Privacy Policy

Last updated: 19 October 2026

1. Who we are

Referral Nexus ("we", "us", "our") is a referral management service operated by Fintech Innovation Group Ltd, a company registered in England and Wales under company number 16909729, with its registered office at 2 Oystercatcher Close, Sprowston, Norwich, England, NR7 8LP.

For any privacy question or request, email us at heaphy@hotmail.co.uk.

This policy explains how we handle personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

2. Our two roles

Where we are the controller. Fintech Innovation Group Ltd is the controller of personal data about the business users who sign up for and manage Referral Nexus accounts ("admins"), about visitors to our website, and about people who contact us.
Where we are the processor. Our business customers run referral programmes on Referral Nexus. They add or collect personal data about their members, referrers and partners, and about the people those members refer ("referred contacts"). For that data, the business customer is the controller and Fintech Innovation Group Ltd is its processor. We only process it on the customer's instructions, under the Data Processing Terms in our Terms of Service. If you are a member of, or were referred into, a programme run on Referral Nexus, please contact the business that runs that programme first. If you contact us instead, we will pass your request to them.

3. What we collect

About admins (business account holders):

Name, email address, company name and login details. Passwords are stored only as secure hashes.
If you choose to sign in with Google, the name, email address and Google account identifier that Google shares with us.
Account settings, programme settings and billing records, such as platform fees charged and paid.
Payment card details are entered directly into a form provided by Stripe. Stripe stores them; we do not see or store full card numbers.

On our business customers' behalf (as processor):

Member, referrer and partner details, such as names, email addresses and company details.
Referred contacts' details, such as names, email addresses, phone numbers, company details and referral status.
Reward amounts and payout records, including PayPal email addresses used to pay rewards.
Data synced with integrations the customer connects, such as Salesforce.

Automatically, when you use the website or the Service:

Server logs, such as IP address, browser type, the pages requested and the time of the request.
Page visit statistics for our marketing pages: the page visited, browser type, referring page and a shortened one-way hash of the IP address (not the IP address itself).
Cookies and similar technologies (see section 9).

When you contact us: your email address and the content of your messages.

4. Why we use it, and our lawful bases

These are the purposes for which we use data as a controller:

To provide and run the Service for admins: account set-up, programmes, referral tracking, integrations and reward payouts. Lawful basis: performance of a contract.
To charge and collect our platform fee. Lawful basis: performance of a contract and legal obligation.
For security, fraud prevention, troubleshooting and improving the Service, including server logs and page visit statistics. Lawful basis: our legitimate interests in running a secure, reliable service.
To send service emails, such as password resets, account notices and changes to our terms. Lawful basis: performance of a contract and our legitimate interests.
To reply to you when you contact us. Lawful basis: our legitimate interests.
To meet legal obligations, such as keeping accounting and tax records. Lawful basis: legal obligation.

We do not use personal data for automated decision-making that has legal or similarly significant effects on you.

We use these service providers (sub-processors) to run Referral Nexus:

Replit. Hosts the Service. All Service data is stored in Replit's hosted PostgreSQL database.
Stripe. Used only to collect Referral Nexus platform fees from admins (our business customers). Stripe receives the admin's billing contact details, payment method and fee amounts.
Resend. Sends emails from the Service, such as password resets, invitations, notifications and emails that customers send to their own members.
PayPal. Used to pay rewards to referrers. When a reward is paid through PayPal, we pass the payee's PayPal email address and the payment amount to PayPal. PayPal processes that data under its own privacy policy (https://www.paypal.com/uk/legalhub/privacy-full).

Integrations a business customer chooses to connect:

Salesforce. The optional Salesforce integration syncs referrals to the customer's own Salesforce account, as the customer instructs.
Zapier and Shopify. If a customer connects these, data moves between Referral Nexus and that service as the customer instructs.

These integrations are run under the customer's own agreement with the provider concerned.

We may also disclose data where the law requires it, to protect our rights, or to a buyer or successor if our business is sold or restructured.

We do not sell personal data.

6. International transfers

Some of our providers, including Replit, Stripe, Resend and PayPal, may process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it) or on appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. How long we keep it

Admin account data: while the account is active, plus up to 12 months after it is closed. We then delete it, unless we need to keep it for a legal claim.
Customer programme data (members, referrers and referred contacts): while the customer's account is active. After the account closes, the customer can export it for 30 days. We then delete it within a further 30 days, unless the customer asks us to delete it sooner or the law requires us to keep it.
Financial records (platform fees, payments and reward payout records): 6 years from the end of the financial year they relate to, as UK tax law requires.
Password reset links: expire 1 hour after they are sent and can only be used once.
Sign-in sessions: end 24 hours after your last activity, or when you sign out.
Server logs: 90 days.
Page visit statistics: 12 months.
Emails you send us: up to 2 years after our last contact with you.

8. Your rights

Under UK GDPR you have the right to:

be told how your data is used (this policy)
access your data
have it corrected
have it erased
restrict or object to its processing
data portability
withdraw consent, where we rely on consent.

To use these rights, email heaphy@hotmail.co.uk. We will reply within one month. If your data is held on behalf of one of our business customers, we will pass your request to them and help them respond.

Your right to complain. If you are unhappy with how we handle your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.

9. Cookies

We only use cookies and similar technologies that are needed for the Service to work:

Session cookie (connect.sid). Keeps you signed in and protects your account. It expires 24 hours after your last activity.
Sidebar cookie (sidebar_state). Remembers whether you left the app's sidebar open or closed. It lasts 7 days.
Browser local storage. Remembers your progress through the dashboard's getting-started checklist, and your light or dark theme choice.

We do not use advertising or third-party analytics cookies. Our page visit statistics (section 3) do not use cookies. Stripe may set its own cookies on the billing set-up page for fraud prevention; see Stripe's cookie policy (https://stripe.com/gb/legal/cookies-policy). If we ever add non-essential cookies, we will ask for your consent first.

10. Security

Referral Nexus is hosted on Replit, and Service data is stored in Replit's hosted PostgreSQL database. Connections to the Service use HTTPS, passwords are stored as hashes, and access to customer data is limited to the account it belongs to. No system is completely secure. If a personal data breach is likely to put your rights at risk, we will tell you and the ICO where the law requires it.

11. Children

Referral Nexus is a business service and is not intended for anyone under 18.

12. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new "Last updated" date, and tell admins about significant changes by email.

13. Contact

Fintech Innovation Group Ltd, 2 Oystercatcher Close, Sprowston, Norwich, England, NR7 8LP. Email: heaphy@hotmail.co.uk.