Privacy Policy
1. Who This Covers
PartnerFlow runs a two-sided referral network. This Policy applies to Service Providers (businesses receiving referrals), Referral Partners (businesses sending them), Referral Leads (people who get referred), and site visitors.
Where we host a form or route data on a client's behalf, that client's own privacy policy also governs what they do with it. This Policy covers our handling.
2. What We Collect
From you: name, business name, business contact details, industry, and login credentials. Payment and payout details, including tax information, are collected and stored by our payment processor, Stripe — we don't store full financial account numbers.
Referral information: when a Referral Partner submits a referral, we receive the Referred Consumer's name, phone, email, address or service area, and what they need — plus the identity of the submitting Partner and the intended Service Provider.
Consent records: where a Referred Consumer agrees to be contacted, we retain a record of that agreement — the disclosure shown, the form and its version, IP address, timestamp, and any confirmation step. We keep these as proof of consent.
Automatically: IP address, browser and device type, pages viewed, timestamps, referring pages, and general location from IP. Collected via cookies, pixels, and server logs.
From other sources: referral outcome data from Service Providers (used for attribution and payouts), and publicly available or commercially licensed business contact information used to recruit partners. This applies to business contacts, not to Referred Consumers.
Please don't send us Social Security numbers, financial account numbers, government IDs, health information, or biometric data through the Services. We don't need it.
3. How We Use It
Create and administer accounts
Route referrals to the right Service Provider
Track attribution from referral through to outcome
Calculate and issue referral compensation, and handle tax reporting
Send transactional and status communications by email, SMS, or phone
Recruit and onboard partners and providers
Provide support and respond to inquiries
Maintain consent, revocation, and do-not-contact records
Detect fraud, duplicate or fabricated referrals, and abuse
Analyze and improve the Services
Comply with law and defend legal claims
4. How We Share It
With the matched Service Provider — this is the point of the Services. We disclose the Referred Consumer's contact details and request so the provider can reach them. They then handle it under their own policy.
With the submitting Referral Partner — status and compensation on referrals they sent.
With vendors who work on our behalf and are limited to that purpose: hosting and infrastructure, storage, email and SMS delivery, CRM and automation, authentication, payments and payouts, analytics, and error monitoring.
With advisors — attorneys, accountants, insurers, under confidentiality.
In a business transfer — merger, acquisition, financing, or sale of assets.
For legal reasons — where required by law or legal process, to enforce our Terms, or to investigate fraud or abuse.
What we don't do
We do not sell personal information for money.
We do not share, sell, or disclose telephone numbers, SMS opt-in data, or consent records to third parties or affiliates for their marketing purposes. No mobile information collected for SMS purposes is shared with third parties for marketing. Consent is used only to enable contact by the party named in the disclosure at the time it was given.
We do not use Referred Consumer information for our own marketing.
On "sale" under state law: some state privacy statutes define "sale" broadly enough to potentially reach a referral disclosed to a Service Provider who pays for it. Our position is that these disclosures are made to fulfill the consumer's own service request, not for behavioral advertising. Either way, the opt-out rights in Section 7 are available to you, and we honor Global Privacy Control signals.
5. Text Messages and Calls
Where a phone number is provided and contact is agreed to:
Consent applies only to the party named in the disclosure shown at the time.
Message and data rates may apply. Frequency varies.
Consent to marketing messages is never a condition of purchase.
Reply STOP to opt out of texts, HELP for help, or tell any caller to stop calling. You can also contact us at Section 10.
We honor revocations across all channels and keep internal do-not-contact records so they stay honored — including after an account is closed.
6. Cookies
We use cookies and similar technologies for authentication and session management, remembering preferences, analytics, and referral attribution — the parameters that credit a referral to the right Partner, which is core to how the Services work.
We may use marketing or retargeting technologies on our public marketing pages to reach business audiences. We don't apply them to Referred Consumer intake forms.
Most browsers let you refuse or delete cookies; disabling necessary or attribution cookies will break parts of the Services. We honor Global Privacy Control. We don't respond to "Do Not Track," which lacks a common standard.
7. Your Rights
Depending on your state, you may have the right to access, correct, delete, or obtain a portable copy of your personal information, to opt out of sale, sharing, or targeted advertising, and to not be discriminated against for exercising these rights. If we deny a request, you may appeal by replying to our decision, and may contact your state Attorney General.
To exercise: contact us at Section 10. We'll verify your identity in proportion to the request — usually by confirming control of the email or phone on file — and respond within 45 days, extendable by another 45 with notice. Authorized agents may submit requests with written authorization.
If we hold your information for a client, we'll route your request to that client, who is responsible for responding, and assist them.
California residents: in the past 12 months we collected the categories in Section 2 (identifiers, commercial information, internet activity, professional information, financial information for payouts, and inferences), for the purposes in Section 3, and disclosed them to the recipients in Section 4. See Section 4 on sale and sharing.
8. Retention
We keep information as long as needed for the purpose collected, then as required by law. Specifically:
Payout and tax records: as required by tax and accounting rules.
Consent and revocation records: at least five years after the last communication. Messaging and telemarketing statutes carry multi-year limitations periods and put the burden of proving consent on the caller — this record is the defense.
Do-not-contact records: indefinitely, so revocations keep working.
Account and referral data is kept for the life of the account and deleted or de-identified within a reasonable period after closure, subject to the above.
9. Security, Children, and Location
We use reasonable administrative, technical, and physical safeguards, including encryption in transit and at rest, access controls, and vendor review. Payment credentials are handled by a PCI-compliant processor. No system is perfectly secure; we'll notify you and regulators of a breach as required by law.
The Services are for businesses and not directed to anyone under 18. We don't knowingly collect information from children.
We operate in the United States and the Services are intended for U.S. users. Information is processed here.
10. Contact and Changes
NodeCode LLC d/b/a PartnerFlow Team [email protected] — put "Privacy Request" in the subject for privacy requests.
We may update this Policy. We'll revise the date above and, for material changes, notify account holders through the Services or by email before it takes effect. Continued use after that constitutes acceptance.