Privacy Policy

Effective Date: 07/31/2026 Last Updated: 07/31/2026

At Refunnel, your privacy is a top priority. This Privacy Policy explains how we collect, use, share, and process personal data when you visit our websites (the "Site") or use any of the features, content, or applications we offer (the "Services"). It also explains your rights regarding the personal data we collect and manage.

The Site and Services are provided by Refunnel Inc., a Texas corporation, and its affiliates and business partners (collectively, "Refunnel," "we," "us," or "our").

If you have questions or concerns about this policy or our data practices, contact us at hello@refunnel.com or at the mailing address in the Contact Us section below.

Who This Policy Covers

Refunnel is a software platform. Our Services are used by two main groups:

Brands and agencies. Businesses that use Refunnel to run creator marketing campaigns, manage creator relationships, run partnership and whitelisted ads, and pay creators. For personal data that a brand uploads or imports into its own Refunnel workspace, the brand is the controller of that data and Refunnel acts as a processor or service provider on the brand's behalf. If you are a consumer whose data was uploaded by a brand, please direct your requests to that brand. We will assist them in responding.

Creators. Individuals who create accounts, join campaigns, submit content, connect social accounts, and receive payments through Refunnel. For creator account data, Refunnel is the controller.

This policy describes our own practices as a controller. Our processing on behalf of brand customers is governed by our customer agreements and, where applicable, our Data Processing Addendum.

Information We Collect

Data You Provide

Account and Profile Information. When you sign up or update your profile, we may collect your name, email address, phone number, username, password, job title, company name, mailing address, demographic details, and preferences. Creators may also provide portfolio content, photos, videos, files, audience information, rates, shipping address, and sizing or product preferences relevant to a campaign.

Contact Details You Upload. If you enter or upload contacts into your workspace or contact list, or share files with others, we collect the email addresses and related details needed to send invitations and enable collaboration. You are responsible for having a lawful basis to upload that data.

Content and Communications. Campaign briefs, messages, comments, content submissions, support requests, survey responses, and other information you send to us or through the Services.

Payment and Tax Information. For paid Services and for creator payouts, our third party payment providers collect payment details such as card information, bank or payout account details, and billing address. Where required by law, we or our payment partners collect tax identification information and tax forms such as a W-9 or W-8BEN. We do not store full payment card numbers on our systems.

Data Collected Automatically

Usage Data and Logs. IP address, device and browser type, operating system, referring and exit pages, pages viewed, search terms, links and ads clicked, timestamps, and other activity data.

Cookies and Similar Technologies. We and our partners use cookies, pixels, SDKs, and similar technologies to operate the Site, remember your preferences, measure performance, and support analytics and advertising. See the Cookies and Tracking Technologies section below.

Data From Third Parties

Connected Platform Data. If you connect a third party account such as Shopify, Instagram, TikTok, Meta, or an email provider, we receive data from that platform according to the permissions you grant. This can include profile information, audience and engagement metrics, content, product and order data, ad account and ad performance data, and message metadata. Our use of data from these platforms is also subject to their developer terms and policies. You can disconnect an integration at any time in your account settings or in the platform's own settings.

Business and Enrichment Sources. For business to business marketing and account management, we may receive business contact information from partners, data providers, publicly available sources, and referrals.

Payment Processors. Transaction status, payout status, and limited verification results.

Sensitive Personal Data

We do not seek to collect sensitive personal data such as government identification numbers, precise geolocation, health data, biometric data, or information revealing racial or ethnic origin, religious beliefs, or sexual orientation. Some information you volunteer, for example in a creator profile or a campaign about a health or wellness product, may be treated as sensitive under certain laws. Where required, we process this data only with your consent and only for the purpose you provided it. Please do not submit sensitive personal data unless it is necessary.

Why We Collect Your Data

We use personal data to:

Operate, maintain, secure, and improve the Site and Services
Create and administer accounts and authenticate users
Enable campaigns, creator discovery, collaboration, content submission, and file sharing
Process payments, creator payouts, invoices, and tax reporting
Provide customer support and respond to your requests
Send transactional and administrative messages such as welcome emails, service updates, security alerts, and policy changes
Analyze usage, run analytics, conduct market research, and develop new features
Publish comments you choose to post on our blog or public pages
With your consent or as otherwise permitted, send newsletters, promotional messages, and offers about Refunnel or our partners
Detect, investigate, and prevent fraud, abuse, spam, and violations of our terms
Comply with legal obligations and protect our rights, property, and users
Any other purpose we disclose to you at the time of collection

Legal bases. Where the GDPR or UK GDPR applies, we rely on: performance of a contract, our legitimate interests in operating and improving the Services and preventing fraud, compliance with legal obligations, and your consent where required. Where we rely on consent, you may withdraw it at any time.

AI and automated processing. We may use automated tools, including machine learning, to power features such as creator matching, content categorization, campaign recommendations, and fraud detection. We do not use these tools to make decisions that produce legal effects about you without human involvement. We do not use customer or creator content to train publicly available third party foundation models.

How We Share Your Information

We do not sell your personal data for money. We share personal data only as described below.

Between Brands and Creators. When a creator applies to or participates in a campaign, we share the profile, content, performance, and shipping or contact information needed to run that campaign with the brand. When a brand posts a campaign, relevant brand information is shared with creators.

Service Providers and Subprocessors. We share data with vendors who help us run the business, including cloud hosting, data storage, analytics, customer support and messaging tools, email delivery, payment and payout processors, tax compliance providers, and security services. They may only process data on our instructions and for our purposes.

Connected Platforms. When you use features that publish, whitelist, or run ads through a third party platform, we transmit the data necessary to complete that action to the platform, subject to your authorizations.

Business Partners. With your consent or as otherwise permitted by law, we may share information with partners to provide offers, promotions, or products that may interest you.

Legal and Safety. We may disclose data to comply with law, respond to subpoenas, court orders, or government requests, enforce our terms, or protect the rights, property, or safety of Refunnel, our users, or the public.

Corporate Transactions. If Refunnel is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred as part of that transaction. We will notify you of any material change to how your data is handled.

Aggregated or De-identified Data. We may create and share aggregated or de-identified data, such as benchmarks and industry reports, that cannot reasonably be used to identify you.

Cookies and Tracking Technologies

We use the following categories of cookies and similar technologies:

Strictly necessary. Required for login, security, and core functionality.
Functional. Remember settings and preferences.
Analytics. Help us understand how the Site and Services are used.
Advertising. Support marketing measurement and, on our marketing website, interest based advertising by us or our partners.

You can manage cookies through your browser settings and, where available, through our cookie preference tool on the Site. Some analytics and advertising cookies may constitute "sharing" or "targeted advertising" under certain state privacy laws. You can opt out using our cookie preference tool or the Do Not Sell or Share My Personal Information link on our Site.

Opt-out preference signals. We honor the Global Privacy Control (GPC) and similar opt out preference signals transmitted by your browser. Because these signals are device and browser specific, you may need to apply them on each browser and device you use.

Retention

We retain personal data for as long as needed to provide the Services and fulfill the purposes described in this policy. Typical retention practices:

Account and profile data: for the life of the account, then deleted or de-identified within a reasonable period after closure
Campaign, content, and collaboration records: for the life of the account and as needed to resolve disputes
Payment and tax records: as required by tax, accounting, and anti fraud laws, generally at least seven years
Marketing data: until you unsubscribe or your data is no longer relevant
Logs and security data: on a rolling basis consistent with our security needs

We may retain data longer where required by law, to resolve disputes, or to enforce our agreements.

Data Security

We maintain physical, administrative, and technical safeguards designed to protect personal data, including encryption in transit, access controls, least privilege permissions, logging, and vendor security review. No method of transmission or storage over the Internet is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password and notify us at hello@refunnel.com if you believe your account has been compromised.

International Data Transfers

Refunnel is based in the United States and our Services are hosted in the United States. If you access the Services from outside the United States, your personal data will be transferred to, stored in, and processed in the United States and other countries where we or our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where needed. You can request a copy of the relevant transfer mechanism by contacting us.

Your Privacy Rights

Depending on where you live, you may have some or all of the following rights:

Access and know. Request confirmation of whether we process your personal data and obtain a copy, along with the categories collected, the sources, the purposes, and the categories of recipients.
Correct. Ask us to correct inaccurate or incomplete personal data.
Delete. Ask us to delete your personal data, subject to legal exceptions.
Portability. Receive a copy of your data in a portable, machine readable format, or ask us to transmit it to another entity where technically feasible.
Opt out of sale, sharing, and targeted advertising. Opt out of any processing of your personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects.
Limit use of sensitive personal information. Where applicable, direct us to limit the use and disclosure of sensitive personal information to permitted purposes.
Withdraw consent. Withdraw consent where processing is based on consent.
Restrict or object. Ask us to restrict processing or object to processing based on legitimate interests.
Non-discrimination. We will not deny you Services, charge different prices, or provide a different level of quality because you exercised your privacy rights.
Lodge a complaint. If you are in the EEA or UK, you may complain to your local supervisory authority.

How to Exercise Your Rights

Submit a request by emailing hello@refunnel.com, using the privacy request form on our Site, or using the Do Not Sell or Share My Personal Information link on our Site. Please tell us which right you want to exercise and provide enough information for us to locate your records.

We will verify your identity before fulfilling a request, typically by confirming control of the email address on your account or by requesting additional information. We respond within the timeframe required by applicable law, generally within 45 days, and we may extend that period once where reasonably necessary. We will notify you if an extension applies.

Authorized Agents

You may use an authorized agent to submit a request on your behalf. We may require written proof of authorization and may still ask you to verify your identity directly.

Appeals

If we decline to act on your request, you may appeal that decision within a reasonable period by emailing hello@refunnel.com with the subject line "Privacy Request Appeal." We will respond in writing within 60 days and, if we deny the appeal, we will provide a method for you to contact your state attorney general to submit a complaint. Texas residents may contact the Office of the Texas Attorney General.

Texas Residents

We provide the rights described above, including access, correction, deletion, portability, the right to opt out of targeted advertising, sale, and certain profiling, and the right to appeal. We do not sell sensitive personal data or biometric identifiers.

California Residents

In addition to the rights above, California residents may request the categories of personal information collected, disclosed, or shared in the preceding 12 months, the sources, the business purposes, and the categories of third parties involved. We do not knowingly sell or share the personal information of consumers under 16 years of age. California residents may also designate an authorized agent as described above.

Nevada Residents

Nevada residents may submit a request to opt out of any future sale of covered information by emailing hello@refunnel.com.

Children's Privacy

The Services are not directed to children. You must be at least 18 years old to create a Refunnel account, receive payments, or enter into a campaign agreement. We do not knowingly collect personal data from anyone under 18. If we learn we have collected personal data from a child under 13, or from a minor under 18 in the case of an account, we will delete it. If you believe a minor has provided us personal data, contact hello@refunnel.com.

Third-Party Links and Services

The Site and Services may link to or integrate with third party websites and platforms. Refunnel does not control their privacy practices. Review their privacy policies before sharing personal information with them.

Marketing Communications

You can opt out of marketing emails at any time using the unsubscribe link in the message or by emailing hello@refunnel.com. We may still send transactional and account related messages, such as billing notices, security alerts, and service updates. If you receive SMS messages from us, you can opt out by replying STOP.

Do Not Track

Some browsers offer a "Do Not Track" setting. There is no common industry standard for responding to these signals, so we do not currently respond to them. We do honor Global Privacy Control signals as described above.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the Effective Date above. If we make material changes, we will provide additional notice such as an email or in product notice where required. Please review this page periodically.