Endorza™ Privacy Policy

1. Who is responsible

Refer Me Technologies Inc., operating as Endorza™, 650 1188 West Georgia Street, Vancouver, BC V6E 4A2, Canada. We are responsible for our own account, security, billing and analytics records.

For the customer records a participating business keeps in Endorza™, that business decides what is collected and why. We handle those records on its instructions. Contact the business first about its own records; contact us and we will help.

2. What we collect

• Account: your name, email address, optional mobile number, password (in hashed form) or Google sign-in, and the businesses you are connected to and your role in each.
• Referrals: the name and email address, and optionally the mobile number, of the person you refer, the business it relates to, referral status, and the confirmation you gave that you know the person.
• Rewards: what was earned, when it was issued, redeemed or reversed, and the reason for a reversal.
• Messages: the emails sent through Endorza™ and their delivery outcome (accepted, delivered, bounced, complained, unsubscribed).
• Preferences and consent: your communication choices, the exact wording you agreed to, and when.
• Technical and security: sign-in events, audit records of sensitive actions, and error logs.
• Product analytics: which features are used, keyed to a salted pseudonymous identifier rather than to your name.

We do not collect government identifiers, health information or payment card numbers. We do not buy personal information from data brokers.

3. If someone referred you

If you received an Endorza™ referral email, a customer of that business gave us your name and email address and confirmed they know you. The email tells you who referred you and to which business. You can unsubscribe from the link in that email, and you can ask us to delete your details at any time — you do not need an account to ask.

4. Why we use it

• To create and run your account and keep it secure.
• To deliver referrals, track progress and record rewards.
• To send service messages about your referrals, rewards and account.
• To send Endorza™ marketing email, only if you have switched it on.
• To prevent fraud, abuse and fake referrals.
• To fix problems and improve the product.
• To meet legal, tax and record-keeping obligations.

We rely on your consent for marketing and for optional analytics, on the need to perform our agreement with you for the rest of the account and referral functions, and on our legitimate interest in security and fraud prevention.

5. Who we share it with

• The business you are connected to. It sees your name, contact details, your referral activity with it, and your reward status. A team member sees less contact detail than an owner or admin. A business never sees your activity with a different business.
• Our service providers: Supabase (database, authentication, file storage — Canada / United States), Cloudflare (hosting and edge delivery — global), Resend (email delivery — United States). Each is bound to use the information only to provide its service to us.
• Authorities, where the law requires it or to protect someone from harm.
• A buyer, if the business is sold, on the same terms as this policy.

We do not sell personal information and we do not share it for advertising.

6. Where it is processed

In Canada and the United States. Where information is processed outside the country it was collected in, it may be accessible to courts and authorities there, and we use contractual protections requiring an equivalent standard of care.

7. How long we keep it

• Account records: while your account is open, then deleted or anonymised within 90 days of closure.
• Referral and reward records: up to 24 months after the referral is complete or cancelled, so disputes can be resolved.
• Consent and unsubscribe records: at least 3 years, because we have to be able to prove them and must not email a suppressed address again.
• Email delivery logs: 12 months.
• Security and audit logs: 12 months.
• Data exports you request: 7 days, then deleted automatically.
• Product analytics: 14 months, pseudonymous.
• Billing records: 7 years, as tax law requires.

Backups follow their own rotation and expire within 30 days.

8. Your choices and rights

• See your information. Request a full export from your account settings.
• Correct it. Edit your details in your account at any time.
• Delete it. Request account deletion from your account settings.
• Control messages. Manage every email category in your preferences, or use the unsubscribe link in any email.
• Withdraw consent. Turn off marketing or analytics at any time; it takes effect immediately and does not affect what happened before.
• Complain. To us first, and then to the Office of the Privacy Commissioner of Canada or your local regulator.

9. Security

Encryption in transit and at rest, row-level database rules so each business only reaches its own records, individual logins with no shared credentials, audit logging of sensitive actions, time-limited and recorded support access, and automatic backups. No system is perfect; if a breach affects you we will tell you and the regulator as the law requires.

10. Children

Endorza™ is for people aged 18 or older and is not directed at children. If we learn we hold information about someone under 18 we delete it.

11. Changes

We will publish a new version here if this policy changes and tell you if the change is material.

12. Contact our Privacy Officer

Privacy Officer, Refer Me Technologies Inc.
hello@endorza.me
650 1188 West Georgia Street, Vancouver, BC V6E 4A2, Canada

We respond to privacy requests within 30 days.