Privacy Notice
This notice explains how personal data is used while Refstack is being built and tested as an MVP.
Effective 16 August 2026 · Last updated 16 August 2026
We collect what is needed to run your account and page, use limited cookieless analytics, and do not sell your personal data.
1. Information we collect
- Account information: your email address, authentication identifiers and security information needed to sign you in.
- Profile and offer content: your handle, display name, biography, images, referral links, codes, notes, eligibility details, expiry dates and publishing choices.
- Support information: messages and other information you send when you contact us.
- Technical information: service logs, security events, device or browser information and IP address where needed to deliver and protect the service.
- Analytics events: page views and limited actions such as opening an offer, copying a code, sharing a page or submitting an account form. Form values are not included in analytics events.
2. Why we use it
| Purpose | UK GDPR basis |
|---|---|
| Create accounts, authenticate users, save pages and provide requested features. | Performance of our contract with you. |
| Publish profile and referral content when you choose to make a page public. | Performance of our contract with you. |
| Answer support requests and communicate about the service. | Contract and our legitimate interest in supporting users. |
| Protect Refstack, prevent abuse and diagnose faults. | Our legitimate interest in running a secure, reliable service and, where relevant, legal obligations. |
| Understand aggregate use and improve the product through limited analytics. | Our legitimate interest in understanding and improving Refstack with privacy-conscious analytics. |
| Meet legal requirements and enforce our Terms. | Legal obligations and our legitimate interests. |
3. What becomes public
Your page remains private until you publish it. Once published, your handle, display name, biography, images and active referral offers are available to anyone with the URL and may be shared or indexed by search engines. Do not publish personal data or images you do not want made public.
4. Analytics, cookies and local storage
Refstack uses PostHog in cookieless mode for limited product analytics. Session replay, broad click capture, advertising profiles and form-value capture are disabled. Query strings and URL fragments are removed from analytics URLs. PostHog may receive an IP address long enough to create a privacy-preserving, rotating identifier and then remove the address from the analytics event.
We do not currently use non-essential advertising or analytics cookies. Signed-in areas use strictly necessary authentication cookies so your session works and remains secure.
5. Who processes information
We use service providers acting on our behalf, including Supabase for authentication, database and file storage; Vercel for hosting and delivery; and PostHog for the limited analytics described above. We may also disclose information to professional advisers, regulators, courts or law enforcement where reasonably necessary or legally required. We do not sell personal data.
6. International transfers
Some providers may process information outside the UK. Where UK data protection law requires it, we rely on an adequacy decision or appropriate contractual safeguards and risk assessments. You can ask for more information about applicable safeguards by emailing us.
7. How long we keep information
We keep account and page information while your account is active. If you request deletion, we remove or anonymise it unless it is needed for security, dispute resolution or a legal obligation. Limited copies may remain temporarily in provider backups until their normal deletion cycle completes. Support messages and security records are kept only for as long as reasonably needed for the request, safety, record-keeping or legal purposes.
8. Your rights
Depending on the circumstances, UK data protection law may give you rights to access, correct, erase or restrict your personal data; receive certain data in a portable format; and object to some uses. Where processing relies on consent, you may withdraw it at any time without affecting earlier processing.
You can object to processing based on our legitimate interests, including limited product analytics. Email support@refstack.co and explain your request.
We may need to verify your identity before completing a rights request. You also have the right to complain to the Information Commissioner’s Office. We would appreciate the chance to address your concern first.
9. Automated decisions and children
Refstack does not use personal data to make solely automated decisions with legal or similarly significant effects. The service is intended for people aged 18 or over and is not directed at children.
10. Changes and contact
We may update this notice as Refstack or the law changes. We will update the date above and give reasonable notice where a change materially affects how personal data is used.
For privacy questions, requests or complaints, email support@refstack.co.