GoRefer Trust Center
Privacy
Updated October 2026
GoRefer.io LLC ("GoRefer", "we", "us") protects the personal data of our customers, their clients and everyone who uses the platform. This page summarizes what we collect, why, and your choices. Our full Privacy Policy is the complete statement.
What Data We Collect & Why
Updated October 2026
We collect the data needed to provide the service. Supported sensitive intake fields use AES-256-GCM encryption. The service providers that receive data are listed on the Sub-processors page.
| Data Category | Examples | Why We Use It | Retention Period |
|---|---|---|---|
| Account & Identity | Name, email, phone number, profile photo | To run your account and sign you in | Life of the firm account, then deleted after cancellation |
| Tax Professional Data | PTIN, EFIN, firm name, specializations | To set up your firm and its team | Life of the firm account, then deleted after cancellation |
| Client Personal Data | Name, contact details, tax year information | To provide the service to your firm | Life of the firm account, then deleted after cancellation |
| Sensitive Identifiers | SSN, EIN, bank account, driver's license | To provide the service to your firm | Life of the firm account, then deleted after cancellation (encrypted at rest) |
| Usage & Analytics | Page views, feature usage, session duration | To understand and improve how GoRefer is used | Up to 24 months (marketing-site analytics: 12 months) |
| Communications | Support emails, in-app messages, texts, voicemail | To deliver messages and support | Firm messages: life of the firm account, then deleted after cancellation. Call recordings and voicemails: the periods the firm sets. GoRefer support texts and chat notes: 36 months |
| Payment Data | Last 4 digits, billing address (card details are held by Stripe) | To bill your subscription | At least 7 years (tax and accounting records) |
Deletion after cancellation
When a firm cancels, we show the date its data will be deleted. After the retention period ends, we delete the firm's workspace: its users, client records, messages, call recordings, voicemails and Gio cases, the documents stored for it in our current document storage, and its account with our phone provider, whose numbers are released. Records on legal hold are kept until the hold is released. Billing and payment records are kept for at least 7 years for tax and accounting purposes, proof that a person agreed to receive messages or asked to stop is kept in a reduced form for up to 5 years, and our security audit trail is kept. Deleted data can remain in our backups for up to 30 days, until those backups expire. Each deletion is recorded. Ask legal@gorefer.io to confirm when your firm's data was deleted and what was kept.
How We Use Your Data
Updated October 2026
Service Delivery
Signing users in and keeping sessions
Tracking referrals and calculating commissions for firms
Sending service emails and texts
Running AI features (Gio) that help preparers
Producing reports, exports and audit trails for firms
Running the Platform
Finding and fixing errors (Sentry)
Detecting suspicious activity and fraud
Billing and subscription management (Stripe)
Keeping records the law requires, such as tax and accounting records
We do not sell your firm's data or your clients' data
We never sell your firm's data or your clients' data, and we never use your clients' data for advertising. Our own marketing website and webinar pages use Meta advertising tags, which state privacy laws may treat as sharing. You can opt out at Your Privacy Choices (gorefer.io/privacy/choices).
Your Privacy Rights
Updated October 2026
Residents of California and other states with privacy laws have the rights below. To use one, go to Your Privacy Choices or email legal@gorefer.io. If you are a client of a tax firm that uses GoRefer, contact that firm first: it controls your information, and we help it respond.
| Right | What It Means |
|---|---|
Right to know and access | Ask what personal information we hold about you and get a copy |
Right to correct | Correct inaccurate personal information |
Right to delete | Ask us to delete your personal information, subject to legal record-keeping duties |
Right to a copy of your firm's data | A firm administrator can download a ZIP of the firm's records as CSV files, its stored client documents, e-signature records, compliance records, and its call log, text messages and notes. It does not include call recording and voicemail audio, Gio chat conversations, the email delivery log and team chat messages. It is available on every plan, including to a firm that cancels. If documents go past the export's size limit, the ones left out are listed in it. |
Right to opt out | Opt out of the sale or sharing of personal information and of targeted advertising, at Your Privacy Choices |
Right to equal treatment | We will not treat you differently for using these rights |
How we respond
We confirm your identity before acting on a request. We respond within 45 days, or tell you if we need up to 45 more. We check legal record-keeping duties before deleting anything.
Cookies & Tracking
Updated October 2026
Essential Cookies
Sign-in cookies keep you signed in
Browser storage keeps your theme and interface settings
The Cookie Policy and the extension privacy policy list what is stored
Analytics & Advertising
Our own usage analytics
Sentry error reports
Marketing-site analytics and Meta advertising tags are described in our Cookie Policy; they do not run inside the signed-in application
Your marketing consent choices are saved in your browser
Where the Service Is Offered
Updated October 2026
The service is for businesses in the United States. If you are outside the United States, contact legal@gorefer.io before using it. Our service providers, and where we can say they process data, are listed on the Sub-processors page.