Privacy Policy

Data controller: MBADV Sas di Matteo Braghetta & C, an Italian agency, contactable at account@mbadv.agency.

This policy explains what personal data we collect when you use the MBADV Referral Program at refer.mbadv.agency, why we collect it, how long we keep it, and your rights under the EU GDPR and the Italian Data Protection Code.

When you sign up and use your referrer account, we collect:

• Email address (used to sign in and receive program notifications)
• Full name (used to sign the introduction emails you send)
• Country (optional, for our records)
• Preferred language (EN or IT)
• Payout currency (USD or EUR)
• Tax status and VAT number (if applicable)
• PayPal or bank details you provide for receiving payouts
• All invites you submit (prospect contact details, status timeline, your optional notes)
• Audit log entries showing actions you take (signup, invites, status changes, profile updates, data exports)

We also collect technical metadata (sign-in timestamps, IP address at signup) for security and fraud prevention.

When a referrer submits an invite, we receive the prospect's name, business email, optional company / website, and any context note the referrer provided. We use this data solely to:

• Send the prospect a single introduction email on behalf of the referrer
• Handle replies and any subsequent commercial relationship
• Track the invite's status so the referrer can see progress

The referrer warrants in our Terms that they have the prospect's consent to share their email with us. If you are a prospect who did NOT consent to this introduction, you can unsubscribe in one click from the link in our email or by contacting account@mbadv.agency. We will block any future invites to your address.

• For referrer data: contract performance (running the program you signed up for) and our legitimate interest in operating and improving the program.
• For prospect data: our legitimate interest in introducing potential customers to MBADV, conditional on the referrer's consent warranty. Prospects can object at any time via the unsubscribe link.
• For payment data: contract performance (paying the commission you earn) and legal obligation (tax records).

We use a small number of trusted processors to operate the program:

• Stripe (payment data and customer matching) — Stripe Payments Europe Ltd., Ireland, with sub-processing in the US under SCCs
• Resend (transactional email delivery) — Resend, Inc., US, under SCCs
• Railway (application hosting and primary database) — US company, but our database is hosted in their EU region (Amsterdam)
• Cloudflare (bot protection via Turnstile, DNS) — Cloudflare, Inc., US, under SCCs

We do not sell your data, and we do not share it with advertising networks.

Some of our processors are in the United States. Where data leaves the EU, we rely on the European Commission's Standard Contractual Clauses and our processors' certifications (Data Privacy Framework where applicable) as the legal mechanism for transfer.

• Active referrer accounts: while your account is open plus 10 years for tax/accounting records on payouts
• Closed referrer accounts: profile data deleted on request (see your rights below); commission & payout records kept for the legal tax retention period
• Invites and prospect data: 24 months from invite creation if there's no commercial follow-up. For prospects who became MBADV customers, the standard customer-data retention period applies (see MBADV's main privacy notice)
• Unsubscribe list: indefinitely, so we can keep honoring your opt-out
• Audit log: 5 years
• Webhook event logs (Stripe, Resend): 90 days for debugging

Under the EU GDPR you have the right to:

• Access the data we hold about you (referrers can download a full JSON export from /dashboard/settings)
• Rectify incorrect data
• Erase data we hold, subject to legal retention obligations (payouts must be kept for tax purposes)
• Restrict processing pending a dispute
• Object to processing based on legitimate interest (e.g. prospects can object via the unsubscribe link)
• Portability — the JSON export above satisfies this
• Withdraw consent at any time where consent is the legal basis
• Lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) or your local EU supervisory authority

To exercise any of these rights, contact account@mbadv.agency. We respond within 30 days.

We use the minimum cookies necessary to run the program:

• Authentication cookie set when you sign in, expires with your session
• Cloudflare Turnstile sets a short-lived cookie on forms to confirm you're not a bot
• Locale cookie remembering your language preference

We do not use analytics cookies or advertising trackers on the referral program subdomain.

We use industry-standard measures: TLS in transit, encryption at rest for sensitive fields (TOTP secrets), per-environment secret management, two-factor authentication for admin access, audit logging on all administrative mutations, regular dependency updates, and least-privilege database access. No system is perfectly secure; if we ever detect a breach affecting your data, we notify you within 72 hours per GDPR requirements.

We may update this policy. Material changes are notified to active referrers by email at least 30 days before they take effect. The version and effective date at the top of this page change with each update.

Questions or requests: account@mbadv.agency.

MBADV Sas di Matteo Braghetta & C · Italy · www.mbadv.agency