Privacy Policy for Referly

Effective Date: July 8, 2026

Welcome to Referly (formerly Push Lap Growth) ("Referly," "we," "us," or "our"). This Privacy Policy explains how we collect, use, protect, and disclose information about you when you access or use our website located at https://referly.so (the "Site") or any services provided therein (the "Services"). By accessing or using the Site or Services, you signify that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree to this Privacy Policy, you may not access or use the Site or Services.

1. Information We Collect

Personal Information: We collect certain personal information from you when you use our Services, including your name, email address, and payment information. This information is necessary for order processing, paying out affiliate commissions, and providing you with access to our Services.

Non-Personal Information: We may also collect non-personal information automatically as you navigate through the Site, such as usage data, IP addresses, browser type, operating system, and other analytics data. This information helps us improve the functionality and user experience of the Site and Services.

Connected Account Data (Google User Data): If you are an affiliate and choose to connect a Google account (such as a YouTube channel or a Google Analytics property) to verify ownership of your channel or website and share audience metrics, we access certain data from Google APIs with your explicit consent, as described in Section 2 below.

2. Google User Data

Referly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

What we access: When you connect your Google account, we request read-only access limited to the following, depending on which account you connect:

- YouTube (youtube.readonly): your channel's public profile information (channel ID, name, handle, profile picture, description) and channel statistics (subscriber count, total views, video count).
- YouTube Analytics (yt-analytics.readonly): aggregate audience and performance metrics for your channel, such as views, watch time, and audience demographics (age ranges, gender, and geography as aggregate percentages).
- Google Analytics (analytics.readonly): the list of Google Analytics properties you have access to (to verify that you own the website you claim) and aggregate traffic metrics for the property you choose to share.

How we use it: This data is used solely to (a) verify that you own the YouTube channel or website associated with your affiliate profile, and (b) display aggregate audience and performance metrics on your affiliate profile so that businesses whose affiliate or creator programs you join or apply to can evaluate your reach. We do not access your Google account password, private videos, email, contacts, or any data beyond the read-only scopes listed above.

How we share it: Aggregate metrics derived from your connected accounts (such as subscriber counts, view counts, and audience demographics) are shown to businesses whose programs you join or apply to on Referly. We do not sell Google user data, do not share it with advertising platforms or data brokers, do not use it to build advertising profiles, and do not use it for purposes unrelated to the functionality described above. We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.

Human access: Humans do not read this data except with your explicit permission (for example, to resolve a support issue you raise), where necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymized.

3. Use of Information

We use the information we collect for the following purposes:

Order Processing and Payouts: We use your personal information to process orders, manage affiliate programs, and pay out commissions.

Verification and Profiles: We use connected account data to verify account ownership and populate affiliate profile metrics, as described in Section 2.

Communication: We may use your email address to communicate with you about your orders, account updates, promotional offers, and other relevant information. You can opt out of receiving promotional emails at any time by following the instructions provided in the email.

4. Data Sharing

We do not sell your personal information. We do not share your personal information with third parties except: (a) as described in Section 2 for connected account metrics; (b) with service providers who help us operate the Services (such as hosting, database, and payment providers) and who are bound by confidentiality and data protection obligations; or (c) as required by law.

5. Data Protection and Security

We take the protection of your data, including sensitive data received from Google APIs, seriously and apply the following safeguards:

Encryption in transit: All data transmitted between your browser, our servers, and third-party APIs (including Google APIs) is encrypted in transit using HTTPS/TLS.

Encryption at rest: Your data, including OAuth tokens and connected account data, is stored in access-controlled databases hosted with infrastructure providers that encrypt data at rest.

Access controls: OAuth access and refresh tokens are never exposed to your browser, other users, or third parties. Access to production systems and databases is restricted to authorized personnel on a need-to-know basis and protected by authentication controls.

Least privilege: We only request read-only OAuth scopes that are strictly necessary for the features described in this policy, and we only retrieve the specific data fields needed.

Secure development: OAuth flows use industry-standard protections, including encrypted state parameters to prevent cross-site request forgery.

Incident response: In the event of a data breach affecting your personal data, we will notify affected users and applicable authorities without undue delay, in accordance with applicable law.

6. Data Retention and Deletion

We retain connected account data and OAuth tokens only for as long as your account connection remains active. You can, at any time:

- Disconnect a connected social or analytics account from your affiliate dashboard, after which we stop accessing the associated Google data;
- Revoke Referly's access to your Google account directly at https://myaccount.google.com/permissions;
- Request deletion of your account and associated data, including all Google user data we have stored, by contacting us at support@referly.so. We will complete deletion requests within 30 days.

7. Children's Privacy

We do not knowingly collect any personal information from children under the age of 13. If you are under the age of 13, please do not provide us with any personal information. If we learn that we have collected personal information from a child under the age of 13, we will promptly delete that information.

8. Updates to this Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be effective immediately upon posting on the Site, and the "Effective Date" above will be revised accordingly. Users will be notified of any material changes via email.

9. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at support@referly.so.

By using Referly's Site or Services, you agree to this Privacy Policy. Thank you for using Referly!