1. Who we are
refine8 is operated by [Legal entity name], a [type of entity] registered in [state or country], with its principal office at [postal address] ("refine8", "we", "us"). For the personal information described in this notice, refine8 is the controller, meaning we decide how and why it is used.
[If applicable: Our representative in the European Union is [name and address]. Our representative in the United Kingdom is [name and address].]
2. What this notice covers
This notice covers personal information we collect when you visit refine8.com, contact us, apply to our Partner Program, or otherwise do business with us as a provider, buyer, partner or prospective customer.
It does not cover the data that providers license through refine8. That data is handled under written agreements with each provider, and is de-identified before it is made available to anyone else. See Data in our products below.
3. Information we collect
Information you give us
- Contact form: your name, work email, company, what you want to do (license data, find data, partner, or get early access), your industry or use case, any message you write, and whether you would like our NDA.
- Partner application: your name, job title, work email, phone number (optional), company, website, company size and headquarters country, plus answers about your data, platform or firm, your goals, your timeline and how you heard about us.
- Emails and calls: anything you share when you write to us or speak with our team.
- Business relationships: contact and billing details for people at providers, buyers and partners we work with, and records of agreements, licenses and payments.
Please do not send us personal information about other people, or sample data, through our website forms. If a conversation needs data, we will arrange a secure channel.
Information collected automatically
Like any website, our hosting provider receives basic technical information when you visit: your IP address, browser type, the pages you request and the time of the request. This is kept in standard server logs for security and to keep the site running. Our pages also load fonts from Google Fonts, which means your browser sends your IP address to Google when it fetches them.
We do not use cookies, analytics, advertising pixels or any other tracking on this website.
4. How we use it
We use personal information only for the purposes below. Where data protection laws such as the GDPR or UK GDPR apply, the right-hand column shows our legal basis.
| Purpose | Information used | Legal basis |
|---|---|---|
| Replying to your inquiry and arranging a conversation | Contact form details, emails | Steps you ask for before a contract; our legitimate interest in responding |
| Reviewing partner applications | Partner application details | Steps you ask for before a contract |
| Sending an NDA you asked for | Name, email, company | Steps you ask for before a contract |
| Telling you about early access to products you signed up for | Name, email, product interest | Your consent, which you can withdraw at any time |
| Running agreements with providers, buyers and partners | Business contact, billing and contract records | Performing our contract |
| Keeping the website secure and working | Server log data | Our legitimate interest in security |
| Meeting legal obligations and defending legal claims | Any of the above, as needed | Legal obligation; legitimate interest |
We do not use your information for automated decisions that have legal or similarly significant effects on you, and we do not use it to train AI models.
5. Data in our products
refine8 helps companies license operational data they already hold. Because that data may originally contain information about people, such as customers or employees, we handle it with particular care:
- We act on the provider's behalf. When we receive data from a provider, we process it under a written agreement and on their instructions, as their processor or service provider. The provider remains responsible for having the right to share it, and we review this before accepting any data.
- De-identification comes first. Direct identifiers are removed and indirect ones are generalized or masked. Every dataset is tested for re-identification risk and documented before any buyer sees a sample.
- Buyers are bound by contract. Every license prohibits attempts to re-identify individuals, resale and use outside the agreed scope, and gives us audit rights.
- We exclude sensitive categories. We do not license data about children, the precise location of individuals, [biometric data], or any data a provider cannot show the right to share.
If you believe information about you is held by a company that works with us, please contact that company first, since they control it. You can also write to us and we will pass your request on.
7. International transfers
refine8 is based in [country], and our service providers may process information in other countries, including the United States. When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision, the EU-U.S. Data Privacy Framework where the recipient is certified, or standard contractual clauses approved by the relevant authorities. You can ask us for a copy of the safeguards we use.
8. How long we keep it
We keep personal information only as long as we need it for the purposes above:
- Inquiries that don't lead to a relationship: [24 months] after our last contact.
- Partner applications that don't proceed: [24 months] after our decision.
- Early access sign-ups: until the product launches or you unsubscribe.
- Contract and billing records: for the life of the agreement plus [7 years], to meet tax and legal requirements.
- Server logs: [up to 90 days], as set by our hosting provider.
9. Security
We protect information with encryption in transit and at rest, least-privilege access that is logged and reviewed, and controlled delivery channels. No system is perfectly secure, but if a breach affects your personal information, we will notify you and the relevant authorities as the law requires.
10. Your rights and choices
Depending on where you live, you may have the right to:
- AccessKnow what we hold about you and get a copy.
- CorrectionFix anything inaccurate or incomplete.
- DeletionAsk us to erase your information.
- PortabilityReceive your information in a usable format.
- Objection and restrictionObject to, or limit, how we use it.
- Withdraw consentUnsubscribe from early access updates at any time.
U.S. state residents, including residents of California, Colorado, Connecticut, Virginia and other states with privacy laws, also have the right to opt out of the sale or sharing of personal information and of targeted advertising. We do neither, so there is nothing to opt out of, but you are welcome to confirm this with us.
How to make a request: email hello@refine8.com with the subject "Privacy request" and tell us what you would like. We will confirm your identity before acting, usually by replying to the email address we have on file, and respond within the time the law allows, typically 30 to 45 days. You can use an authorized agent, and we will ask them for proof of your permission. We will never treat you differently for using your rights.
If we decline your request, you can appeal by replying to our decision, and we will review it again. You also have the right to complain to your local data protection authority or state attorney general.
12. Children
Our website and services are for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, contact us and we will delete it.
13. Changes to this notice
We will update this notice when our practices change, and change the "Last updated" date at the top. If a change is significant, we will highlight it on our website or tell you directly.