Your contacts stay yours.

Received a referral email?

If someone sent you a referral through Refer Kindly, read how we got your address and what we keep. You can use the control link in that email to stop future referrals from that business or report a concern. Opening a control link never changes a preference.

What the referral experience uses

The local demonstration uses fictional contacts and a synthetic sender. No Google account is connected and no email is sent. If approved for live use, saved contacts support individual recipient selection and Gmail access supports only the emails you explicitly confirm.

What businesses can see

Businesses receive campaign-level counts, including sessions, connections, previews, and submission outcomes. They cannot view your address book, account credentials, selected recipients, or individual message content. Small aggregate counts can still reveal activity in context.

Session and message data

Unselected contacts stay in browser memory. Selected destinations and exact messages are stored as encrypted operational snapshots to support preview, sending, and your private results. Sessions are time limited; terminal batch snapshots are removed within 24 hours, and a session deletion request removes operational contact and message data while stopping pending sends.

Reward emails

Some campaigns can email you a reward code as well as showing it in the app. We only keep your verified email address for this after you explicitly opt in on the connect step, and we store it encrypted, use it only to send that reward email, and keep it only while the campaign is live plus 30 days afterwards. For a campaign with no end date, it is also cleared 7 days after your last referral can no longer lead to a reward. Deleting your session data removes it immediately, and opting out clears it as well.

Records that remain

Business-wide opt-out records do not expire automatically. Pseudonymous suppression, duplicate-prevention, security, and audit records are kept under separate retention rules. Deleting a session does not remove opt-outs, business aggregates, messages already submitted to a provider, or instantly erase time-limited backups.

A one-way code made from a recipient’s address is kept to stop repeat referrals from the same business for up to 90 days after the last referral to them, and in our record of each referral email until 30 days after the campaign ends. If the campaign has no end date, that record keeps it until 12 months after the person who made the referral last used the campaign.

Deleting your session data unlinks your referral progress and reward records from you, but it does not reset sending limits. Reward codes already issued stay valid with the business.

Your choices

Use Session & privacy in the referral flow to disconnect or delete session data.

Lost the page or browser you used? You can still delete your referral data by signing in with the same Google account. Delete your referral data

Disconnecting stops local access and pending work; external Google grant revocation is reported separately. Emails already being submitted may still complete.

Contact: [email protected]

Before live operation

A final notice must identify the operating entity, privacy contact, jurisdiction, processors, regions, exact retention schedules, and how to exercise applicable rights. The local draft is not a production privacy notice.