Refract privacy notice
Your work should stay yours.
This original Refract privacy draft explains what the studio needs to run a generation, what is sent to a model provider, and what choices a customer should have.
1. What this notice covers
This notice applies to the Refract website, studio, account, support inbox, payment flows, MCP connection, and related APIs. It describes the categories of information Refract handles and the purposes for handling them. It does not replace a provider's own privacy notice when a job is sent to that provider.
Refract does not publish a customer's private prompt, upload, generation, or account profile to other customers unless the customer deliberately shares it through a feature that says it is public.
2. Information we handle
| Account and profile | Username, PIN-derived authentication records, names, phone number, email, country, Google-link details, account/session identifiers, and account timestamps. |
|---|---|
| Creative requests | Prompts, model choice, settings, reference roles, uploaded media, generated output URLs, provider task IDs, status, usage, and error details. |
| Payments | Pack, amount, currency, payment reference, receipt and refund state. Full card details are handled by the checkout provider rather than stored by Refract. |
| Support | Messages, screenshots or attachments a customer chooses to send, support category, account username, and the time and status of the conversation. |
| Technical and security | IP or network information available to the deployment, browser/device details, request timing, error events, rate-limit signals, and audit information needed to protect the service. |
3. Why we use it
- To authenticate the account, preserve the correct wallet, and sync history across devices.
- To accept a prompt or upload, submit the requested generation, poll the provider, store the result, and show the correct status.
- To quote and settle credits, reconcile payments, prevent duplicate claims, and investigate disputed charges.
- To provide support, diagnose upload/provider failures, prevent abuse, secure MCP/API connections, and maintain performance.
- To comply with law, enforce the policies, and protect Refract, customers, providers, and other people.
Refract does not use customer prompts, uploads, or generated outputs to train a Refract foundation model as part of the current service. That promise does not prevent a selected third-party provider from processing a request under its own terms; see the provider section below.
5. Prompts and media
Do not upload health records, government IDs, exact location data, private communications, or another person's image, voice, or likeness unless the feature is appropriate for that data and you have a lawful basis and any required consent. A reference file is sent to the provider needed to complete the job; it is not private merely because the Refract gallery is private.
Refract may use automated systems and limited human review to investigate security, abuse, support requests, legal reports, or provider failures. Refract does not need to inspect every private file to operate the service, and should not use support access as a general license to browse a customer's gallery.
6. Retention and deletion
Refract keeps each category only for as long as needed for the purpose described above, account continuity, billing reconciliation, security, dispute handling, backups, or legal obligations. Provider-hosted media and logs can expire sooner than the Refract account record. Generated URLs may stop working when the provider's retention window ends.
A customer may request account or content deletion through in-app Support. The final published version must state the actual deletion workflow, active-system timeline, backup handling, provider deletion request process, and any exceptions. Content already incorporated into an upstream trained model may not be technically removable from that model, so Refract must not promise otherwise.
7. Your choices and rights
Depending on where you live, you may have rights to access, correct, export, delete, restrict, object to, or withdraw consent from certain processing. You may also have the right to complain to a data-protection authority. We may need to verify account ownership before fulfilling a request and may retain limited records where the law requires it.
Use the Support control in Refract and identify the account username and the request you want handled. Do not include passwords, PINs, full card numbers, or provider API keys in a privacy request.
8. Security and transfers
Refract uses account-scoped sessions, hashed PIN handling, server-side provider credentials, database row scoping, signed media operations, and protected MCP tokens to reduce unauthorized access. No internet service can guarantee absolute security. Customers should use a unique PIN, sign out of shared devices, and revoke an MCP connection they no longer trust.
Information may be processed in countries different from the country where it was collected. The final published notice must identify the legal transfer mechanism and the operator/entity responsible for the relevant data-protection obligations.
9. Children and changes
Refract is not intended for children below the minimum age permitted by applicable law. The final age and guardian-consent rule must be confirmed before publication. If you believe a child supplied personal information improperly, contact Support so the account can be reviewed.
We may update this notice when the product, providers, law, or data practices change. A material change should show a new effective date and, where required, ask for renewed consent rather than relying silently on continued use.
10. Contact and review
For a live account question, use in-app Support. Before this notice is activated as the final privacy notice, Refract must insert a dedicated privacy contact, operator/entity name, service address, regional rights process, and confirmed retention schedule.
This page is a review-ready product baseline, not jurisdiction-specific legal advice.