Privacy Policy

1. Legal Framework

ReferSuite respects your privacy and handles your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APP). This policy explains how we collect, use, store, and protect your personal information when you use our platform.

2. Your Data is Your Data

3. Information We Collect

We collect information that you provide directly to us:

• Account Information: Name, email address, password, and business name when you register
• Business Data: Campaigns, referrals, leads, and settings you create within the platform
• Payment Information: Processed securely through Stripe - we never store your card details
• Usage Data: How you interact with our platform to improve our services

4. How We Use Your Information

• To provide and maintain the ReferSuite service
• To send you important service notifications
• To process your subscription payments
• To improve and personalise your experience
• To respond to your support requests

5. Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using TLS/SSL
• Passwords are hashed using secure algorithms
• Regular security audits and monitoring
• Access controls limiting who can access system infrastructure

6. Notifiable Data Breaches

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988).

7. Data Sharing

We do not sell, rent, or share your personal or business data with third parties for marketing purposes. We only share data with:

• Service Providers: Essential services like payment processing (Stripe), email delivery (Resend), SMS delivery (Twilio), and hosting
• Connected Platforms: If you connect RewardSuite or StreamifyBox, limited member data is shared as described in your Connected Platforms settings
• Legal Requirements: When required by law or to protect our rights

8. Children's Privacy

ReferSuite is intended for users aged 16 and over for members, and 18 and over for business administrators. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete such information.

9. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and associated data
• Export your data
• Opt out of marketing communications
• Lodge a complaint with the OAIC if you believe your privacy has been breached

10. Cookies

We use essential cookies to keep you logged in and maintain your session. We do not use third-party tracking cookies for advertising purposes.

11. Data Deletion Requests

You can also self-serve for most data via Settings → Account → Export & Delete inside the ReferSuite app. Self-serve deletions are permanent within 24 hours.

Certain records may be retained after account deletion where required by law (e.g. tax records, fraud prevention), stored in an isolated archive and not used for any operational purpose.

12. Facebook / Meta Platform Data

Gym owners can optionally connect their Facebook Page(s) to ReferSuite via Meta's official OAuth flow so that Lead Ad submissions land automatically inside their ReferSuite dashboard. When you connect a Page, ReferSuite receives ONLY the following, and ONLY for Pages you administer and have explicitly connected:

• Page metadata: Page name, ID, and the list of Lead Ad forms attached to that Page — used to show the picker and confirm which forms feed into your CRM.
• Lead submissions: The fields a prospect submits on your Lead Ad form (typically name, email, phone, plus any custom questions you configured). Retrieved via Meta's leads_retrieval permission the moment Meta's webhook notifies us of a new submission.
• Business Manager admin status (one-time): A single check via business_management confirming the connecting user has admin rights over the Business that owns the Page.

ReferSuite does not read Page posts, comments, reactions, direct messages, or any other engagement content. We do not manage, edit, or delete any Page assets. The only write action we perform is subscribing / unsubscribing our own webhook on the leadgen field, so leads flow in real time.

How to disconnect: Inside ReferSuite go to Integrations → Meta Lead Ads → "Disconnect Page". This immediately unsubscribes our webhook via Meta's API, revokes the stored access token, and stops all future lead ingestion from that Page. To also remove the app entirely from your Facebook account, visit facebook.com/settings/?tab=business_tools → find "ReferSuite" → Remove.

Leads already ingested before disconnection remain in your gym's ReferSuite tenant (they're now your data, not Meta's). To delete those as well, use the Data Deletion Request path in section 11.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us at legal@refersuite.com. For data deletion requests specifically, use privacy@refersuite.com.