Privacy Policy

Last updated: October 5, 2026 · Effective date: October 5, 2026

1. Who This Policy Covers

This Privacy Policy describes how Afamdi Achufusi, doing business as Chum ("we," "us," "our") collects and uses information through Chum (the "Service"). It applies to three different kinds of people who interact with the Service in very different ways, and this policy is organized around that distinction:

• Businesses — the companies who sign up for and administer the Service.
• Referrers — individuals a Business identifies as eligible to earn a reward for referring others.
• Referred customers ("Friends") — individuals who click a referral link and interact with a Business's own site or checkout as a result.

We do not have a direct relationship with Referrers or Friends — they interact with a Business's own referral program, and most of what we know about them comes from the Business, not from them directly.

2. Information We Collect

2.1 From Businesses

At signup and throughout your use of the Service, we collect: your business name, a description of your business, your industry category, transaction economics you provide (average transaction value, margin, and similar figures), and billing information processed through Stripe (we do not store full payment card numbers). If you connect Stripe, Square, or Tremendous, we store the authentication credentials (API keys, OAuth tokens) needed to communicate with those services on your behalf.

2.2 From Referrers

A Business assigns each Referrer an identifier of the Business's own choosing — this may be a name, an internal user ID, or similar, and is not something we generate or require to be personally identifying. If a Business wants to pay a Referrer through Tremendous, the Business provides us the Referrer's email address for that specific purpose.

A Referrer may also be given a private link where they can view their own click, conversion, and earnings data for a Business's program. That link — not a username or password — is what grants access; anyone holding it can view the data behind it. We do not send this link anywhere ourselves; it is the Business's responsibility to share it with the correct Referrer.

2.3 From Friends (Referred Customers)

When someone clicks a referral link, we record: the referral code that was clicked, a randomly generated visitor identifier (stored in a cookie and, where a Business has embedded our tracking snippet, in their browser's local storage), a hash of their IP address (not the raw IP address itself), and their browser's user-agent string. If a conversion is later recorded for that visitor, we also record whatever identifier the Business's own system uses for that customer and, where provided, the value of the transaction.

Where a Business uses Stripe, we also receive and store the Friend's email address directly from Stripe at the time of their purchase, for every conversion — not only where a Two-Sided Program (see Terms of Service Section 5.4) is enabled. We actively use this email for one specific purpose: where a Two-Sided Program is enabled, to enforce the Business's configured limit on how many times a single Friend can redeem the discount. For Businesses not running a Two-Sided Program, this email is stored but not otherwise used. Square does not supply this information to us the same way.

Where a Business has enabled a Square gift card reward (see Terms of Service Section 5.4), we collect a Friend's email differently: directly from the Friend themselves, through an optional form shown before they reach checkout — never required, and never collected without the Friend's own action. We use this email for exactly one purpose: to deliver a gift card once their purchase is confirmed. If the Friend does not provide an email at all, we never collect one. If they do provide one but never complete a purchase, we retain the email but do not use it for any purpose other than the gift card delivery described here — we do not contact the Friend for any other reason.

2.4 Cookies and Similar Technologies

When someone clicks a referral link for the first time, we set a first-party cookie on our own domain (ref_visitor_id) to recognize that visitor if they return, and show a brief, visible notice — before continuing automatically to their destination — that this cookie is being set and why, with a link back to this page. We do not ask for a click or any other action before continuing; the notice exists so this is genuinely disclosed rather than silent, not to gate access to a Business's referral program behind a consent click. A visitor who has already seen this notice on a prior click is not shown it again. Where a Business has embedded our client-side tracking snippet on their own site, that snippet also stores referral attribution data in the visitor's browser local storage, scoped to the Business's own domain, so the attribution survives navigation around the Business's site until a conversion occurs.

3. How We Use Information

We use the information described above to: operate the referral tracking and reward calculation described in our Terms of Service; detect and prevent fraudulent referral activity; process billing; communicate with Businesses about their account; and comply with legal obligations.

We do not sell personal information, and we do not use Referrer or Friend data for advertising or marketing purposes unrelated to operating the Service a Business has configured.

4. How Information Is Shared

4.1 With the Business Whose Program You Interacted With

If you are a Referrer or a Friend, the Business whose referral program you interacted with can see the data described in Sections 2.2 and 2.3 as it relates to their own program. We do not share your data with any other Business.

4.2 With Our Service Providers

We share information with the following third parties, solely as necessary to provide the Service:

• Stripe, Inc. — processes subscription billing (Business data) and, for Businesses who connect it, their own customers' payments (Friend transaction data, handled directly between the Business and Stripe).
• Square, Inc. — same role as Stripe, for Businesses who connect Square instead.
• Tremendous, Inc. — receives a Referrer's email address and payout amount solely to disburse their reward, where a Business has connected Tremendous.
• Render (or your hosting provider) — hosts our infrastructure and processes data as our data processor.
• Anthropic — where enabled, processes Business data for several distinct features, not just one: classifying a Business's industry category from their business description at signup; generating suggested marketing copy for a Business's referral program, using the Business's name, category, and computed reward amount; suggesting whether a held payout should be approved or rejected, using the relevant conversion context, hold reason, and the Referrer identifier the Business itself assigned (see Section 2.2 — this identifier is not required to be personally identifying, but may be, depending on what the Business chose to use); and summarizing a batch of failed payout attempts for administrative review. None of these features are required to use the Service, and none of them send Friend personal data, or a Referrer's contact information, to Anthropic.

4.3 Legal Disclosures

We may disclose information if required by law, or to protect the rights, property, or safety of the Service, our users, or the public.

5. Data Security

Access to Business accounts is secured by a two-key model: a secret key used for server-side operations and a separate public key restricted to link-creation only, so that even if the public key is exposed in a Business's client-side code, it cannot be used to access financial or customer data. Webhook communications from Stripe, Square, and Tremendous are cryptographically verified before being trusted. Session-based dashboard access uses browser-inaccessible (HttpOnly) cookies.

A Referrer's private stats link (see Section 2.2) uses a long, randomly generated token as its own access credential, rather than a username and password. This link only ever exposes that one Referrer's own click, conversion, and earnings data for one Business's program — never another Referrer's data, and never data belonging to any other Business.

No security measure is perfect, and we cannot guarantee absolute security of any information.

6. Data Retention

We retain Business, Referrer, and Friend data for as long as the associated Business account remains active. Once a Business's subscription is canceled, we permanently delete the Business's account and all Referrer and Friend data collected through that Business's program — including click, conversion, and payout records — 120 days after cancellation.

This 120-day period is enforced automatically, not just described here; it applies specifically to a canceled subscription, not to a free trial that simply expires without ever converting. We may retain information for a different period, or take a different approach for specific categories of data, as needed to comply with legal obligations, resolve disputes, or enforce our agreements.

7. Your Rights

Depending on your location, you may have rights to access, correct, or request deletion of your personal information. Because Referrers and Friends interact with a Business's own referral program rather than with us directly, requests concerning that data should generally be directed to the relevant Business in the first instance; we will assist Businesses in responding to such requests as needed.

8. Children's Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect information from children.

9. International Data Transfers

Chum is operated from the United States, and the information we collect is stored and processed on servers in the United States (Oregon). If you access the Service from outside the United States, your information will be transferred to and processed in the United States. The service providers described in Section 4 process information under their own policies and may do so in other countries.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will indicate the date of the most recent revision at the top of this page.

11. Contact

Questions about this Privacy Policy: aachufusi@chumreferrals.com