Privacy Policy

This Privacy Policy describes how ReferLift, operated by LAX CURBSIDE LIMO, LLC (“ReferLift,” “we,” “us”), collects, uses, and shares information when you use the ReferLift websites, APIs, mobile applications, Partner Location guest pages, and related referral services.

Effective date: July 25, 2026. Last owner review: July 25, 2026.

Operator: LAX CURBSIDE LIMO, LLC, 7671 El Chaco Dr, Unit B, Buena Park, CA 90620.

Governing law notice: California.

Privacy contact: support@referlift.com.

ReferLift is a guest request system for hotels and restaurants. Guests request rooms, amenities, and local help, and staff handle those requests. Referral and commission tracking is secondary: Partners manage guest-facing Partner Locations, Service Providers receive referred customers on their own websites, and customers pay Service Providers directly. ReferLift tracks attribution, bookings, and Partner commission status; it does not process customer payments or automatic payouts.

Business users: Partners, Service Providers, and platform operators who create accounts, manage referral programs, Partner Locations, or use ReferLift dashboards.

Guests and other visitors: people who open a public Partner Location guest page (for example via a QR code), browse Location services or Explore Nearby listings, or follow a referral link such as /r/:code. Hotels are one supported Partner Location type.

Independent Service Providers listed on a guest page operate their own websites and booking flows. When you leave our page to contact or book with a Service Provider, that Service Provider’s privacy practices apply to information you give them.

Account information you provide when signing in (such as email address) and role, Partner, or Service Provider context associated with your account.

Partner and Location profile details needed to operate the product (such as business name, contact details you enter, guest-page configuration, and referral codes), when you are authorized to manage them.

Referral interaction data needed for attribution (such as referral codes opened or scanned, and referral session outcomes recorded by our servers).

Commission and manual commission-payment records associated with authorized Partner or Service Provider accounts (for example status labels such as Pending, Marked paid, Confirmed received, or Disputed).

Guest-page interaction events described in “Partner Location guest pages and limited analytics” below.

Device and technical information reasonably needed for security, rate limiting, diagnostics, and support (for example approximate client IP address and user agent on certain server requests and logs). We do not intentionally collect precise GPS location for advertising.

Camera images are processed on-device only when a mobile user chooses to scan a referral QR code in the mobile app; we do not upload camera frames for scanning unless a future feature explicitly requires it and this policy is updated.

When you open a public Partner Location guest page, our servers may store limited first-party interaction records so Partners and operators can see privacy-minimized usage counts and keep the experience working.

These records may include: an opaque guest-page QR identifier (publicId); event type (for example page opened, Location service opened, category opened, Service Provider selected, or outbound booking handoff); a browser-generated client event UUID used for deduplication; optional resource labels such as a public service or provider key; a sanitized JSON payload that excludes passwords, tokens, secrets, and room numbers; and timestamps. Events are associated with the Partner Location that owns the QR source—not with a guest login account.

The guest page does not require payment-card information merely to load or browse it. It also does not ask for your name, email address, phone number, or room number to load content. If you choose to call, message, email, or visit a Partner Location or Service Provider using links on the page, that contact happens outside our analytics payload and is governed by the party you contact.

If you leave this page to transact with an independent Service Provider, that Service Provider or its payment processor handles the transaction under its own terms and privacy practices.

Authorized Partners or platform operators may view aggregated counts (for example how many times a page was opened). The product does not expose a public guest feed of raw events.

Guest analytics are first-party. This guest experience does not intentionally use targeted-advertising SDKs, and this codebase does not include third-party advertising or marketing pixels on the guest page.

When a guest opens a referral link or scans a Partner QR code (including /r/:code style redirects), the ReferLift backend may create or update a referral session so conversions can later be attributed according to server rules.

Referral session processing may record technical metadata such as IP address and user agent, the referral code, and the destination URL used for the redirect.

If you continue from a guest page to an independent Service Provider, we may append a referral code to the Service Provider destination URL so attribution can continue. The destination site then receives that referral parameter under its own practices.

Financial and attribution outcomes shown to Partners and Service Providers are determined by the server. Clients do not invent commission totals.

Signed-in native sessions use access and refresh tokens stored in the device’s secure storage (SecureStore on native builds). Web sessions may use browser storage appropriate to the product surface.

Tokens are used to call ReferLift APIs on your behalf. Logging out clears the local session. Cached non-sensitive Partner summary data used for offline display may also be cleared on logout.

Do not share your credentials. ReferLift staff will not ask for your password by email.

Public Partner Location guest pages do not require an account or password.

If a Partner displays or shares a referral QR or link, others may open that link. Opens and subsequent bookings may be recorded by the service for attribution.

Partner Location QR sources use opaque public identifiers. Room numbers are not placed in guest URLs by design.

If you use Scan in the mobile app, the app reads QR payload text locally to validate a referral code format, then may open the referral resolver.

Customers pay Service Providers directly. ReferLift does not process customer payments or automatic payouts.

ReferLift tracks attribution, bookings, and Partner commission status. Service Providers may manually record that a commission payment was sent. Partners may confirm receipt or dispute a payment record. Status labels such as Pending, Marked paid, Confirmed received, and Disputed are operational records maintained by the service.

Authorized Partners and Service Providers may view commission-payment history associated with their account. Clients do not allow editing of confirmed history on the device. Questions about amounts or status should go through support or your Partner or Service Provider administrator.

The public Partner Location guest page does not require payment-card information merely to load or browse it. This repository does not implement a named card-payment SDK for that guest page.

If a guest leaves the page to transact with an independent Service Provider, that Service Provider or its payment processor handles the transaction under its own terms and privacy practices.

Camera permission is requested when a mobile user chooses to scan a referral QR code in the mobile app. You can deny permission and still use other features (for example, opening a typed or shared referral link).

Other OS permissions, if added later, will be requested in context and described in store listings and this policy.

We retain first-party application and server logs for security, reliability, rate limiting, and abuse prevention (for example failed sign-in attempts or API errors).

Hosting and security infrastructure may process technical logs, including IP address, user-agent, request time, and requested route, and may retain them according to operational and security needs and the hosting provider’s configuration. Those infrastructure practices are not fully verified in this policy and must be confirmed before production launch.

Product dashboards may show first-party aggregates derived from referral and guest-interaction data stored in our database.

We do not currently ship third-party crash-reporting or marketing analytics SDKs in this codebase. If such vendors are enabled later, this policy will be updated to name those providers before broad release.

To provide, secure, and improve Partner Location guest pages, referral attribution, Partner and Service Provider dashboards, and related APIs.

To show authorized operators privacy-minimized usage counts and operational history.

To detect abuse, enforce rate limits, troubleshoot errors, and protect the integrity of the service.

To communicate with account holders about security, support, and product operations (for example password reset email).

To meet legal, accounting, and compliance obligations applicable to the business.

We may share information with infrastructure and service providers that process data on our behalf, such as hosting and transactional email delivery, subject to contractual and technical controls appropriate to the service.

Partners that use the product may receive operational data for their own Locations and referral programs (for example aggregated guest-page counts, referral outcomes, and commission records they are authorized to view). Service Providers may receive referral and commission-payment records related to referrals they receive.

When you follow a referral or Service Provider booking link, the destination business receives the referral parameters and any information you submit on their site.

We may disclose information if required by law or to protect the rights, safety, and integrity of users and the platform.

ReferLift does not sell personal information. ReferLift does not share personal information for cross-context behavioral advertising. No targeted-advertising SDKs are intentionally used in the guest experience. If those practices ever change, we will update this policy and any required opt-out mechanisms before the change goes live.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, may provide you rights regarding personal information. LAX CURBSIDE LIMO, LLC is located in California and designs this notice for California-facing users of ReferLift.

Categories that may be collected, depending on how you use the service, include: identifiers (such as account email, account IDs, client event UUIDs, IP address on certain requests); customer records for business accounts; commercial and financial information related to referrals, commissions, and manual commission-payment records; internet or electronic activity (such as guest-page interaction events and referral opens); and professional or employment-related information for Partner or Service Provider staff accounts.

We do not intentionally collect sensitive personal information from guests through the public Partner Location guest page (for example government ID, precise geolocation, or account passwords). Business users provide account credentials and may enter business contact details.

Sources include: information you submit; information generated by your device or browser when calling our APIs; information from Partner configuration of guest pages and referral codes; and information from integrated booking or webhook partners when those integrations are used.

Business purposes include providing the service, security, debugging, analytics limited to first-party product metrics, and short-term transient use.

California residents may have the right to know/access, delete, correct, and opt out of sale or sharing of personal information, and to limit use of sensitive personal information where applicable. Because ReferLift does not currently sell personal information or share it for cross-context behavioral advertising, we do not present a “Do Not Sell or Share” opt-out workflow that would have no effect. You may contact support@referlift.com with privacy questions or requests. If our practices change, we will update this policy and required opt-out mechanisms before the change goes live.

To exercise a request, email support@referlift.com. We may need to verify your identity. Authorized agents may submit requests as permitted by law. We will not discriminate against you for exercising CCPA rights.

Intended retention limits for guest and referral technical data are:

Guest interaction events (guest_interaction_events): intended retention up to 12 months.

Private guest-request conversations and messages: provisional intended retention up to 12 months (owner review required before production deletion is enabled).

Referral-session IP address and user-agent fields: intended retention up to 30 days.

Aggregated or de-identified statistics may be retained longer when they can no longer reasonably identify a person or device.

The application includes a bounded retention-cleanup command for guest interaction events and referral technical fields. Private guest-request conversations are not deleted by that command. The command is not started by the API process, and a production schedule has not yet been configured or verified. Records may remain until an authorized operator enables and schedules the command; production scheduling and first-run verification remain required before launch.

Account, commission, manual commission-payment, and other business records are retained as needed to operate the service, meet legal and accounting obligations, and resolve disputes.

Hosting and security infrastructure logs (which may include IP address, user-agent, request time, and route) are retained according to operational and security needs and provider configuration, which must be verified before production launch.

We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information. No security method is completely secure.

Guest analytics payloads are sanitized to exclude passwords, tokens, secrets, and room numbers before storage.

Please use strong passwords and protect your device when using signed-in features.

Depending on your location, you may have rights to access, correct, delete, or restrict certain personal data, or to object to certain processing.

To exercise a request or ask a privacy question, contact support@referlift.com. We may need to verify your identity before fulfilling a request.

Guests who did not create an account can still contact us with the approximate time, Partner Location, and QR page they used; we may be limited in locating anonymous interaction records.

Account holders can request account deletion by emailing support@referlift.com or using the Account Deletion page / in-app Help & Support flow.

Deletion is processed manually after identity verification. The product does not claim automated erasure today.

Please include the email on your account and, if applicable, your Partner or business name.

ReferLift business tools are intended for business and Partner users. Partner Location guest pages are general information surfaces (including for hotel Locations where applicable) and are not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children.

We may update this Privacy Policy to reflect product, legal, or operational changes. The effective date and owner-review date above will be revised when material updates are published.

Within this application, the policy is available at the same-origin /privacy route. A public HTTPS URL (https://referlift.com/privacy) is planned for production listings but is not claimed live until verified after an authorized staging deployment.

Privacy questions and requests: support@referlift.com.

Support: support@referlift.com.

Mailing address: LAX CURBSIDE LIMO, LLC, 7671 El Chaco Dr, Unit B, Buena Park, CA 90620.