Privacy Policy

1. Information we collect

When you create an account, we collect your name, email address, business information, and optionally a video introduction and profile photo. We also collect data you voluntarily provide in your “who I want to meet” and “who I can refer” fields. If you connect an optional integration such as Google Calendar or Zoom, we also process the limited data described in sections 4 and 5.

2. How we use your information

• To match you with other members via our AI engine.
• To facilitate introductions, bookings, and Zoom meetings.
• To send you transactional emails (booking confirmations, referral alerts).
• To improve our own matching algorithm over time. We never use data from connected Google services to train or improve any AI/ML models - see sections 4 and 6.

3. Video introductions, transcription, and AI processing

If you record or upload an optional video introduction, here is exactly what happens to it:

• Transcription. The audio in your video is automatically transcribed to text using speech-to-text technology, which may be provided by third-party AI service providers acting on our behalf.
• Indexing for matching. The transcript - together with your profile fields (business info, “who I want to meet,” “who I can refer”) - is indexed and processed by our AI matching engine to suggest relevant introductions. It is used only to power matching and search inside the platform.
• Third-party AI providers. Our AI features (profile matching and the in-app support assistant) are powered by third-party AI services accessed through their APIs. We send them only the profile and support content needed to provide the feature, under API terms that do not permit them to use our data to train or improve their own models. We never send data obtained from Google APIs (see section 4) to any AI service.
• Visibility. Your video is shown to other logged-in members as part of your profile. Transcripts are used internally for matching and are not published as a separate public document.
• Retention. We keep your video and its transcript while your account is active or until you replace or delete the video. Deleting your video from profile settings also removes its transcript from matching, and deleting your account removes both.
• Model training. We use your content to generate your matches - we do not sell it or permit our AI providers to use it to train their own models beyond providing the service to us.
• Your controls. The video is optional. You can record, replace, or delete it at any time from your dashboard settings, or email us for full deletion.

4. Google Calendar and Google user data

Connecting your Google Calendar is optional. If you choose to connect it, Referral Nova requests only the minimum access needed to schedule your calls - two calendar scopes, plus your Google account’s email address so the page can show which account is connected:

• calendar.events - to add a calendar event when you confirm a Referral Nova call, and to update or remove that event if the call is rescheduled or canceled. We only create, update, and delete the events that Referral Nova itself adds for your bookings.
• calendar.freebusy - to read only your busy/free time intervals (start and end times) so we never offer a booking slot when you are already busy. This scope returns only busy intervals; it does not give us the titles, attendees, descriptions, locations, or any other content of your calendar events.
• openid and email - to show “Connected as you@example.com” so you know which Google account is linked. We do not use this address for anything else.

We access this data solely to provide the scheduling feature to you, at your request. You can disconnect Google Calendar at any time from your dashboard settings, or revoke access from your Google Account permissions page. Disconnecting stops all further access and deletes the authorization tokens we stored for your account.

Limited Use. Referral Nova’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

No AI training on Google data. We do not use any data obtained through Google APIs - whether raw, aggregated, or derived - to develop, train, or improve any generalized or foundational artificial-intelligence or machine-learning models, and we do not transfer Google user data to any third-party AI/ML service. Your Google Calendar data is used only to power your bookings inside Referral Nova; it is never sent to our AI matching engine or to any AI provider.

5. How we protect your data

We treat the following as sensitive data: Google user data (the authorization tokens for your Google Calendar connection and the busy/free times we read with them), your account password, payment information, and the videos and transcripts you upload. We protect it with these mechanisms:

• Encryption in transit. All traffic between your browser, our application, Google, and the other services we rely on is encrypted with TLS (HTTPS, TLS 1.2 or higher). We never send or accept Google user data over an unencrypted connection.
• Encryption at rest. Our database and file storage are encrypted at rest with AES-256 by our hosting providers, including backups.
• Google OAuth tokens: encrypted in our application. On top of the encrypted database, the access and refresh tokens for your Google Calendar connection are encrypted by our application with AES-256-GCM (authenticated encryption, a new random value for each token) before they are stored. The encryption key is kept separately from the database, as a secret in our server environment, so a copy of the database alone does not reveal a token. Tokens are decrypted only in server memory, at the moment a scheduling action needs them, and are never shown in the app, sent to your browser, or written to logs.
• Google Calendar busy times are not stored. When we check your availability we read only busy/free intervals from Google, use them in memory to offer open slots, and do not save them.
• Passwords. Passwords are never stored in readable form; we keep only a salted bcrypt hash.
• Payment information. Card details are entered on and processed by Stripe, a PCI DSS Level 1 certified payment provider. Referral Nova never receives or stores your full card number.
• Access controls. Every request to our API is authenticated, and each member can reach only their own data and their own connected accounts. Access to production systems and data is limited to a small number of authorized team members, on a need-to-know basis, through accounts protected by authentication. No database table can be read through a public API (row-level security denies it), and the database accepts connections only with credentials held by our server.
• Least privilege for Google data. We request only the Google scopes described in section 4, use the data only to provide scheduling to you, and never sell it, use it for advertising, or use it to train AI models.
• Retention and deletion. When you disconnect Google Calendar, we delete its tokens immediately. When you delete your account, we delete your connected-account tokens and your personal data, except what we must keep by law (for example, payment records). You can request deletion at any time (see section 7).
• Incidents. If we become aware of unauthorized access to your personal data, we will act promptly to contain it and notify affected members and authorities as the law requires.

No method of transmission or storage is completely secure, but we use these industry-standard safeguards and review them as the service grows. Questions about how we protect your data can be sent to the contact address in section 9.

6. Information sharing

We do not sell your personal data. Your public profile (name, business info, video) is visible to other logged-in members. We share booking details only with the two parties involved in a call. We use third-party services (SendGrid for email, Twilio for SMS, Zoom for meetings, Stripe for payments, and third-party AI providers for matching and support) to deliver platform functionality; each receives only the data needed for its function. As stated in section 4, data obtained from Google APIs is never shared with any AI provider.

7. Your rights

You can update or delete your profile at any time from your dashboard settings. You can request a full export or deletion of your data by emailing privacy@referralnova.com.

8. Cookies

We use an HTTP-only refresh token cookie to keep you logged in across sessions. This cookie is not used for tracking or advertising.

9. Contact

Questions about this policy? Email privacy@referralnova.com.