Privacy Policy

This policy applies only to the public marketing website at refractsoftware.com — the site you are reading right now, including this page, the homepage, and pages such as Book a Demo and Contact.

It does not describe or govern the separate REFRACT SaaS application that customer organizations use at their own subdomain (for example, yourbusiness.refractsoftware.com). That application is a different system, built and operated separately from this website, and may require its own privacy documentation. Nothing in this policy should be read as a statement about how the SaaS product handles customer or tenant data.

This website collects personal information only when you choose to submit one of its two forms.

Demo request form (/demo): name, company, and work email are required. Phone, industry, number of technicians/users, current system, and a free-text description of what you'd like to improve are optional.

Contact form (/contact): name, email, enquiry type, and message are required. Company is optional.

No other form or data-collection mechanism exists on this website.

When you submit the Demo or Contact form, the server reads your IP address from standard request headers, solely to apply a short-lived rate limit (at most 5 submissions per 10 minutes from the same address) intended to reduce automated abuse of the forms. Within this website's own application code, that IP address is held only in server memory for that purpose, is not written to a database or log alongside your name, email, or message, and clears automatically as the rate-limit window expires or when the server process restarts.

Requires review: the above describes this website's own code only. Whether the underlying hosting platform independently keeps its own request/access logs (as most web hosts do at the infrastructure level, outside any application code) is not yet confirmed — see Data security.

Each form also includes a hidden field and a render-timestamp check used only to distinguish automated (bot) submissions from real ones. Neither collects information about you personally.

This website does not use cookies, browser local/session storage, analytics scripts, advertising or tracking pixels, or a CAPTCHA/bot-verification service — see Cookies and analytics below. This website's own application code does not maintain visitor request logs beyond what is described above.

• To respond to a demo request or a general/sales/security/partnership enquiry you submit.
• To operate the website, including the rate-limiting and anti-spam checks described above.

This website does not currently run analytics of any kind, so information is not used to analyze visitor behavior beyond the form-submission handling above. If that changes, this section will be updated first — see Updates.

A validated Demo or Contact submission is sent, as a single HTTP request, to an internal REFRACT notification destination — but only if one has been configured. As of this draft, no such destination is configured: this website's own code does not currently deliver a visitor's submission to, or store it in, any third-party service, email provider, or CRM (the underlying hosting platform's own infrastructure-level logging is a separate question — see Data security).

Requires business/legal review: once REFRACT selects a real delivery destination (for example, a transactional email provider or a CRM), that provider will process the information you submit on REFRACT's behalf, and this section must be updated to name it before that destination goes live.

Beyond that pending delivery destination, this website uses no other third-party processor — no analytics vendor, CDN service with access to submitted data, error- monitoring service, or CAPTCHA provider is integrated into this codebase today.

Requires business/legal review: REFRACT has not yet set a formal retention period for information submitted through this website.

What is true today: while the notification destination described in Service providers remains unconfigured, a submitted form is validated and then discarded by this website's own application code — it is not written to a database by that code. Whether the underlying hosting platform separately retains its own request-level logs is not yet confirmed — see Data security. Once a real delivery destination is configured, retention will also be governed by that destination's own storage and retention practices, which will be documented here once chosen.

Form submissions are validated on the server and, where a delivery destination is configured, transmitted to it directly — never logged with your name, email, or message content (see Information collected automatically for what is logged). No password, payment, health, or other sensitive-category information is collected by any form on this site.

Requires review: this website's specific hosting infrastructure and transport-security configuration are not documented in this policy, and whether the hosting platform itself keeps independent request/access logs — separately from this website's own application code, described in Information collected automatically — has not been confirmed. No security certification, audit, or specific technical control (for example, a named encryption standard) is claimed here — see also Security for REFRACT's current, narrowly-scoped public security disclosures.

Requires review: this website's hosting location and the geographic location of any future service provider (see Service providers) are not yet confirmed. This section will describe where information is processed once that is established.

This website does not set cookies and does not use browser local or session storage. It does not run any analytics, advertising, or tracking script. Because no non-essential cookies or tracking technologies are in use, this website does not display a cookie-consent banner.

If analytics or another tracking technology is added in the future, this section — and, if the technology involves non-essential cookies or similar storage, a consent mechanism — will be put in place before that change goes live, not after.

You may ask REFRACT what information you've submitted through this website, or ask that it be deleted, by using the Contact form (select "General Enquiry" and reference this policy).

Requires legal review: this policy does not currently state jurisdiction-specific rights (for example, under GDPR or a U.S. state privacy law), since REFRACT's legal entity and operating jurisdiction are not yet documented in this repository. That detail will be added once confirmed — see Terms of Use — Governing law.

This website does not yet have a published privacy-specific contact address. For any privacy question or request, use the Contact page — select the enquiry type that best fits, and mention that your message concerns privacy.

This is a draft policy and does not yet carry an approved effective date. Once REFRACT approves a final version, this section will be updated with a real "last updated" date, and material changes to an approved policy will be reflected here going forward.