Privacy Policy

This policy applies only to the public marketing website at refractsoftware.com — the site you are reading right now, including this page, the homepage, and pages such as Book a Demo and Contact.

It does not describe or govern the separate REFRACT SaaS application that customer organizations use at their own subdomain (for example, yourbusiness.refractsoftware.com). That application is a different system, built and operated separately from this website, and may require its own privacy documentation. Nothing in this policy should be read as a statement about how the SaaS product handles customer or tenant data.

This website collects personal information only when you choose to submit one of its two forms.

Demo request form (/demo): name, company, and work email are required. Phone, industry, number of technicians/users, current system, and a free-text description of what you'd like to improve are optional.

Contact form (/contact): name, email, enquiry type, and message are required. Company is optional.

No other form or data-collection mechanism exists on this website.

When you submit the Demo or Contact form, the server reads your IP address from standard request headers, solely to apply a short-lived rate limit (at most 5 submissions per 10 minutes from the same address) intended to reduce automated abuse of the forms. Within this website's own application code, that IP address is held only in server memory for that purpose, is not written to a database or log alongside your name, email, or message, and clears automatically as the rate-limit window expires or when the server process restarts.

Requires review: the above describes this website's own code only. Whether the underlying hosting platform independently keeps its own request/access logs (as most web hosts do at the infrastructure level, outside any application code) is not yet confirmed — see Data security.

Each form also includes a hidden field and a render-timestamp check used only to distinguish automated (bot) submissions from real ones. Neither collects information about you personally.

This website does not use cookies, browser local/session storage, advertising or tracking pixels, or a CAPTCHA/bot-verification service. It can run a privacy-focused analytics tool (Plausible) that also does not use cookies or browser storage — see Cookies and analytics below for what that tool does and doesn't collect, and whether it is currently active. This website's own application code does not maintain visitor request logs beyond what is described above.

• To respond to a demo request or a general/sales/security/partnership enquiry you submit.
• To operate the website, including the rate-limiting and anti-spam checks described above.
• If analytics is active in this environment (see Cookies and analytics), to understand in aggregate which pages are visited and whether visitors use the Demo/Contact forms — never to identify you individually.

A validated Demo or Contact submission is sent as a single email to REFRACT's support inbox ([email protected]) through Resend, a transactional email provider that processes the information you submit on REFRACT's behalf in order to deliver that email. The email contains the fields you filled in and the time of submission, and uses the email address you entered as its reply-to address so REFRACT can respond to you directly. This website's own code does not store your submission in a database or CRM (the underlying hosting platform's own infrastructure-level logging is a separate question — see Data security).

Requires business/legal review: Resend's own data processing and retention terms, and the provider behind REFRACT's support mailbox, have not yet been reviewed for this policy.

This website's code also supports sending analytics data to Plausible Analytics, a privacy-focused analytics provider — see Cookies and analytics for what it collects and whether it is currently active in this environment. Beyond Resend and Plausible, this website uses no other third-party processor — no CDN service with access to submitted data, error-monitoring service, or CAPTCHA provider is integrated into this codebase today.

Requires business/legal review: REFRACT has not yet set a formal retention period for information submitted through this website.

What is true today: this website's own application code does not write a submitted form to a database. Once sent, your submission exists as an email in REFRACT's support inbox and in Resend's own delivery records (see Service providers), and is retained according to those services' practices. To stop accidental double submissions, the server keeps a one-way fingerprint (hash) of a successful submission in memory for two minutes; it cannot be turned back into your details and is never written to disk. Whether the underlying hosting platform separately retains its own request-level logs is not yet confirmed — see Data security.

Form submissions are validated on the server and sent to Resend over an encrypted (HTTPS) connection — never logged with your name, email, or message content (see Information collected automatically for what is logged). No password, payment, health, or other sensitive-category information is collected by any form on this site.

Requires review: this website's specific hosting infrastructure and transport-security configuration are not documented in this policy, and whether the hosting platform itself keeps independent request/access logs — separately from this website's own application code, described in Information collected automatically — has not been confirmed. No security certification, audit, or specific technical control (for example, a named encryption standard) is claimed here — see also Security for REFRACT's current, narrowly-scoped public security disclosures.

Requires review: this website's hosting location and the geographic location of any future service provider (see Service providers) are not yet confirmed. This section will describe where information is processed once that is established.

This website does not set cookies and does not use browser local or session storage, for analytics or anything else. It does not run any advertising or cross-site tracking script.

This website's code includes support for Plausible Analytics, a privacy-focused analytics tool chosen specifically because it doesn't use cookies or persistent identifiers to count visitors. It only becomes active once REFRACT both configures an analytics domain and explicitly enables analytics for a deployment of this site — REFRACT's practice is to do this for the live production site only, not a preview or staging copy, though that separation is an operational configuration practice rather than something this policy or the website's code independently guarantees. Whether it is active on the copy of this site you are viewing depends on that configuration, not on anything in this policy. When active, it collects, in aggregate:

• which pages are viewed, and the page you came from (referrer/campaign source);
• clicks on the site's "Book a Demo" / "Contact REFRACT" buttons, and whether the Demo/Contact forms were started, failed validation, or were successfully submitted;
• for a successfully submitted Demo request, the industry category you selected (if any); for a successfully submitted Contact enquiry, the enquiry type you selected — never your name, email, phone, company, or message content, which this analytics tool never receives.

Per Plausible's own published data policy, it does not store your IP address — it is used only transiently, alongside your browser's user agent and a daily-rotating value, to compute a temporary, non-identifying count of unique visitors, then discarded. Your approximate location (country, region, and city) may also be derived from your IP address at the moment of that transient lookup and retained in aggregate — e.g. "12 visitors from the United Kingdom this week" — but the underlying IP address itself is not. This applies both to ordinary page views (sent directly by your browser) and to the two conversion events noted above, which this website's server forwards to Plausible with the same transiently-used information after a Demo or Contact submission genuinely succeeds — never before, and never with your name, email, phone, company, or message content. REFRACT has not independently audited Plausible's data-retention claim; it is stated here as Plausible's own documented behavior, consistent with how this policy treats other claims it hasn't independently verified (see Data security).

Because this analytics tool sets no cookies and stores no persistent identifier in your browser, this website does not display a cookie-consent banner. If a future tracking technology introduces cookies, persistent identifiers, or cross-site tracking, this section — and, if required, a consent mechanism — will be put in place before that change goes live, not after.

You may ask REFRACT what information you've submitted through this website, or ask that it be deleted, by emailing [email protected] or using the Contact form (select "General Enquiry" and reference this policy).

Requires legal review: this policy does not currently state jurisdiction-specific rights (for example, under GDPR or a U.S. state privacy law), since REFRACT's legal entity and operating jurisdiction are not yet documented in this repository. That detail will be added once confirmed — see Terms of Use — Governing law.

For any privacy question or request, email [email protected] or use the Contact page — select the enquiry type that best fits, and mention that your message concerns privacy.

This is a draft policy and does not yet carry an approved effective date. Once REFRACT approves a final version, this section will be updated with a real "last updated" date, and material changes to an approved policy will be reflected here going forward.