Privacy Policy

Effective 2026-10-05

This Privacy Policy describes how RefSource ("we," "us," or "our"), operated by SyncTek LLC, collects, uses, and protects information when you use the RefSource iOS app or web applications. RefSource is a referral-management tool for professional service businesses.

Two kinds of data flow through RefSource. Account Data is information about you as a RefSource user. Customer Data is information you enter about your own customers and jobs in order to create and track referrals. For Customer Data, your organization (your "tenant") is the data controller and RefSource acts as a processor / service provider. We process it only to provide the Service on your organization's behalf, and never for our own independent purposes.

1. Information we collect

Account Data (about you)

• Name. The name you provide when you set up or are invited to an account.
• Email address. Collected when you accept an invite or sign in with a one-time email code. Used to authenticate you and to send service-related email (invite confirmations, notifications you opt into). Not used for marketing.
• Role and organization. Your role and the shop or company you belong to, used to scope your access within your tenant.
• User identifier. An internal user ID that associates your activity within your tenant. Not shared across organizations.

Customer Data (entered by you about your customers and jobs)

• Customer contact information. The name, phone number, and physical or service address of the customers and jobs you enter to create and track a referral.
• Referral and commission content. Referral notes, commission figures, job details, and other content you create or that is shared with you.
• Photos and videos. Attachments you add to a referral or thread message. Stored in our object storage and visible to your organization and the specific partner shop on that referral, the two businesses working the job together, and no one else.
• Voice notes. Audio recordings you attach to a referral. Stored in our object storage and visible to your organization and the specific partner shop on that referral.
• Jobsite location (optional). If you tap "Use my location" while creating a referral, the iOS app captures your device's precise location once to autofill the jobsite address. It is opt-in, one capture per use, never in the background, never continuous, and never used for ads, analytics, or tracking. The location is saved on that referral and visible to your organization and the specific partner shop on that referral, the same as an address you type in by hand. Our web applications do not request or use your location.
• Machine translation. When someone at your shop taps Translate on a referral note or message from a referral partner (a partner shop or a referrer), or someone at a partner shop taps Translate on one of yours, RefSource translates that one note or message using an Anthropic Claude model on AWS Bedrock. If you are a referrer, someone at a shop on the referral can tap Translate on a note or message you wrote. Nothing is translated unless someone taps Translate. The text you or your partner wrote, which can include customer names, addresses or phone numbers if you typed them, is sent to the model to produce a translation. Translations are kept for up to 90 days. The original is always kept and shown on request. This content is not used to train AI models.
• AI-assisted referral drafting (when enabled). On accounts where AI drafting is turned on, RefSource uses AI to turn a voice note or photos you attach into a referral draft. AWS Transcribe converts your voice note to text, with personally identifying details redacted at the point of transcription, and an Anthropic Claude model running on AWS Bedrock reads that transcript and your photos to suggest the referral's details: job type, address, notes. You review and edit the draft before anything is sent, and nothing goes to your partner until you send it. Your voice notes and photos are not used to train anyone's AI models.

Technical and diagnostic data

• Device and usage data. A device identifier and basic information such as app version, used to operate the Service and diagnose issues.
• Crash and error data. We use Sentry to capture crash reports and error events from the app and backend services. Sentry events do not include attachment contents, OTP codes, or other secrets. We have configured Sentry to strip personally identifiable information from breadcrumbs and to never send default PII.

2. Information we do NOT collect

• We do not track your activity across other apps or websites.
• We do not sell, rent, or share your personal information with third parties for marketing or advertising purposes.
• We do not use advertising or marketing trackers of any kind. The one third-party diagnostics SDK in the app is Sentry, used for crash reporting and a small sample (10%) of performance traces so we can find and fix bugs. It is configured to strip personal data from what it sends us. See Subprocessors below for the full list of who touches your data and why.
• We do not collect your location in the background, continuously, or for tracking. The only location we ever collect is the one-time, opt-in jobsite autofill described in Section 1, and only on iOS when you tap "Use my location."

3. Required-reason APIs (Apple)

The iOS app uses the following Apple APIs for the listed legitimate purposes:

• UserDefaults (reason: CA92.1), to persist user-selected app preferences across launches.
• FileTimestamp (reason: C617.1), to display creation and modification timestamps on user-attached files.
• SystemBootTime (reason: 35F9.1), to compute elapsed time for diagnostic measurements.
• DiskSpace (reason: E174.1), to verify available storage before downloading attachments.

4. How we use information

• To authenticate you and authorize your access to your tenant's data.
• To provide the referral-management features you use: create and track referrals, record commissions, and store the documents tied to a job.
• To deliver service-related transactional email and one-time passcodes.
• To diagnose and fix crashes and errors.
• To comply with legal obligations.
• To translate a note or message from a referral partner (a partner shop or a referrer) when someone at your shop taps Translate on it, or one of yours when someone at a partner shop does.
• When AI drafting is enabled for your account, to draft a referral from the voice note or photos you attach, using the AI services named in Section 5, always subject to your review before anything is sent.

5. Subprocessors

We share data with a limited set of subprocessors that process it on our behalf under contract. We name all of them here rather than promising there aren't many:

• Amazon Web Services (AWS). Cloud hosting, database, object storage, authentication (Cognito), and secrets management. United States region.
• AWS Bedrock, running an Anthropic Claude model. Translates a referral note or message from a referral partner when someone taps Translate on it. On accounts where AI drafting is enabled, it also reads the voice-note transcript and photos you attach to help draft a referral. You review every draft before it is sent. Content processed this way is not used to train AI models.
• AWS Transcribe. On accounts where AI drafting is enabled, converts your voice notes to text. Personally identifying details are redacted at the point of transcription.
• AWS SNS. SMS delivery for one-time-passcode sign-in.
• Resend. Transactional email delivery, including one-time-passcode sign-in emails.
• Stripe. Payment processing for subscriptions. Stripe collects your card details directly; we never receive or store your full card number.
• Sentry. Crash and error diagnostics, plus a 10% sample of performance traces, configured to strip personal data.
• Instantly. Sends our outbound marketing email to prospective shops who have not signed up. Never used for messages to existing account holders, and no Customer Data is shared with it.

A current list of subprocessors is available on request at [email protected]. We do not authorize any subprocessor to use your data for its own purposes.

6. Cookies and local storage

Our web applications use strictly necessary cookies and browser local/session storage to keep you signed in and remember your preferences. We do not use advertising or cross-site tracking cookies.

7. Your privacy rights

Depending on where you live, you may have rights over your personal information, including the right to access or know what we hold, to delete it, to correct it, and to receive a portable copy (export). Residents of California (CCPA/CPRA) and individuals in the EEA and UK (GDPR) have these rights among others, including the right to restrict or object to certain processing.

We do not sell your personal information and do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising your rights.

To exercise a right, email [email protected]; we will respond within the timeframe required by applicable law. Where the request concerns Customer Data, your organization is the controller. Please direct the request to your tenant administrator, and we will assist them as processor. For EEA/UK users, we process personal data to perform our contract with your organization, to pursue our legitimate interests in operating and securing the Service, and with consent where required.

8. Data retention

We retain Account Data and tenant data while your account or tenant remains active. Referral and commission records may be retained longer where we need them to meet legal, tax, or audit obligations, or to resolve disputes. Media attachments (photos and videos) that are no longer referenced by an active thread are automatically deleted after 90 days. Voice notes are retained for the life of the referral and for 12 months after it closes, can be deleted by your tenant at any time, and are purged when your tenant is deleted. Machine translations are deleted automatically about 90 days after they are created (backup copies expire on our normal backup schedule). If you report a translation problem, the report, including the translated text you saw, is deleted from our support inbox within 90 days; a copy is kept with our support records. You can request export or deletion of your personal data at any time by emailing [email protected]; we will complete verified requests within 30 days.

9. Data security

Data is encrypted in transit (TLS 1.2+) and at rest. Customer Data is logically isolated per tenant using row-level security in our database; it is not visible to other tenants except where you explicitly share it with a referral partner as part of the Service's core functionality (see Terms, Section 8). Access to production systems is restricted to a small operations team.

10. Children's privacy

RefSource is intended for use by professional service operators. We do not knowingly collect information from children under 13. If you believe a child has provided information, contact us and we will delete it.

11. Changes to this policy

We may update this policy. The effective date at the top reflects the most recent revision. Material changes will be communicated by email or in-app notice.

12. Contact

Privacy inquiries: [email protected]
General support: [email protected]
Postal mail: SyncTek LLC, attn: RefSource Privacy, 5540 Centerview Dr Ste 204 #462485, Raleigh, NC 27606