Privacy Policy

• Account and team information — name, email, profile details, organization, role, invitations, and seat status.
• Customers, prospects, connections, and references — names, contact details, roles, relationship context, assignments, and reference status.
• Projects and media — project history, locations, descriptions, photos, files, and related proof.
• Notes, stories, and identifiers — private notes, testimonial text, interests, traits, concerns, and attributes used for matching.
• Permission and consent records — contact preferences, opt-in or opt-out information, approved communication methods, and permissions for stories or photos.
• Page, portal, referral, and invitation activity — generated pages, privacy-safe interaction events, submissions, referrals, and related attribution.
• Subscription metadata — plan, seat count, status, renewal/trial dates, and payment-processor identifiers when billing is enabled. Raw card numbers are handled by the payment processor, not stored by ReferenceOS.
• Technical and security data — IP address, browser/device information, timestamps, error information, authentication events, and abuse-prevention signals made available by our infrastructure providers.
• Support and feedback — information you send us when requesting help or providing feedback.

• provide, authenticate, operate, and secure the Service;
• enforce workspace, role, assignment, and sharing permissions;
• generate matches, Reference Pages, Trust Pages, portals, referrals, and invitations you request;
• process subscriptions and seat changes when billing is enabled;
• provide support, diagnose errors, prevent abuse, and improve product reliability;
• send service/account communications and marketing where permitted;
• comply with law and enforce our Terms.

In Personal/Pro, the individual owner controls the private workspace. In Team/Enterprise, the subscribing organization controls the workspace and determines authorized users and roles. ReferenceOS uses role-based and record-level authorization so membership in a company does not necessarily provide access to every customer or private record.

Adding someone as a customer, connection, or potential reference does not automatically make them an active reference, publish their contact information, grant photo/story permission, or enroll them in promotional messaging.

Trust Pages, Reference Pages, invitations, and customer portal links are created to be shared. A recipient with a valid link may see the information intentionally exposed by that surface and may forward it. ReferenceOS applies current permission checks when a shared surface is requested, but cannot control copies or screenshots a recipient already made.

ReferenceOS acts as a controller for information needed to run user accounts, our own security, support, and direct business relationship with you. For customer, prospect, reference, employee, and other data a company or professional places in a workspace, that customer or organization is generally the controller and ReferenceOS processes the data on its instructions. Where required, enterprise customers may enter into a separate data-processing addendum with us.

We use service providers only as needed to operate the Service. Current or planned core providers include:

• Supabase — database, authentication, APIs, and private file storage;
• Vercel — application hosting and delivery for deployed ReferenceOS environments;
• Stripe — subscription billing and payment processing when billing is enabled;
• development, monitoring, email, messaging, analytics, and support providers as applicable.

We may also disclose information where required by valid legal process or in connection with a corporate transaction, subject to applicable law and contractual obligations.

ReferenceOS does not sell personal information to advertisers or data brokers and does not give advertisers access to private workspace records. We do not use customer/reference contact data for cross-site advertising.

If a company uses messaging or campaign features, it is responsible for having the legal right to contact each recipient. ReferenceOS may store delivery status, consent, suppression, and opt-out records needed to honor communication preferences. An approved reference is not treated as automatically opted in to promotional or referral-incentive messages.

We retain information while an account or organization needs the Service and for legitimate security, legal, tax, support, or dispute-resolution purposes. Deleted data may remain for a limited period in encrypted backups and operational logs before aging out through normal retention cycles. Team workspace deletion, transfer, or export may require an authorized owner rather than an individual rep or manager.

ReferenceOS uses row-level database authorization, tenant and role separation, private file storage, short-lived signed media URLs, server-side permission checks, encrypted transport, secure authentication, rate/abuse controls on public endpoints, and automated security tests. We do not claim certifications or compliance attestations we have not independently completed. Report security concerns to security@referenceos.app.

Depending on your location, you may have rights to access, correct, delete, obtain a copy of, or restrict certain processing of your personal information. Contact privacy@referenceos.app. If your request concerns information controlled by a ReferenceOS customer organization, we may direct the request to that organization and assist it in responding.

We use cookies and browser storage for essential functions such as authentication, workspace preferences, pending invitation/claim context, and attribution through signup. We may use limited product analytics for reliability and adoption. We do not use cross-site advertising cookies in private ReferenceOS workspaces.

The Service is not directed to children under 13. We are based in the United States and our providers may process information in the United States and other countries. Where required, we use appropriate contractual or legal safeguards for cross-border processing.

We may update this Policy and will provide reasonable notice of material changes. Privacy questions: privacy@referenceos.app. General support: support@referenceos.app. Legal notices: legal@referenceos.app. Security reports: security@referenceos.app.