Privacy Policy

1. What we collect, why and on what legal basis

We follow the data-minimisation principle: we only ask for data that is strictly necessary for each purpose. Browsing the Site does not require an account and we do not ask you for your name or email to use it.

• Codes and links you submit. Purpose: publish them in the directory. They are public by design: anyone can see them on the Site. Legal basis: your request to publish (performance of the service you ask for, Art. 6.1.b GDPR). Do not submit codes that belong to other people.
• Copies and “did it work?” votes. Purpose: count each action once, rank codes and limit abuse (rate limits, daily limits). For this we derive a salted hash of your IP address and store it next to the action. We do not store your raw IP address in our database, and the hash is not used to identify you; however, because it is derived from an IP address, we treat it as pseudonymised personal data. Legal basis: our legitimate interest in running and protecting the Site (Art. 6.1.f GDPR).
• Sponsored placements. Purpose: activate the placement, take the payment and, if needed, refund it. We store the placement (code, dates, status) and the Stripe payment identifiers. Payment data (card number, billing details and the email you give at checkout) are entered on Stripe’s hosted page and we never see or store your card number. Legal basis: performance of the contract (Art. 6.1.b) and legal obligations such as accounting and tax (Art. 6.1.c).
• Messages. If you write to contact@yourreferralcodes.com we process your email address and the content of your message to answer you. Legal basis: your request (Art. 6.1.b) or our legitimate interest in answering you (Art. 6.1.f).
• Technical and traffic data. Our hosting provider processes technical data (for example IP address, browser and date and time of the request) to deliver the Site and keep it secure, and Vercel Analytics and Speed Insights produce aggregate traffic and performance statistics. Legal basis: legitimate interest in security, operation and improvement of the Site (Art. 6.1.f).

Providing data is voluntary, but without the data required for a given feature (for example the code you want to publish, or the payment for a sponsored placement) we cannot provide that feature. We do not take decisions based solely on automated processing that produce legal effects on you, and we do not create advertising profiles.

2. Who receives your data

We do not sell personal data and we do not share it with third parties for their own marketing. We only use the following service providers (data processors), who process data on our behalf: Vercel (hosting, analytics and performance measurement), Supabase (database) and Stripe (payments). Stripe also acts as an independent controller for payment data (fraud prevention and its own legal obligations). We may also disclose data to authorities when the law requires it. Codes and links you publish are visible to everyone.

3. International transfers

Some of these providers may process data outside the European Economic Area, including in the United States. When that happens, the transfer relies on an adequacy decision, such as the EU-US Data Privacy Framework, or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

4. Cookies and similar technologies

The Site does not set its own cookies and does not store information on your device that requires consent, and it does not use advertising, analytics or tracking cookies of third parties. For that reason it does not show a cookie banner. Specifically:

• Vercel Analytics and Speed Insights measure traffic and performance in aggregate. They are designed to work without cookies and without building profiles of individual visitors.
• Stripe: when you pay for a sponsored placement you are redirected to Stripe’s hosted checkout, which may set strictly necessary cookies (fraud prevention and payment security) on stripe.com. We do not control them; see Stripe’s cookie policy.
• Web fonts (the typefaces used on the Site) are served from our own domain, not from Google’s servers.
• If we ever add cookies or similar technologies that are not strictly necessary, we will inform you and ask for your consent first, and update this section with their type, purpose, provider and how to manage or delete them.

You can in any case block or delete cookies from your browser settings (Chrome, Firefox, Safari and Edge explain how in their help pages).

5. How long we keep it

• Public codes and links: until they are removed or expire.
• Hashed votes and copy records: only as long as needed for rate limiting, anti-abuse and ranking.
• Payment and placement records: for the period required by tax and accounting law (in Spain, generally up to six years, and up to ten for some obligations), and afterwards while claims may arise.
• Messages: while needed to answer you and handle your request, and then deleted or kept blocked while legal responsibilities may arise.

6. Your rights

You can exercise the following rights: access your data, rectification, erasure (“right to be forgotten”), restriction of processing, objection to processing based on legitimate interest, and portability of data you provided. Where we rely on your consent, you can withdraw it at any time without affecting the processing done before.

To exercise them, write to contact@yourreferralcodes.com, saying which right you want to exercise. We may ask you to prove your identity. We will reply within one month. Because votes and copies are stored only as an irreversible hash of your IP address, we may not be able to link them to you unless you give us the information needed to do so. To have a published code removed, use the same address.

If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency, Agencia Española de Protección de Datos (aepd.es), or with the authority of your country of residence.

7. Security

We apply reasonable technical and organisational measures to protect data: encrypted connections (HTTPS), access limited to the owner and our providers, no storage of card data and no storage of raw IP addresses in our database.

8. Children

The Site is not directed to children. In Spain, consent to the processing of data can only be given by people aged 14 or over (and by parents or guardians for younger children). We do not knowingly collect data from children; if you think a child has sent us data, write to us and we will delete it.

9. Changes

We may update this policy, for example when the law or our providers change.