Privacy Policy

A core value at Refine is that the content you upload is strictly confidential. We will not train any large language models on your uploaded content, and we do not permit our AI service providers to do so either.

AI model processing is routed through OpenRouter Enterprise, our LLM gateway provider. Our agreement with OpenRouter Enterprise contractually prohibits the use of submitted content to train or improve AI models. This obligation extends to the underlying model providers accessed through OpenRouter's infrastructure. This no-training guarantee applies to all users.

For users accessing Refine through an organizational account (institutional or enterprise tier), we additionally require Zero Data Retention (ZDR) with our LLM providers, meaning submitted content is not stored by any model provider even transiently. For individual consumer accounts, ZDR is not enabled; submitted content may be processed by model providers subject to their standard operational data handling practices, but use of your content for model training remains prohibited under our agreements with those providers. If you are interested in organizational access with ZDR enabled, please contact us at institutional-support@refine.ink.

Separately, we use PostHog for product analytics and session replay to improve our service and assist with troubleshooting. For users accessing Refine through an organizational account, session content is masked. For individual consumer accounts, this includes session recordings linked to your account. Where required by applicable law, including for users in the European Economic Area and United Kingdom, session replay will only be activated after you have provided your consent via our cookie consent banner. You may withdraw that consent at any time through our Cookie Policy. PostHog processes this data as a contracted sub-processor and is prohibited from using it for any purpose other than providing analytics services to Refine.

The content you upload may not be shared or sold by us or our providers to any third party.

Your data is protected by industry-standard security practices on Microsoft Azure infrastructure. When you delete a session in your history, we delete all its associated data permanently and unrecoverably.

We may use your interactions with comments to improve feedback ranking and quality. You may opt out of such use by notifying help@refine.ink from the email address associated with your Refine account.

• OpenRouter Privacy Policy

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following: names, email addresses, usernames, billing addresses, contact or authentication data, passwords.

We do not intentionally collect sensitive personal information. Uploaded content may incidentally contain such data, which we process solely to deliver the requested service and do not use for any other purpose.

We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and the security code associated with your payment instrument. All payment data is handled and stored by Stripe. You may find their privacy notice here: stripe.com/privacy.

We may provide you with the option to register with us using your existing social media account details, like your Google or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider. All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. You can find out more about this in our Cookie Notice: refine.ink/cookie-policy.

The information we collect includes: Log and Usage Data (service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files) and Device Data (information about your computer, phone, tablet, or other device you use to access the Services, including IP address, device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information).

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. We may rely on the following legal bases:

• Consent. We may process your information if you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
• Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information to: send users information about special offers and discounts on our products and services; analyze how our Services are used so we can improve them to engage and retain users; diagnose problems and/or prevent fraudulent activities; understand how our users use our products and services so we can improve user experience; and assess and improve our marketing strategies.
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

In legal terms, we are generally the data controller under European data protection laws of the personal information described in this Privacy Notice, since we determine the means and/or purposes of the data processing we perform. This Privacy Notice does not apply to the personal information we process as a data processor on behalf of our institutional customers. In those situations, the customer that we provide services to and with whom we have entered into a Data Processing Agreement is the data controller responsible for your personal information, and we process your information on their behalf in accordance with their instructions. If you want to know more about our customers' privacy practices, you should read their privacy policies and direct any questions to them.

Data protection inquiries may be directed to privacy@refine.ink. The Information Security Officer currently fulfills data protection oversight responsibilities for Refine.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including for investigations and fraud detection and prevention, for business transactions provided certain conditions are met, to comply with a subpoena, warrant, or court order, or where the information is publicly available and specified by applicable regulations.

We share your data with third-party vendors and service providers who perform services for us or on our behalf. We have contracts in place with all such parties designed to safeguard your personal information. They may not do anything with your personal information unless we have instructed them to do so, and they commit to protect the data they hold on our behalf.

We engage service providers in the following categories:

• Cloud infrastructure: Microsoft Azure (primary compute, storage, and networking)
• AI and LLM processing: OpenRouter Enterprise (LLM gateway). AI model processing is routed through OpenRouter, which contractually prohibits training on submitted content. The full list of current sub-processors, including the underlying model providers accessed through OpenRouter, is maintained at trust.refine.ink.
• Document processing: Mathpix (mathematical notation and formula parsing of submitted documents)
• Product analytics and session replay: PostHog. For users accessing Refine through an organizational account, session content associated with manuscript uploads is masked. For individual consumer accounts, PostHog may receive session recordings and usage events linked to your account, including content associated with your sessions, which Refine uses for product improvement and troubleshooting. PostHog processes this data under a Data Processing Agreement that prohibits use of the data for its own purposes, including AI model training.
• Authentication: Clerk
• Invoice and billing: Stripe
• Email communications: Customer.io (transactional and marketing email delivery)
• User account registration: Google Sign-In

The current named sub-processor list is maintained at trust.refine.ink and is updated in accordance with our vendor change management process. Institutional customers are notified of material sub-processor changes per the terms of their Data Processing Agreement. Session replay tools may be active during your use of the Services; please refer to our Cookie Policy for details and opt-out options.

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These tools are designed to enhance your experience and provide you with innovative solutions. The terms in this Privacy Notice govern your use of the AI Products within our Services.

AI model processing is provided through OpenRouter Enterprise, our LLM gateway, which routes requests to one or more underlying model providers. As outlined in Section 1 of this Privacy Notice, your submitted content will not be used to train or improve any AI models, and this restriction applies to OpenRouter and to the underlying model providers accessed through OpenRouter's infrastructure. This no-training guarantee applies to all users. Users accessing Refine through an organizational account additionally benefit from Zero Data Retention (ZDR), meaning submitted content is not stored by any model provider even transiently. See Section 1 for more detail on the ZDR tier distinction.

You must not use the AI Products in any way that violates the terms or policies of any AI service provider.

Our AI Products are designed for the following functions: manuscript analysis, error detection in academic research, mathematical and logical reasoning analysis, and generation of structured feedback reports.

All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with third-party providers. Submitted content is processed through our AI pipeline solely to generate and return feedback to the submitting user. Refine's AI outputs are advisory in nature and do not constitute automated decisions with legal or similarly significant effects on users.

Our servers are located in the United States (Microsoft Azure, Central US region). Regardless of your location, please be aware that your information may be transferred to, stored by, and processed by us and the third-party providers with whom we share your personal information in the United States.

If you are a resident of the European Economic Area (EEA), United Kingdom (UK), or Switzerland, please be aware that the United States may not have data protection laws as comprehensive as those in your country. We take the following measures to protect your personal information in connection with international transfers:

Standard Contractual Clauses. For transfers of personal data from the EEA or UK to the United States, we rely on the European Commission's Standard Contractual Clauses (EU Commission Implementing Decision 2021/914) as the lawful transfer mechanism. These clauses impose data protection obligations on both parties to the transfer. A copy of the applicable Standard Contractual Clauses can be provided upon request by contacting privacy@refine.ink.

We have implemented equivalent safeguards with our third-party sub-processors that process personal data originating from the EEA or UK. Further details are available upon request.

We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. These include encryption of data in transit and at rest, access controls, and ongoing security monitoring. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

We are currently undergoing SOC 2 and ISO 27001 audits. Further information about our security program is available at trust.refine.ink.

We maintain an incident response program designed to detect, contain, and remediate security incidents affecting personal information. In the event of a personal data breach, we will take the following steps:

1. Regulatory notification. Where required by applicable law, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach (GDPR and UK GDPR), or within the timeframe required under applicable US state law.
2. Individual notification. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify affected individuals as soon as reasonably practicable, using the contact details we hold on record. We will provide information about the nature of the breach, the data affected, and the steps we are taking to address it.
3. Remediation. We will investigate the breach, contain the incident, and take steps to prevent recurrence. We will document all breaches in accordance with our legal obligations regardless of whether regulatory notification is required.

If you have reason to believe that your personal information has been compromised, please contact us immediately at privacy@refine.ink.

If you are located in the United Kingdom, you have the right to make a request regarding your personal information to the extent provided under the UK GDPR and the Data Protection Act 2018. You may request: what personal information we hold about you; how we use your personal information and on what legal basis; for how long we store your personal information; who it has been, or will be, shared with; and whether there are automated decision-making processes that affect you.

You may submit your request using the contact details provided in the section How Can You Contact Us About This Notice? below. If you believe we are processing your information in breach of applicable law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).