral handoff in the WooCommerce server-side session. When WordPress Consent API is present, marketing consent must also permit it. Visitors can withdraw consent using the storefront button; this clears session attribution and removes its friend coupon. Withdrawal does not erase previously recorded purchases or accounting records. Signed-in shoppers can explicitly request referral links and view their own referral and reward history.
Store administrators can use WordPress Tools → Export Personal Data and Tools → Erase Personal Data for confirmed requests. WordPress uses the request email locally to find the customer and guest order identifiers. The plugin sends those identifiers, not the email, to RefRef to export or delete hosted personal data. Deactivating or uninstalling the WooCommerce plugin does not erase hosted records. If the store is no longer connected, contact help@refref.ai for assistance with hosted data requests.
Data Retention and Deletion
We retain personal data for as long as needed to provide the service and meet applicable obligations. After a verified deletion request, or a shop deletion request from Shopify following uninstall, we delete or anonymize the affected personal data.
We retain limited transaction and reward records for billing, accounting, and audit purposes, and information we are required to keep by law. Retained records can include transaction identifiers, dates, and amounts. We limit this retention to the relevant purpose and applicable obligations.
Plugin and Service Licensing
The distributed RefRef WordPress plugin files are licensed under GPLv2-or-later. That license does not apply to the separately hosted RefRef service. This privacy policy covers the information processed by our website and hosted service.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date.
Contact Us
If you have any questions about this Privacy Policy, please contact Exa Labs LLC at help@refref.ai.