Last updated: October 26, 2026 · Effective on posting
Were you referred or did you apply? Open your privacy center
See who referred you, which employers can see your contact details, download your data, and withdraw consent or delete your data. No account needed.
Hidden until you say yes
Referred candidates’ contact details are never shown to an employer without their consent.
No sale, no ad tracking
We don’t sell personal information or share it for advertising, and use no third-party trackers.
Self-serve rights
See, download, correct or delete your data from the privacy center in minutes, with or without an account.
ReferYes ("ReferYes", "we") runs a referral jobs marketplace at referyes.com. Employers and hiring managers post roles; sourcers refer people they know; candidates are referred or apply directly; affiliates introduce employers. This policy explains what personal information we collect from each of these groups and from site visitors, why, who sees it, how long we keep it, and the rights you have over it.
It is written to meet the California Consumer Privacy Act as amended by the CPRA, and the comparable privacy laws of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Utah and other US states, as well as the federal CAN-SPAM Act and equal-employment recordkeeping rules. If you are outside the United States, see §12.
Employers use ReferYes to receive referrals and applications. When an employer processes your information in its own systems after a hire, the employer’s privacy notice applies to that processing.
The table below is our notice at collection. "Service providers" are the vendors listed in §6, who may only use your information to provide their service to us.
| Category | Examples | Collected from | Used for | Disclosed to | Kept |
|---|---|---|---|---|---|
| Identifiers | Name, email address, phone number, LinkedIn profile address, account ID, IP address | You; the sourcer who refers you; automatically when you use the site | Accounts and sign-in; running referrals and applications; contacting you; fraud prevention | Hiring team for the role (after consent for referred candidates); service providers | Account life, then see §9 |
| Professional and employment information | Current title and employer, résumé, work history, education, skills, salary expectations, cover letter, interview notes and scorecards, offer details | You; your referrer; the hiring team; the public LinkedIn profile you or your referrer give us | Matching you with roles; letting hiring teams evaluate you; scheduling interviews; recording offers and hires | Hiring team for the role; the sourcer (status only, not interview content); service providers | Account life or 18 months of inactivity for prospects, then see §9 |
| Commercial and financial information | Credits purchased, finder’s fees, payouts, Stripe account status. We never see or store card numbers | You; Stripe | Billing, escrow and payouts; tax reporting | Stripe; tax authorities where required | 7 years (tax and accounting) |
| Internet and device activity | Pages viewed on our landing page, buttons clicked, browser and device type, referring page, approximate region from IP | Automatically, with your cookie choice | Keeping you signed in; measuring and improving the site; security | Hosting provider | Landing-page analytics 90 days; server logs per hosting provider |
| Communications | Messages exchanged on ReferYes, emails we send you and whether they bounced, interview availability you submit | You; the people you message | Delivering messages; scheduling; keeping a record of consent and notices | The other party to the conversation; email delivery provider | Account life; redacted on deletion |
| Calendar information (optional) | Free/busy times and interview events, only if you connect Google Calendar or set your availability (My availability) | Google, with your authorization | Showing open interview slots and creating calendar events | Google; the candidate or interviewer being scheduled (times only) | Until you disconnect the calendar |
| Sensitive personal information (voluntary) | Race or ethnicity, veteran status, disability status and gender from the optional EEO self-identification form | You, only if you choose to answer | Aggregate equal-opportunity and affirmative-action reporting (EEO-1, OFCCP) for the employer. Never used in hiring decisions | Aggregate reports only; individual answers are not visible to hiring teams | The period required by federal recordkeeping rules, then deleted |
| Inferences | AI-generated candidate summaries, résumé parsing, match scores and suggested roles | Derived from the information above | Helping sourcers and hiring teams review candidates faster | Hiring team for the role; the sourcer; AI model providers (processing only) | With the profile they describe |
We do not collect precise geolocation, biometric information, government identifiers, or the contents of your email or messages outside ReferYes. We do not knowingly collect information from anyone under 18 (§11).
Business contacts. When we contact companies about ReferYes, we may collect professional details about people who work there from public sources, such as their name, job title, employer, business email address or LinkedIn profile, and use them only to reach out about our services. If you are one of these contacts, you can ask us to stop contacting you or to delete these details at any time through the privacy center or by emailing privacy@referyes.com.
When a sourcer refers you, they confirm that you know about the referral. We store your name, title, résumé and contact details, but the employer sees only your professional profile: your name, email and phone are withheld.
If the employer is interested, we email you a connection request describing the role and the employer. Nothing is revealed until you accept. If you decline, or simply do not answer before the request expires, the employer never sees your contact details, and you can delete your profile from the same email.
You can withdraw consent at any time from your privacy center (§8). Withdrawing hides your contact details from the employer on ReferYes again; if they already contacted you directly, they may still have your details outside ReferYes. Once you have been hired through a referral, the record of that hire is kept for payment and legal reasons and cannot be withdrawn from the privacy center; contact the employer directly about data they hold.
Sourcers see the status of their referral (for example "interested", "interviewing", "hired") and the finder’s fee they earn. They do not see interview notes, scorecards or offer details.
ReferYes uses AI models to turn a résumé or a public LinkedIn profile into a structured profile, to write short candidate summaries, to score how well a profile matches a role, and to suggest roles to sourcers. These outputs are suggestions shown to people; every decision about whether to contact, interview, hire or pay someone is made by a person at the employer or at ReferYes. We do not make decisions with legal or similarly significant effects on you by solely automated means.
To produce these outputs, the relevant text (for example, your résumé) is sent to AI model providers through our hosting platform. These providers act as service providers: they may process the data only to return the result to us. You can ask to see or correct any inference about you (§8).
Google Sign-In. If you sign in with Google, we receive your name, email address and profile picture from your Google account. We use them only to create and secure your ReferYes account and sign you in. We do not receive your Google password.
Google Calendar (optional). If you connect Google Calendar, we access your free/busy times and the interview events ReferYes creates, only to show your open interview slots and add scheduled interviews to your calendar. We do not read the content of other events. You can disconnect at any time in Settings, and we stop accessing your calendar immediately.
How we handle Google data. We do not sell Google user data, use it for advertising, or use it to train AI models, and we do not send Google Calendar data to AI model providers. We share Google user data only with the service providers in §6 that are needed to run these features.
ReferYes's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke ReferYes's access at any time from the security settings of your Google Account.
Depending on where you live you have some or all of the rights below. We give them to everyone in the United States regardless of state, and we never discriminate against you for using them.
How to exercise them. Referred candidates and applicants, with or without an account: use the privacy center, which emails a one-time link to the address we hold so that only the owner of that address can see, download, withdraw or delete its data. Account holders: use Settings, or the privacy center with your account email. Anyone: email privacy@referyes.com or write to the address in §13. Requests made through the privacy center are verified by control of the email address and actioned immediately; other requests are verified by matching the details you give us against our records and may need a reply from the email address on file. We respond within 45 days, and tell you if we need up to 45 more.
Authorized agents may submit requests on your behalf with your signed permission; we may also ask you to confirm the request directly with us.
Personal information is stored with our hosting provider in the United States, encrypted in transit and at rest. Access inside ReferYes is governed by role-based rules enforced on every record: hiring teams see only their own roles’ candidates, sourcers only their own referrals, and individual EEO answers are visible only to administrators. Contact details of referred candidates are withheld from employers until consent. Privacy-center links are single-use secrets of which only a hash is stored. We run automated security regression checks and keep an audit log of consent, disclosure and privacy events. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you and the authorities as the law requires.
ReferYes is for adults. You must be at least 18 to create an account, apply for a role or be referred. We do not knowingly collect personal information from anyone under 18; if you believe we have, email privacy@referyes.com and we will delete it.
ReferYes is operated from the United States and our providers store data there. If you use ReferYes from elsewhere, your information is transferred to and processed in the United States, where privacy laws may differ from those of your country. Where the GDPR or UK GDPR applies, our legal bases are performance of a contract (operating your account and referrals), legitimate interests (running and securing the marketplace), consent (revealing a referred candidate’s contact details, optional analytics, EEO answers) and legal obligation, and you have the same rights described in §8 plus the right to lodge a complaint with your supervisory authority.
We will post any change here with a new "last updated" date and, for material changes, tell account holders by email or in the app before the change takes effect.
Privacy questions and requests: privacy@referyes.com. Postal address: ReferYes · San Jose, California, USA. For legal notices: legal@referyes.com.
ReferYes does not sell or share personal information, so there is no sale or sharing to opt out of. These are the choices that apply.
Open your privacy center to see everything we hold for your email address, download it as a file, and withdraw consent from any referral. We email a one-time link so only the owner of the address can use it.
Open my privacy centerStop non-essential emails from ReferYes. Account holders can also change individual notifications in Settings. Essential account, security and legal notices may still be sent.
Ask us to delete your personal information. We email a confirmation link to the address first so that only you can delete your data; the deletion runs as soon as you confirm, except for records the law requires us to keep (§9).
Change whether optional first-party analytics run in your browser. Browsers sending the Global Privacy Control signal are set to "Essential only" automatically.
Privacy questions, requests and appeals: privacy@referyes.com · ReferYes · San Jose, California, USA
Essential cookies keep you signed in; optional analytics help us improve. Privacy