Privacy

Who we are

Referral Booster is operated from British Columbia, Canada. We help home-service businesses turn happy customers into a tracked referral program. This policy explains what personal information we collect, how we use it, who we share it with, and the rights you have under Canadian privacy law.

What we collect

From visitors to this site: if you submit the waitlist or apply form, your name, work email, company, role, province, and the qualifying details you provide. We use cookies and analytics that record aggregated, non-identifying usage.

From operators using our product: account information (name, email, business name, addresses), billing information (handled by our payment processor; we do not store card numbers), and the customer records you choose to import or sync from your field-service software.

From your customers (the people you refer to as ambassadors): name, phone number, email, and the conversation history we mediate on your behalf. We collect this from you and on the basis of the implied consent created by their pre-existing relationship with your business (CASL §10).

Why we collect it

We use personal information only to deliver the service you signed up for. Concretely: to enroll customers in your referral program, to track which referrals came from which ambassador, to send SMS and email on your behalf, to fire reward payouts when invoices clear, and to support you when you ask for help. We do not sell or rent personal information to anyone.

Sub-processors

To operate the product we rely on the following sub-processors. Each has its own privacy policy and security commitments:

• Vercel — application hosting and edge delivery (US/global)
• Neon — Postgres database (US region, configurable)
• Clerk — user authentication (US)
• Twilio — SMS and voice routing (Canadian carriers Bell, Rogers, Telus for Canadian numbers)
• Anthropic — AI assistance for parsing inbound messages (US, no training on customer data)
• SendGrid — transactional email (US)
• Stripe — payment processing (US)

Some sub-processors are located in the United States. We rely on standard contractual safeguards consistent with PIPEDA cross-border-transfer requirements.

Retention

We keep operator account information for as long as the account is active, plus a reasonable retention period for tax and audit purposes (typically seven years for financial records). Customer records you import are deleted from our systems on operator request, or 90 days after the operator account is closed, whichever comes first.

Your rights

Under PIPEDA, you have the right to access the personal information we hold about you, to correct it if it’s wrong, and to withdraw consent. Quebec residents have additional rights under Law 25, including the right to deindexation and to data portability. To exercise any of these rights, email the address below. We respond within 30 days.

CASL and SMS

Our product sends SMS only on behalf of the operator, only to that operator’s existing customers (implied consent under CASL §10), and only with a clear opt-out path on every message. Customers who reply STOP, UNSUBSCRIBE, CANCEL, END, or QUIT are added to a permanent suppression list and we send no further messages. Quiet hours (9am–8pm in the customer’s local time) are enforced automatically.

Security

All connections to our service use TLS. Sensitive credentials (FSM API keys, webhook signing secrets) are encrypted at rest with AES-256. Authentication is handled by Clerk with industry-standard session management. We do not store payment-card numbers.

Changes to this policy

We will publish material changes here and date the update. If a change reduces your rights or changes how we use existing data in a material way, we will notify operators by email before it takes effect.

Contact

Questions, access requests, or complaints: privacy@referralbooster.ca. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.