Privacy Policy

1. Information We Collect

Information you provide

• Account information: Name, email address, and password when you create an account.
• Billing information: Payment details processed securely through our payment provider (Stripe). We do not store credit card numbers on our servers.
• Brand and domain data: Website URLs, brand names, competitor names, and search queries you configure for monitoring.
• Communications: Messages you send to us via email, Slack, or our support channels.
• Sign-ups from AI apps: When you create an account from inside an AI app such as Claude or ChatGPT, we store which app you came from, the campaign that brought you (if any) and whether you asked for our newsletter. Connecting an AI app records which app, when it was last used and which organization it can read; you can disconnect it at any time.

Signing in with Google or Microsoft

If you choose to sign in with Google or Microsoft, we receive your name, email address, profile picture (if available) and a unique account identifier from that provider. For Microsoft work accounts we also receive the identifier of your organisation's directory. We use this only to create your Refora account and sign you in. The legal basis is the performance of our contract with you. We do not receive your password, and we do not access your email, files, contacts or calendar. You can disconnect sign-in at any time by contacting us, after which you can sign in with email and password.

Information collected automatically

• Usage data: Pages visited, features used, clicks, and interactions within the Service.
• Device information: Browser type, operating system, screen resolution, and IP address.
• Cookies: We use necessary cookies and browser storage to keep you logged in and remember your choices. Analytics and campaign cookies are only used if you accept them. See section 8.

Information generated by the Service

• AI response data: When the Service queries AI platforms (such as ChatGPT, Perplexity, and Gemini) on your behalf, we store the AI-generated responses, extracted brand mentions, citations, and visibility metrics. This data is generated from publicly available AI outputs and does not contain your personal information.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service.
• Process payments and manage your subscription.
• Monitor AI platforms for brand mentions and citations based on your configured prompts.
• Generate analytics, reports, and visibility scores.
• Send you service-related communications (account confirmations, billing notices, feature updates).
• Respond to your support requests.
• Detect and prevent fraud or abuse.

We do not use your information to:

• Sell or rent your personal data to third parties.
• Serve advertisements.
• Train AI models on your account data.
• Share your monitoring configurations or results with other users.

3. How We Share Your Information

We share your information only in the following circumstances:

• Service providers: We use third-party services to operate the platform, including Stripe (payments), Railway (hosting), and email delivery services. These providers only receive the minimum information necessary to perform their function.
• AI platforms we monitor: to collect AI answers for you, we send the prompts you configure to the AI platforms we monitor (OpenAI, Anthropic, Google, Perplexity and Mistral) and to DataForSEO for search and AI Overview results.
• Analytics providers (only with your consent): Google (Google Analytics) and PostHog receive usage and device data to help us understand how the Service is used. See section 8.
• DataForSEO (AI search data): receives the website address and buyer questions for a market snapshot of the site; no personal data.
• AI assistants you connect: if you connect Refora to an AI assistant (see "Connecting Refora to AI assistants" below), the data you ask it to read is sent to that assistant's provider at your direction.
• Legal requirements: We may disclose information if required by law, regulation, legal process, or government request.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change.
• With your consent: We may share information when you explicitly ask us to, such as when exporting reports.

We never share your visibility data, brand monitoring results, or competitive intelligence with other customers or third parties.

3a. Connecting Refora to AI assistants (MCP)

You can connect Refora to AI assistants such as Claude (Anthropic) or ChatGPT (OpenAI) through our MCP server at mcp.refora.ai. When you connect, you choose one Refora organization and allow the assistant to read its data: workspaces, visibility metrics, competitors, citations, sentiment and prompt results. The connection is read-only; it cannot change anything in your account.

• What the assistant receives: only the data needed to answer the questions you or your colleagues ask it, from the organization you approved. That data is then processed by the assistant's provider under its own terms and privacy policy.
• What we store: which user connected which application to which organization, when, and when the connection was last used. Access tokens are stored only as one-way hashes; they expire after one hour, and refresh tokens after 30 days.
• What we log: for each request, the tool used, the organization, the time, the duration and the outcome, for security and support. These logs follow our server-log retention (deleted after 90 days).
• Your control: you can disconnect at any time in the assistant's settings or by emailing support@refora.ai. If a member is removed from an organization, their connections stop working immediately.

4. Data Storage and Security

• Your data is stored on servers hosted by Railway in the United States.
• We use encryption in transit (TLS/SSL) for all connections to the Service.
• Passwords are hashed using bcrypt and are never stored in plain text.
• Authentication is handled via JSON Web Tokens (JWT).
• We implement access controls so your data is isolated to your account and workspace.

While we take reasonable measures to protect your information, no method of transmission or storage is completely secure. We cannot guarantee absolute security.

5. Data Retention

• Account data: Retained for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it by law.
• AI response data: Retained for as long as your account is active to provide historical trends and analytics.
• Billing records: Retained for up to 7 years as required by applicable tax and accounting regulations.
• Server logs: Automatically deleted after 90 days.

6. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and associated data.
• Export your data in a portable format (CSV and PDF exports are available in the Service).
• Object to or restrict certain processing of your data.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at privacy@refora.ai. We will respond within 30 days.

7. International Data Transfers

If you are located outside the United States, your data will be transferred to and processed in the United States where our servers are hosted. By using the Service, you consent to this transfer. We take steps to ensure your data receives adequate protection in accordance with applicable law.

9. Children

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the Service before the changes take effect. The "Last updated" date at the top indicates when the policy was last revised.

11. Contact

If you have questions about this Privacy Policy or how we handle your data:

Data controller: Refora AB
Company registration number: 559605-1556
Email: privacy@refora.ai
Security issues: security@refora.ai
Website: refora.ai/contact