Privacy in plain language
DreamReferral does not install analytics, advertising pixels, fingerprinting scripts or tracking cookies. You do not need an account to read the site, and we do not sell personal data. Theme, locale and consent preferences can be stored only in your browser. This does not mean that hosting or email providers process no technical information.
This policy describes the DreamReferral website operator’s processing for dreamrefer.al. For privacy questions or rights requests, contact dreamreferral@duck.com. DreamReferral is the public-facing operator name and the controller for inquiries handled through this website. Provider products have separate controllers and policies.
Information you choose to send
Clicking an invitation button opens your email application with a suggested message. Nothing is submitted to DreamReferral merely by clicking. If you send the email, we receive your sender address, message, time and any information or attachments you include. We use these to answer your inquiry, provide an available invitation, address corrections or handle privacy requests.
Do not send passwords, one-time codes, identity documents, bank statements or payment details. We do not need these to provide an invitation. If sensitive information arrives accidentally, we aim to delete it rather than use it for another purpose.
Technical information and browser storage
Our static hosting provider, Netlify in production, may process IP addresses, request times, requested URLs, device or browser headers and security events to deliver and protect the site. The preview environment is operated by a different hosting platform and may have separate platform-level processing outside the production site’s code.
Three localStorage keys may be used: kr-theme, kr-locale and kr-consent. They are not cookies, are not sent automatically with network requests, and are not used to identify you across sites. The site does not transmit these preference values to us. See the cookie policy for the audit table and retention behavior.
Purposes and lawful bases
Where the GDPR or UK GDPR applies, responding to an inquiry relies on our legitimate interests in answering requests and maintaining this website, or taking steps at your request before a relevant arrangement where applicable. Security and abuse prevention rely on legitimate interests. Legal obligations may require retaining a specific record. We assess necessity and minimize the information used.
Nonessential analytics is not installed. The preference banner can record an analytics choice but does not activate a tracker, including after “Accept all”. If analytics is introduced later, this policy and the consent mechanism must be updated before it runs. We do not use inquiry addresses for unsolicited marketing.
Recipients and international transfers
Information may be handled by infrastructure and email service providers needed to deliver the website and receive or reply to messages. The duck.com email alias uses DuckDuckGo Email Protection routing; email delivery may also involve the recipient mailbox service and your own provider. An alias does not make email anonymous or end-to-end encrypted.
We do not send your inquiry to a featured product provider unless you request it or it is necessary and you are informed. Normally, you receive an invitation and contact the provider yourself. Service providers may process information outside your country. Where required, appropriate transfer safeguards such as adequacy decisions or standard contractual clauses should apply. Contact us for the safeguards relevant to a particular processing request.
Retention
We aim to delete ordinary inquiry correspondence within 90 days after resolution, unless follow-up is needed. Unresolved requests are reviewed periodically. Records needed for legal claims, abuse prevention or statutory obligations may be retained longer only for that purpose. Hosting providers determine operational security-log retention under their own service terms; we do not maintain a separate visitor analytics database.
Consent preferences are treated as expired after 180 days when you next visit. Theme and locale preferences remain until you change or remove them or your browser clears site data. Browser storage is not a server-side contact record.
Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You may withdraw consent without affecting processing that was lawful before withdrawal. We do not make solely automated decisions producing legal or similarly significant effects and do not profile visitors for advertising.
Email the contact above with enough information to locate your correspondence. We may ask for proportionate verification, but do not request unnecessary identity documents. Where GDPR applies, we aim to respond within one month, with a lawful extension for complex requests if required. You may complain to the supervisory authority where you live, work or believe an infringement occurred. Statutory rights are not limited by this policy.
External links and children
When you visit Revolut, Airalo, Nomad or another external resource, their terms and privacy practices apply. We do not control their cookies or processing. The website is not directed at children, and we do not knowingly solicit children’s personal data. Provider minimum-age requirements apply independently.
Security and changes
We minimize collection, use HTTPS and limit the information needed for inquiries, but no website or ordinary email channel is perfectly secure. We may update this policy to reflect actual processing. Material changes requiring consent will not rely on an old preference. The review date appears at the top of this page.