And you should have David sign some attorney approved Privacy release because when you pay me, I'll know he is your customer, and that violates (potentially) his privacy rights.
I have a real problem when banks try to use this to get out of the Privacy issue. They promote "refer a friend and we'll pay you $50". But to get the $50, my friend has to give up their legal right. If they don't sign the Privacy release, I don't get my money. I referred them. They opened the account, but if they don't sign the release, I'm out $50.
I think you have a problem on your hands either way:
1. If my friend doesn't sign the release, I'm mad that I played your game and didn't get my $50.
2. For me to get my $50, my friend has to give up their right to privacy.
Stinks all around.