Privacy Policy

Version 1.4. Effective October 12, 2026.

This Privacy Policy explains how GoRefer.io LLC ("GoRefer," "we," "us" or "our") collects, uses, shares and protects personal information. It covers our website at gorefer.io, our webinar pages and the GoRefer service that tax firms and their teams use (the "Service"). It also covers the academy where learners buy and take courses from tax firms, which runs at gorefer.academy, at addresses ending in .gorefer.academy and on the custom domains firms connect to their academy. The Service is for businesses in the United States; academy learner accounts are for adults.

Section 2 explains how we handle the information tax firms store in GoRefer about their own clients, and section 2A explains how we handle the information of academy learners. If you are a client of a tax firm, your firm's privacy notice applies to that information. The GoRefer Autofill (Beta) browser extension has its own Extension Privacy Policy. To opt out of the sharing described in section 8.5, see Your Privacy Choices.

1. Information We Collect

1.1 Information You Provide

We collect information you give us when you:

• Register for an account (name, email address, company name, phone number)
• Subscribe to the Service (your plan and billing details; Stripe collects your card details, and we never store them)
• Add team members or preparers to your account
• Set up commission rules and payout settings
• Contact our support team or chat with us on our website
• Register for a webinar or sign up for our newsletter
• Take part in surveys or promotions
• Join GoRefer's affiliate program. You set up affiliate payouts with Stripe, which collects your payout and tax details. We do not store your taxpayer identification number.

1.2 Information Collected Automatically

When you use our websites or the Service, we automatically collect:

• Device information (browser type, operating system, device identifiers)
• Log data (IP address, access times, pages viewed, referring address)
• Usage data (features used, actions taken, session length)
• Cookies and similar technologies, as our Cookie Policy describes

1.3 Information from Third Parties

We may receive information from:

• Stripe: payment status and, for affiliates, whether payout setup is complete
• Integrations you connect: the account details and data an integration needs, such as your appointments when you connect Google Calendar
• Marketing partners: lead information, with your consent

1.4 Advertising Measurement

We advertise GoRefer on Meta's platforms (Facebook and Instagram) and measure which ads lead to visits and webinar registrations. To do that, the Meta Pixel runs on this public marketing website, when marketing measurement is turned on, and on our public webinar registration pages at app.gorefer.io/webinar/. It does not run inside the signed-in GoRefer application. The Pixel sets cookies that identify your browser (listed in our Cookie Policy) and reports page views and webinar registrations to Meta.

When you register for a webinar, we send Meta your email, phone and name in scrambled form, plus browser identifiers, so Meta can tell us which ads led to registrations. We send Meta nothing about your taxes and nothing from inside the signed-in application.

If your browser sends Global Privacy Control or Do Not Track, the Pixel does not load on these pages and we send Meta nothing about your visit. You can also block the Pixel with your browser's tracking protection or an ad blocker. Meta's own privacy policy governs what Meta does with the information it receives.

1.5 Advertising and Analytics Tags on Firms' Pages

Firms that use GoRefer can publish their own landing pages, at app.gorefer.io/p/ and at addresses ending in goreferme.to. A firm can add its own advertising and analytics tags to its pages: the Meta Pixel, Google Analytics, Google Ads and the TikTok pixel. GoRefer does not add these tags to a firm's page, and a page loads only the tags its firm has added.

The firm controls these tags. It decides which tags to add and which of its own accounts with Meta, Google or TikTok receives the data. The firm's tags load only after you agree in the page's cookie notice. They do not load when your browser sends Global Privacy Control. When you submit a form on a firm's page, the firm's tags may report that a form was sent. If the firm has also connected Meta's server-side measurement, we send the firm's Meta account the contact details you entered on the form in scrambled form; your other answers are not sent.

We host the page and load the tags on the firm's instructions, as its service provider under our Data Processing Addendum. The firm's own privacy notice applies, so please send questions about a firm's tags to that firm. If you send one to us, we will pass it on. Nothing from inside the signed-in GoRefer application is sent to a firm's tags.

2. Information We Process for Tax Firms

When a tax firm uses GoRefer, we store and process its clients' information, including tax documents, Social Security numbers, bank details and information about dependents, only to provide the Service to that firm and under its instructions. We act as the firm's service provider. The firm decides what it collects and how it uses it, and the firm's own privacy notice applies. Firms can publish their own Privacy Notice for their clients in GoRefer.

• Requests from clients. If you are a client of a tax firm, send privacy requests to your firm. If you contact us, we will pass your request to the firm and help it respond.
• Tax return information. GoRefer uses and discloses tax return information only to provide the Service to the firm. When a firm asks its clients for consent under section 7216 of the Internal Revenue Code, those consents are recorded in GoRefer.
• AI. Microsoft provides our AI services. It reads uploaded tax documents to pull out their details, and it runs Gio, our AI assistant. ElevenLabs provides the voice of Gio's voice assistant, so a conversation with it is processed there too. Before text is sent to an AI model, Social Security numbers, ITINs, EINs and bank account and routing numbers are masked. Names and other details can still be processed, and masking can miss a number written in an unusual way. Before AI reads a client's documents in the firm's intake, the client sees a short notice and can choose to continue without AI. We do not use this information to train AI models. More about how we use AI.
• Texts and picture messages. Firms can text their clients through GoRefer. The messages, and the numbers they are sent to and from, are stored with the firm's records.
• Calls and voicemail. Firms can make and receive calls through GoRefer. Voicemails are recorded and may be transcribed. If your firm records calls, the recording, and any transcript or AI summary made from it, are stored with the firm's records.
• Rewards. If a firm sends someone a gift certificate, our gift certificate provider (CMI) receives the recipient's email address to deliver it.
• No marketing use. We never use firms' client information for our own marketing, and we never sell or share it.
• How long it is kept. Life of the firm account, then deleted after cancellation (encrypted at rest). Section 6 explains what happens when a firm cancels.

2A. Academy Learners

This section is for people who create a learner account to buy and take courses that tax firms sell on the academy, at gorefer.academy, at addresses ending in .gorefer.academy and on the custom domains firms connect to their academy. One learner account works with every firm on the academy. Learner accounts are for adults (18 or older). The Academy Learner Terms apply.

• What we collect. Your name, email address and password (we store a hash of the password, not the password), the courses and bundles you buy and your subscriptions, your progress in each course, where you stopped in each video, your quiz answers and scores, the certificates you earn, and the IP address and device you sign in from.
• Who receives it. The firm that sells you a course receives your name, email address, what you bought and your progress in its courses, including quiz results and certificates. It can use your email address to send you announcements about its courses, and you can unsubscribe from those. The firm has its own privacy notice for what it does with that information. Stripe, on the firm's own Stripe account, receives your payment details when you pay; GoRefer never stores your card details. GoRefer's service providers, listed in section 4.1 and in our sub-processor list, process learner information for us under contracts that limit what they can do with it. We do not sell learner information.
• How long we keep it. Your account is kept until you delete it. An account with nothing active in it (no subscription and no purchase in progress) that has not been used for 3 years is deleted, and we email you 30 days before we do. Order records are kept for as long as tax records require.
• Download or delete your data. You can download your data and delete your account yourself from the account menu in your library. Deleting your account cancels your subscriptions at the end of the period you paid for and removes your name and email from your enrollments, orders and progress. A certificate you earned stays verifiable by its number, without your name. You can also email legal@gorefer.io, and section 8 explains the rights state laws give you.
• The anonymous visit counter. The academy's store pages count visits, course views and Buy clicks so firms can see how their store is doing. The counter sets no cookies and does not know who you are. It records a hash of your IP address and browser that is salted and changes every day. If your browser sends Global Privacy Control or Do Not Track, the visit is counted without even that hash. Academy store pages do not run advertising or analytics tags.

3. How We Use Information

We use the information we collect to:

• Provide, maintain and improve the Service
• Process transactions and send confirmations and invoices
• Calculate commissions and prepare payout reports and exports for your firm
• Pay commissions to members of GoRefer's affiliate program, through Stripe
• Send administrative messages, updates and security alerts
• Respond to your questions and support requests
• Send marketing email about GoRefer, which you can unsubscribe from at any time
• Measure our own advertising, as section 1.4 describes
• Understand how the Service is used, so we can improve it
• Detect, prevent and address fraud and security issues
• Comply with the law and enforce our terms

4. How We Share Information

4.1 Service Providers

These companies process information for us, under contracts that limit what they can do with it:

• Google LLC (Google Cloud): hosting for the application and its database
• Amazon Web Services, Inc.: file storage (including academy course videos, files and certificates), email delivery, notifications and backups
• Cloudflare, Inc.: bot checks on landing-page and webinar sign-up forms
• Stripe, Inc.: payments for GoRefer subscriptions and purchases, affiliate payouts, and client invoice payments a firm takes through its own Stripe account, and academy course payments on a firm's own Stripe account
• Twilio Inc.: text and picture messages, phone calls, voicemail and its transcription, call recordings and their transcripts when a firm records calls, and registration of firms' texting programs with phone carriers
• Microsoft Corporation: AI processing for Gio, including the text and images Gio produces for academy courses, and reading uploaded tax documents
• ElevenLabs: voice for our voice assistant
• CMI: gift certificates (receives the recipient's email address)
• Sentry: error monitoring
• HeyCatch: analytics on this public marketing website
• Meta Platforms, Inc.: measuring our own advertising (section 1.4). A tag a firm adds to its own landing page reports to that firm's Meta account, not ours (section 1.5).
• Beehiiv: our newsletter
• Sanity: content for our blog
• Apple Inc.: push notifications for the GoRefer admin app

4.2 Integrations Your Firm Chooses to Connect

These services receive information only if your firm, or a member of its team, connects them, and only what the connection needs:

• Zapier: the events your firm chooses to send, such as new leads or referrals
• Intuit QuickBooks: your firm's clients, added as customers in its QuickBooks account
• Google Workspace: Google Calendar appointments, Google Sheets imports and exports, and a staff member's own Gmail mailbox if they link it
• Zoho Mail: a staff member's own mailbox, if they link it
• Gusto: we prepare a payroll file that your firm uploads to Gusto itself; we send Gusto nothing

Your firm's agreement with each provider governs what it does with that information.

The complete, current list of both groups is in our Trust Center sub-processor list.

4.3 Mobile Numbers and Text Messages

We do not sell or share mobile phone numbers or text-message opt-in data with third parties or affiliates for their marketing. Text-message opt-in data is used only to send the messages you agreed to.

4.4 Legal Requirements

We may disclose information if required by law, regulation, legal process or a government request, or to protect the rights, property or safety of GoRefer, our users or others.

4.5 Business Transfers

If we are involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction. We will notify you of any such change.

4.6 With Your Consent

We may share information for other purposes with your consent.

4.7 No Sale of Personal Information

We do not sell personal information. The only sharing for advertising is the Meta measurement described in sections 1.4 and 8.5, and you can opt out of it.

5. Data Security

We use technical and organizational measures to protect personal information, including:

• Encryption in transit
• Additional encryption for sensitive intake fields such as Social Security numbers, EINs and bank and driver's license numbers
• Role-based access controls
• Audit logging
• Nightly encrypted backups, kept for 30 days
• Payment processing through Stripe; we never store card details

No method of transmission over the internet or of electronic storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We keep personal information for as long as we need it to provide the Service, meet legal obligations such as tax and accounting rules, resolve disputes and enforce our agreements. The main periods are:

• Firm account, team and client data: Life of the firm account, then deleted after cancellation
• Sensitive client fields: Life of the firm account, then deleted after cancellation (encrypted at rest)
• Messages: Firm messages: life of the firm account, then deleted after cancellation. Call recordings and voicemails: the periods the firm sets. GoRefer support texts and chat notes: 36 months
• Gio cases and their documents: Life of the firm account, then deleted after cancellation
• Gio background-job logs: 90 days
• Automation run history: 12 months by default; the firm can choose 30 days to 10 years
• Usage analytics in the Service: Up to 24 months
• Website analytics: 12 months
• Billing and payment records: At least 7 years (tax and accounting records)
• Deleted data in backups: Up to 30 days

When a firm cancels, we show the date its data will be deleted. After the retention period ends, we delete the firm's workspace: its users, client records, messages, call recordings, voicemails and Gio cases, the documents stored for it in our current document storage, and its account with our phone provider, whose numbers are released. Records on legal hold are kept until the hold is released. Billing and payment records are kept for at least 7 years for tax and accounting purposes, proof that a person agreed to receive messages or asked to stop is kept in a reduced form for up to 5 years, and our security audit trail is kept. Deleted data can remain in our backups for up to 30 days, until those backups expire. Each deletion is recorded. Ask legal@gorefer.io to confirm when your firm's data was deleted and what was kept.

The Trust Center retention schedule lists each period.

7. Your Rights and Choices

You can:

• Access a copy of the personal information we hold about you
• Correct information that is wrong or incomplete
• Delete your personal information
• Get a portable copy of your information
• Unsubscribe from marketing email, using the link in any marketing email
• Opt out of sharing for advertising, on our Your Privacy Choices page

To make a request, email legal@gorefer.io. Section 8 explains the rights state laws give you and how we handle requests.

8. Your State Privacy Rights

8.1 Who This Covers

This section applies to residents of California and of other states with consumer privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, and other states as their laws take effect. The rights differ from state to state.

It covers the personal information GoRefer handles for itself: visitors to our websites, people who register for our webinars, users of the Service, members of our affiliate program and academy learners (section 2A). Information that tax firms store about their clients is handled by GoRefer as each firm's service provider (section 2). If you are a firm's client, please make your request to the firm.

8.2 Your Rights

• Know and access: ask what personal information we have collected about you, where it came from, why we use it and who we disclose it to, and get a copy
• Delete: ask us to delete personal information we collected from you
• Correct: ask us to correct information that is wrong
• Opt out of sale and sharing: opt out of the sale of your information and of sharing it for targeted advertising (section 8.5)
• Limit: limit the use of sensitive personal information (section 8.6)
• Non-discrimination: we will not treat you differently for using these rights

8.3 Notice at Collection

This table lists the personal information we collect about the people in section 8.1, where it comes from, why we use it, how long we keep it and whether it is sold or shared.

8.4 Disclosures in the Preceding 12 Months

For the 12 months before the effective date of this policy, this is what we disclosed about the people in section 8.1:

• Disclosed for a business purpose. We disclosed every category in the table in section 8.3 (identifiers and contact details; commercial information; internet and device activity; communications; professional information; academy learner information; and sensitive personal information, which is your account login) to the service providers in section 4.1. They process it for us, under contracts that limit what they can do with it.
• Sold. We did not sell personal information.
• Shared for cross-context behavioral advertising. We shared two categories with Meta, to measure our own ads, as section 8.5 describes: identifiers (a webinar registrant's email, phone and name, in scrambled form) and internet and device activity (browser identifiers and page views on this public marketing website and our webinar pages). We did not share any other category this way.

8.5 Sharing with Meta and How to Opt Out

We share identifiers with Meta to measure our own ads. That is "sharing" under California law, and targeted advertising under some other states' laws. You can opt out with the Your Privacy Choices link or by turning on Global Privacy Control, which we honor. When your browser sends Global Privacy Control, we treat it as a request to opt out of sale and sharing, and the Meta Pixel does not load on this public marketing website or our webinar pages.

When you opt out on that page with your email address, or register for one of our webinars or send a form on a firm's page while your browser sends Global Privacy Control, we save your choice for the email address and phone number you give us. From then on we do not send Meta that email address or phone number, from our pages or from forms on firms' pages, and we do not tell Meta when you register for our webinars.

8.6 Sensitive Personal Information

We use sensitive personal information, such as your account login and password, only to provide the Service and keep it secure, as the law allows. We do not use it to infer things about you, so we do not offer a separate option to limit its use.

8.7 How to Make a Request

Email legal@gorefer.io, or use our Your Privacy Choices page to opt out of sharing. We confirm receipt within 10 business days and respond within 45 days. If we need more time, we will tell you why, and we may take up to 45 more days where the law allows.

• How we verify requests. We match the details you give us with the information we hold, and we may ask you to confirm the request from the email address on your account. We ask for more detail only when a request involves sensitive information, and we use it only to verify you. You do not need to verify a request to opt out of sale or sharing.
• Authorized agents. Someone you authorize can make a request for you. We will ask for your signed permission, and we may ask you to verify your identity with us directly.

8.8 Appeals

If we decline your request, you can appeal by replying to our decision or by emailing legal@gorefer.io with "Appeal" in the subject. We will answer within the time your state's law allows and explain our decision. If you are not satisfied, you can contact your state attorney general.

9. Children's Privacy

GoRefer is for businesses and is not directed to children under 13. Tax firms may store information about their clients' dependents, including minors, as part of a tax return. We process it only for that firm and protect it like other client tax information.

Academy learner accounts are for adults (18+). We do not knowingly create accounts for children under 13, and we delete one if we learn of it.

10. Google API Services

If you connect a Google account, for example to sync appointments with Google Calendar, GoRefer uses the Google information it receives only to provide that feature to you. GoRefer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

11. Where We Process Information

GoRefer is offered to businesses in the United States. If you use our websites or the Service from another country, your information is transferred to the United States, where privacy laws may differ from those in your country.

12. Third-Party Links

Our websites and the Service may link to other companies' websites or services. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

13. Changes to This Privacy Policy

We may update this Privacy Policy. We will post the new version on this page with its effective date, and we will email account holders before a material change takes effect.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or want to make a request, contact us by email. You can also opt out of sharing on our Your Privacy Choices page.

GoRefer.io LLC, Dallas, Texas
Email: legal@gorefer.io
Website: https://gorefer.io