Privacy Policy

This Privacy Policy explains how Get Me Referrals (operated by AUTOMATECORE PTY LTD, ABN 40 684 872 820) (“we”, “us”, “our”) handles personal information when you visit our website, create or use an account, or are referred to one of our customers through the Get Me Referrals platform (the “Service”).

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where the EU or UK General Data Protection Regulation (GDPR) applies to our handling of your information, we also comply with it.

We handle personal information in two different capacities:

• For our own purposes — information about website visitors, people who contact us, and the people who sign up for and use the Service (account holders). For this information we decide how and why it is used.
• On behalf of our customers — information that our customers and their partners put into the Service, such as details of people being referred (“Customer Data”). Our customer decides what Customer Data is collected and why, and we process it only to provide the Service to them and as described in our Terms of Service.

If you were referred to a business that uses Get Me Referrals and have questions about how your details are used, please contact that business first — they are responsible for your information. We will help them respond to your request.

• Account information: your name, work email address, phone number (if you add one), password (stored only as a one-way hash), workspace name, role and preferences such as time zone and notification settings.
• Workspace information: details of your organisation, teams, services, partners and routing rules, and records of activity in your workspace (for example who accepted a referral and when).
• Referral information (Customer Data): details about a person being referred, such as name, email address, phone number, company, a summary of their needs, notes, files and a record of their consent (how and when it was given and which privacy notice applied).
• Billing information: plan, billing period, invoices and payment status. Card details are collected and stored by our payment processor, Stripe; we never receive or store full card numbers.
• Communications: messages you send us through our contact forms or by email, and our replies.
• Technical and security information: IP address, browser and device information, the pages and features you use, timestamps, and signals from our bot-protection provider. We use this to operate, secure and troubleshoot the Service.
• Notification information: if you enable them, push-notification device tokens and the mobile number used for SMS alerts.

You don’t have to give us personal information, but if you don’t we may be unable to create your account, provide the Service or respond to you. You may contact us anonymously or using a pseudonym where that is practicable.

• Directly from you, when you sign up, use the Service, submit a referral form or contact us.
• From our customers and their partners, when they enter or import referral information into the Service, or when a person submits a customer’s public referral link.
• Automatically, through server logs, cookies and analytics tools when you use our website and the Service.
• From service providers acting for us, such as our payment processor confirming a payment.

We use personal information to:

• provide, operate and maintain the Service, including routing referrals, notifications and integrations you configure;
• create and secure accounts, authenticate users and prevent fraud, spam and abuse;
• process payments, issue invoices and manage subscriptions;
• respond to enquiries and provide support;
• send service messages such as security alerts, billing notices and changes to our terms;
• send product updates and offers to account holders, which you can opt out of at any time;
• monitor performance, fix problems and improve the Service;
• comply with our legal obligations and enforce our terms.

We use Customer Data only to provide the Service to the relevant customer, to keep it secure, and as required by law. We do not sell personal information, and we do not use Customer Data to market to the people it describes.

Where the GDPR applies, our legal bases are: performing our contract with you; our legitimate interests in operating, securing and improving the Service; your consent (for example, optional SMS alerts), which you can withdraw at any time; and compliance with legal obligations.

We use cookies that are strictly necessary for the Service to work:

• secure, HTTP-only session cookies that keep you signed in and protect against cross-site request forgery;
• a cookie that remembers which workspace you last used;
• Cloudflare Turnstile, which protects our forms from automated abuse and may process technical signals about your browser.

We also use Google Analytics to understand how our website and the Service are used — for example which pages are visited, how people arrive and which features are popular — so we can improve them. Google Analytics sets first-party cookies (such as _ga) and collects device, browser, approximate location and usage information. We do not send Google your name, email address or referral details, and we do not use Google Analytics for advertising. Google processes this information as described in its partner-sites policy. You can block these cookies in your browser settings or install the Google Analytics opt-out add-on.

We do not use advertising cookies. If that changes, we will update this policy and, where required, ask for your consent first.

We disclose personal information only as needed to run the Service, to these categories of recipients:

• Infrastructure and storage: our hosting providers and Amazon Web Services (file storage).
• Payments: Stripe, for checkout, subscriptions and invoicing.
• Communications: Brevo (email delivery), Twilio (SMS alerts you opt in to) and Google Firebase (push notifications).
• Security: Cloudflare, for bot protection and network security.
• Analytics: Google (Google Analytics), for aggregated website and product usage statistics.
• Your workspace: other users in your workspace, and partners you exchange referrals with, in line with the sharing settings your organisation chooses.
• Integrations you enable: for example a CRM or a webhook endpoint configured by your organisation.
• Professional advisers such as lawyers and accountants, under confidentiality obligations.
• Authorities, where required or authorised by law, or to protect the rights, property or safety of any person.
• A buyer or successor if we are involved in a merger, acquisition or sale of assets, subject to this policy.

Our service providers may use personal information only to provide services to us and must protect it.

Some of our service providers store or process information outside Australia — in particular the United States (including file storage with Amazon Web Services in the US), and countries in the European Union where our email provider operates. Payment, SMS, push-notification, analytics and security providers may also process information in other countries where they or their sub-processors operate. We take reasonable steps, including contractual commitments, to ensure overseas recipients handle personal information consistently with the APPs.

We protect personal information with administrative, technical and physical safeguards, including:

• encryption in transit (HTTPS/TLS) and encryption of stored integration credentials;
• strict separation of each customer’s workspace, enforced on every request;
• passwords and API keys stored only as one-way hashes;
• role-based access controls and an append-only audit trail of changes;
• files quarantined and scanned before they can be downloaded;
• secure, HTTP-only cookies that browser scripts cannot read.

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us immediately.

If we suspect a data breach, we act promptly to contain and assess it. Where a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme. If a breach affects Customer Data, we will notify the affected customer without undue delay and help them meet their own obligations.

We keep account and billing information for as long as your account is active and afterwards for as long as needed to meet legal, tax and accounting obligations and to resolve disputes. Customer Data is kept for as long as our customer uses the Service, and is deleted or de-identified after their account ends in line with our Terms of Service, unless the law requires us to keep it. Information in backups is overwritten on a rolling basis. When information is no longer needed, we take reasonable steps to destroy or de-identify it.

You can ask to access the personal information we hold about you and to correct it if it is inaccurate, out of date, incomplete or misleading. Many details can be updated directly in your account settings. Where the GDPR applies, you may also have rights to erasure, restriction, portability and objection, and to withdraw consent.

To make a request, use our privacy request form. We may need to verify your identity. We will respond within 30 days. If we refuse a request, we will tell you why and how to complain. For Customer Data, we will pass your request to the relevant customer and help them respond.

We may send account holders news about the Service and related offers. Every marketing email includes a way to unsubscribe, and you can also opt out by contacting us. You will still receive essential service messages, such as security and billing notices. We never send marketing to people whose details were entered as referrals.

The Service is designed for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children.

If you have a concern about how we have handled your personal information, please contact us first so we can try to resolve it. We will acknowledge your complaint promptly and aim to respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or, where the GDPR applies, to your local data protection authority.

We may update this policy from time to time. The version and effective date at the top of this page show when it last changed. If we make a material change, we will notify account holders by email or in the Service before it takes effect.

For privacy questions or requests, use our privacy request form or email hello@getmereferrals.com.

AUTOMATECORE PTY LTD, ABN 40 684 872 820