Referino

Privacy Policy (GDPR)

Last updated: October 19, 2026

1. Who we are and whom this policy concerns

The controller of personal data is Rabbit Studio s.r.o., Hradečnica 30, 036 01 Martin, Slovakia, Company ID (IČO): 53455983, Tax ID (DIČ): 2121373342, VAT ID: SK2121373342 (the “Controller” or “we”), the operator of the Referino service at referino.com. You can contact us about personal data at info@referino.com or at the address above.

This policy concerns:

  • clients – businesses and individuals with a Referino account,
  • reviewers – people who submit a review through a client’s review page,
  • clients’ contacts – people whose email address a client adds to Referino so that we send them a request for a review,
  • visitors – people who visit referino.com, review pages or a client’s website with the Referino widget,
  • people interested in the service who leave their email address while registration is closed.

2. What data we process

a) Client account and billing data

  • name, email address and password (stored only as a one-way hash),
  • company name and billing address (street, city, postal code, country), optionally VAT ID and tax ID,
  • selected plan, account language, email notification settings, discount codes used,
  • the time you agreed to the Terms and Conditions, the time you requested an immediate start of the service at checkout and, if you withdraw from the contract, the time of withdrawal and the amount refunded,
  • two-factor authentication data (stored encrypted), if you enable it,
  • payment data: card details are entered and processed only by Stripe. We store only the Stripe customer identifier, card type, the last four digits of the card, payment and invoice records, and SMS credit purchases and balance.

b) Review page

The business name, description, logo, address, phone, email and website that the client enters on the review page are public. If the client enters personal data here (for example as a sole trader), it is published.

c) Reviewers

  • name, email address, rating, review text, language of the page and the time of consent to publication,
  • a one-way hash of the email address, which we use to detect repeated reviews. When a review is submitted, we check that the email domain exists,
  • if you verify your phone number: the phone number, the verification code, the IP address and the browser identification (user agent) at the time of verification. The phone number is stored encrypted.

We do not store the IP address or the browser identification together with the review.

d) Reviews from external platforms

If a client connects a Google Business Profile, a Facebook page, or a Trustpilot, Yelp or Tripadvisor profile, we import its reviews: the reviewer’s name or username as shown on the platform, the rating, text, date, the review identifier and other data that the platform’s interface provides about the review (for Google, for example, a link to the reviewer’s profile photo). We store Google and Facebook access tokens encrypted. For Google we request the Google Business Profile management permission, which we use only to read reviews.

e) Visitors

  • Session: for each visit we store a session with the IP address and browser identification. The session expires 120 minutes after the last activity.
  • Server logs: the IP address, browser identification, requested address (without parameters) and time. Logs are kept for a short time and are overwritten continuously.
  • Review page and widget statistics: we count visits using a daily pseudonymous identifier, which is a one-way hash of the IP address, browser, page and date created with a secret key. We do not store the IP address. We keep the records for 13 months and clients see only aggregated numbers.
  • QR code scans: the time of the scan, the IP address and the browser identification. We delete the IP address and browser identification after 90 days; only the number of scans is kept.
  • Web analytics: on public pages we use our own cookieless analytics tool Strixomo. It is described in the Cookie Policy.

f) People interested in the service

While registration is closed, we store your email address, optionally your name, your language and the source of the sign-up, so that we can invite you to register.

g) Communication

The content of emails you send us and our replies.

h) Clients’ contacts

A client can add the email address, name and language of its customers to Referino. On the client’s behalf we send them an email asking for a review and at most two reminders. We record when an email was sent, whether the link in it was opened and whether a review was submitted through that link. The client confirms that it has these people’s consent; for this data the client is the controller and we are its processor. Every email contains a link to unsubscribe from that business’s emails.

3. Purposes and legal bases

  • Providing the service to clients (account, review pages, imports, widget, SMS verification, notifications, statistics) – performance of a contract (Art. 6(1)(b) GDPR).
  • Invoicing and accounting – compliance with a legal obligation (Art. 6(1)(c) GDPR).
  • Publishing reviewers’ names and reviews on the review page and on the client’s website – the reviewer’s consent given when submitting the review (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time.
  • Credibility of reviews and protection against misuse (email domain check, detection of repeated reviews, spam filter, phone verification, rate limits) – our legitimate interest and the legitimate interest of clients in credible reviews (Art. 6(1)(f) GDPR).
  • Notifying a reviewer by email that the business has replied to their review – legitimate interest (Art. 6(1)(f) GDPR).
  • Displaying reviews from external platforms – performance of a contract with the client and the legitimate interest in displaying publicly available reviews (Art. 6(1)(b) and (f) GDPR).
  • Security, sessions, server logs and statistics – legitimate interest in the secure operation and development of the service (Art. 6(1)(f) GDPR).
  • Service emails (account, security, payments, renewal reminders, account pausing and deletion) – performance of a contract. Notifications of new reviews and the weekly summary can be switched off in the account settings or via the link in each email. We do not currently send marketing emails or newsletters.
  • Review requests on behalf of a client – we process clients’ contacts as the client’s processor (Art. 28 GDPR); the legal basis is the consent the client has obtained from the contact. Every email contains a link to unsubscribe.

4. Automated processing

We automatically classify reviews as positive, neutral or negative based on the rating and keywords, so that we can notify the client of negative reviews and allow filtering. A spam filter automatically rejects reviews containing links, email addresses and similar content, and repeated reviews from the same email address are not accepted. Businesses in the catalog are ordered by average rating. None of this processing produces decisions with legal or similarly significant effects for you.

5. Who can see your data

  • Public: the content of the review page (business details, reviewer’s name, rating, review text, the business’s reply, the verification mark and the date), the business catalog and the widget on the client’s website. A reviewer’s email address and phone number are never published.
  • Client: sees the reviewer’s name, rating, text, verification mark and date, but not the email address or phone number.
  • Client and its contacts: for each contact the client sees whether a review request was sent, whether the link was opened and whether a review was submitted through it, but not which review it was.
  • Service providers (processors and other recipients):
    • the server hosting provider,
    • the email delivery provider,
    • Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA) – payments, invoices and the payment portal: the client’s name, email address, company name, address and payment data,
    • SMS providers Amazon Web Services (Amazon SNS), Twilio, Vonage and MessageBird – the phone number and the text of the SMS (verification code and business name). The provider is chosen according to the country of the number,
    • MEGA (S4 object storage, Amsterdam data centre) – database backups,
    • Google, Meta (Facebook), Trustpilot, Yelp and Tripadvisor – only if a client connects their profile. These platforms are independent controllers of the data they publish,
    • Google (YouTube) – only if you play the video on the home page,
    • public authorities, where required by law.

We never sell personal data.

6. Transfers outside the EU

Some providers (Stripe, Amazon Web Services, Twilio, Vonage, Google, Meta, Yelp and Tripadvisor) are based in the USA or belong to groups based in the USA, and an SMS may be processed outside the EU. Such transfers take place on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) for certified companies or standard contractual clauses included in the providers’ terms. MEGA is based in New Zealand, for which an adequacy decision of the European Commission applies.

7. Retention period

  • Client account: for as long as the account exists. After a subscription ends, after withdrawal from the contract, if a renewal payment is not completed within 7 days, or if a subscription has never been activated, the account is paused and deleted 90 days later. If the email address is verified, we send a reminder at least 14 days before deletion. If you delete your account yourself, the data is deleted immediately.
  • When an account is deleted, the account, review pages, reviews, imports, widgets, QR codes and statistics are deleted. Payment and invoice records are kept for as long as required by accounting and tax law (up to 10 years). Stripe keeps its own records according to its terms. SMS sending records (country, price, status – without the phone number) are kept without a link to the account.
  • Reviews: for as long as the client’s account exists. A review that we unpublish or remove is no longer displayed, but it remains in our database until the client’s account is deleted, unless you ask us to delete it.
  • Phone verification: verification records (phone number, code, IP address, browser identification) are deleted 30 days after the code expires. The phone number of a verified review is kept encrypted together with the review.
  • QR code scans: IP address and browser identification for 90 days. Visit statistics: 13 months. Import records: 90 days. Session: 120 minutes after the last activity. Server logs: short-term.
  • People interested in the service: until you ask us to delete your data.
  • Backups: we create a full database backup before each update of the application and store it on the server and in MEGA S4 storage. Deleted data may remain in backups until those backups are deleted. We use backups only to restore the service.
  • Clients’ contacts: until the client deletes them or its account is deleted. If a contact unsubscribes, we keep a one-way hash of the email address so that the client cannot send it further requests.

8. Your rights

You have the right to:

  • access your personal data,
  • rectify your personal data,
  • erasure (the “right to be forgotten”),
  • restriction of processing,
  • data portability – clients can download a copy of their data in the machine-readable JSON format in the account settings; reviewers’ email addresses and phone numbers are not included, because clients do not have access to them. Reviewers and other people can request a copy by email,
  • object to processing based on legitimate interest,
  • withdraw your consent at any time – reviewers can ask us to unpublish or delete their review, without affecting the lawfulness of processing before the withdrawal,
  • lodge a complaint with a supervisory authority – the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk) or the authority in your country of residence.

You can exercise your rights by email at info@referino.com. We will respond within one month.

  • Clients can change most data, download a copy of their data and delete their account themselves in the account settings.
  • Reviewers cannot edit or delete a review themselves; please contact us by email.
  • After disconnecting Google or Facebook in the account, you can also revoke Referino’s access in your Google or Facebook account settings.

9. Data security

We use appropriate technical and organisational measures to protect your data, including:

  • encrypted connections (HTTPS),
  • passwords stored only as one-way hashes,
  • encryption of phone numbers, verification codes, access tokens to external platforms and two-factor authentication data in the database,
  • two-factor authentication available to clients and mandatory for our administrators,
  • access to data restricted to authorised persons.

10. Cookies

On referino.com we use only cookies necessary for the website to function and cookies that remember your settings. We do not use advertising cookies or Google Analytics. Details are in the Cookie Policy.

11. Changes to this policy

We may update this Privacy Policy. The current version will always be available at referino.com.