Privacy Policy

Account information. When you sign up we collect your name, email address, and password (stored in hashed form), along with company or workspace details you provide.

OAuth profile data. If you sign in with Google or GitHub, we receive basic profile information from that provider — such as your name, email address, and avatar — as permitted by your settings with the provider.

Usage and analytics data. We collect information about how you interact with the dashboard and our website, along with log and device data such as IP address, browser type, and pages visited, to operate, secure, and improve the Service.

End-user referral event data. Our SDKs and APIs process referral events — such as link clicks, sign-ups, attribution signals, and reward eligibility data — about our customers’ end users. We process this data on behalf of and at the direction of the customer whose app generated it. If you are an end user of one of our customers’ apps, that customer’s privacy policy governs their use of your data; please direct requests to them, and we will support them in responding.

• to provide and operate the Service, including generating referral links, attributing referrals, and facilitating reward payouts;
• to detect and prevent fraud, including AI-assisted genuineness scoring of referral events;
• to secure the Service, authenticate users, and monitor for abuse;
• to understand usage and improve the product, using aggregated or de-identified data where practical;
• to communicate with you about your account, billing, security, and service changes; and
• to comply with legal obligations.

We do not sell personal information. We share information only with:

• subprocessors and infrastructure providers that help us run the Service — such as Supabase (database and authentication) and Vercel (hosting) — under agreements that limit their use of the data;
• payout partners, to the extent needed to disburse rewards you configure (for example gift cards or cash payouts);
• professional advisers, and authorities where required by law or to protect rights, safety, or the integrity of the Service; and
• a successor entity in connection with a merger, acquisition, or sale of assets, subject to this policy.

We keep account information for as long as your account is active and for a reasonable period afterward as needed for legal, billing, and security purposes. End-user referral event data is retained according to our customers’ instructions and our standard retention schedules, after which it is deleted or de-identified. Aggregated or de-identified data that no longer identifies anyone may be retained longer.

We use administrative, technical, and physical safeguards designed to protect information — including encryption in transit, access controls, and scoped API keys. No system is perfectly secure, so we cannot guarantee absolute security; we encourage you to use strong, unique credentials and to protect your API keys.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You can exercise many of these directly in the dashboard (for example updating profile details), or by contacting us at legal@invitebase.com. We will respond consistent with applicable law. If you are an end user of a customer’s app, we will route your request to that customer or assist them in fulfilling it.

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Service is used. Referral links may use cookies or equivalent identifiers to attribute referrals accurately. You can control cookies through your browser settings; disabling them may limit parts of the Service, such as staying signed in.

With your consent or as otherwise permitted, we may send periodic emails about product updates, features, and offers. You can opt out at any time using the unsubscribe link in any marketing email or by contacting us. We will still send transactional messages about your account, security, and billing.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you — for example by email or through the dashboard — before they take effect. The “Last updated” date above reflects the most recent revision.

Questions about this policy or our data practices? Contact us at legal@invitebase.com. You can also review our Terms of Service.