Not very privacy-friendly, is it? ;) Also, I think associating email addresses and referred users may not be covered by your privacy policy yet, you should check that.