PRIVACY POLICY

Privacy Policy

Last updated: October 19, 2026 · Effective: May 11, 2026

Reffed ("we," "us," "our") is a product operated by PromptlessPress Technologies Inc., based in Vancouver, BC, Canada. This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights regarding that data.

If you have questions, email us at support@reffed.ai.

1. Information we collect

Information you provide directly

  • Audit and checkout information — your email address and the website URL you enter for a free audit or at checkout. We do not ask for your name or business name there. Stripe collects your billing details at checkout (see section 4). Our rate-limit records also keep the email address you used.
  • Website information — the URLs you submit for audits. If you use the Watch + Fix WordPress beta, the connection token you provide (stored encrypted) and a record of each change applied, including the previous value so it can be undone.
  • Google Search Console (optional) — you may choose to connect Search Console with read-only access. If you do, we store an encrypted access token and snapshots of your search query and page data. The connection is not required to use Reffed, and it may not be available to all customers yet. To disconnect, email support@reffed.ai and we will handle the request.
  • Communications — messages you send via our contact form (name, email, website, topic, message), feedback form, email, or support channels.
  • Waitlist signups — your email address and the pricing tier you expressed interest in.

Information collected automatically

  • Usage data — pages visited, features used, audit runs, click events. Aggregated, never tied to your identity in our analytics. Our own site analytics events and Academy lesson-view counts are not sent from your browser when it sends a Do Not Track or Global Privacy Control signal. This does not cover events our servers record themselves (for example a completed subscription), or the Vercel analytics and performance scripts on the Watch checkout confirmation page.
  • Network and device information — our hosting provider (Cloudflare) processes your IP address to serve the site and keeps its own request logs. For rate limiting and abuse prevention we store a one-way hash of your IP address, not the address itself. Feedback you submit also includes your browser's user-agent.
  • Cookies and browser storage — the only cookies we have set are affiliate-link cookies (reffed_ref, reffed_ref_js), set when someone followed a Reffed affiliate link. Affiliate links are now disabled, so no new ones are set. We also keep a campaign tag in your browser's sessionStorage for the current session. The free Academy quizzes save your progress, and any email you enter, in your browser's local storage on your device. We do not use third-party advertising cookies.

Information collected from your site

  • Content and structure of pages we audit (HTML, meta tags, schema, internal links, copy)
  • Crawl signals and page-speed results for the URL you submit. If you optionally connect Google Search Console, search query and page data.
  • An AI-assessed check of whether AI answers appear to mention your site, included in audit reports. AI Visibility tracking is experimental and not currently available, so we do not collect AI engine query results for customers today.

2. How we use your information

  • Provide the service — run audits, send reports, re-check your site weekly (Watch), and apply changes you approve (Watch + Fix beta).
  • Communicate with you — send your audit report, secure dashboard and billing links, weekly reports, billing notices, and support replies. After a free audit we also send two follow-up emails to the address you entered, about 3 and 7 days later, unless you have already subscribed or unsubscribed. Each follow-up email has an unsubscribe link. Weekly reports and access links for customers do not have one; to stop them, cancel through the billing portal or email us.
  • Improve the product — aggregated, anonymized data informs which features to build and which audit signals correlate with results.
  • Protect against abuse — detect bots, rate-limit, prevent fraud.
  • Legal compliance — comply with applicable laws, respond to lawful requests from authorities.

Business contact addresses (our own outreach)

We may email a small number of businesses at a business address the business itself published on its own website, about a free check of that website. We keep the address, the page where we found it, when we collected it, the audit we ran, and a record of each message we sent, so we can show why we contacted the business. Every such message identifies Reffed, gives our mailing address and a contact method, and has an unsubscribe link. When someone unsubscribes, we keep a one-way hash of the address so we never email it again. We do not buy or rent email lists.

3. What we don't do

  • We don't sell your data. Ever. Not to advertisers, not to data brokers, not to anyone.
  • We don't train AI models on your content without your explicit consent. We use a third-party AI provider (currently Anthropic's Claude) to analyze audits and write the report; see section 4 for what is sent. Their own terms apply to that processing.
  • We don't use advertising tracking. No retargeting pixels, no third-party ad cookies, no behavioral profiling.
  • We don't share your audit data with competitors or aggregate it into reports that would identify your business.

4. Third-party services we use

We use carefully selected service providers to operate Reffed. Each receives only the minimum data required to perform its function:

  • Stripe — payment processing through Stripe Checkout. Stripe receives your email and website URL and collects your billing details; Reffed does not hold card data. We keep your Stripe customer and subscription IDs, plan and status.
  • Anthropic (Claude API) — audit analysis. For each audit we send the domain, URL, a summary of crawl signals, and an excerpt of the page text.
  • Supabase — database hosting (our primary data store).
  • Cloudflare — hosts the site and handles traffic and request logs, including IP addresses. It also handles inbound email routing.
  • Resend — email delivery (audit reports, follow-up emails, weekly reports, access and billing links). It receives the recipient address and email content.
  • Google PageSpeed Insights — public API used to measure your site's performance. Only your URL is sent; no account data.
  • Google Fonts — pages load fonts from Google, so your browser sends your IP address to Google when a page loads.
  • Google Search Console — only if you choose to connect it (optional); read-only access as described in section 1.

If we add or change a service provider in a way that affects data handling, we'll update this policy.

5. How long we keep data

  • No automatic deletion — we do not currently delete data automatically. Audit reports, email and subscription records, and waitlist signups are kept until we delete them at your request.
  • Cancellation — cancelling a subscription does not delete your data.
  • Deletion requests — email support@reffed.ai and we will handle the request. A person does this by hand, and we do not state a deadline.
  • Unsubscribes — we keep a record of unsubscribed email addresses so we continue to honor the opt-out.
  • Provider logs — our hosting and other providers keep their own logs under their own settings.

6. Your rights

Depending on where you live, you have some or all of these rights:

  • Access — request a copy of the personal data we have about you.
  • Correction — fix anything that's inaccurate.
  • Deletion — ask us to delete your account and associated data (subject to any legal retention requirements).
  • Portability — ask us for a copy of your data. We handle these requests by hand.
  • Opt out — use the unsubscribe link in follow-up emails at any time. Service emails (billing, weekly reports, access links) continue while you have an active subscription.
  • Object — object to certain types of processing, including profiling.

To exercise any of these rights, email support@reffed.ai. A person handles each request manually; we do not state a response deadline.

7. Security

We use industry-standard security practices: TLS encryption for all data in transit, encrypted storage at rest, principle-of-least-privilege access controls, regular security reviews, and prompt patching of dependencies. No system is 100% secure, but we take this seriously.

If you discover a security vulnerability, please email support@reffed.ai with details. We don't currently run a paid bug bounty but we appreciate responsible disclosure and will acknowledge reporters publicly if they wish.

8. International transfers

Reffed is operated from Canada, but some of our service providers are based in the United States and operate in multiple regions. By using Reffed, you consent to your data being transferred to and processed in these jurisdictions, which may have different data-protection laws than your home country.

9. Children's privacy

Reffed is not directed at children under 16. We don't knowingly collect data from anyone under 16. If you believe we've collected data from a child, email support@reffed.ai and we will handle the request.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll email customers and post a notice on the site at least 30 days before changes take effect. The "Last updated" date at the top of this page always reflects the most recent revision.

11. Contact us

Privacy questions, data requests, or concerns:

support@reffed.ai

PromptlessPress Technologies Inc.
Operating Reffed
Vancouver, BC, Canada