Privacy Policy

Last updated: 27 July 2026

Operated by CXDATA LTD ("Refyner", "we", "us"), a company registered in England & Wales under company number 15100231, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. Refyner is a CXDATA product.

Refyner forms part of the CXDATA group, and this product-specific policy is built on CXDATA's group data-protection framework. It sits alongside CXDATA's group policies – Privacy · Terms · Cookies – and where this policy is silent the CXDATA group Privacy Policy applies.

1. Who we are

Refyner is a data preparation and scheduling product for eCommerce and subscription brands, operated by CXDATA LTD, a company registered in England & Wales under company number 15100231, with registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. For the purposes of the UK GDPR and the Data Protection Act 2018, CXDATA LTD is the controller responsible for personal data we collect directly. For questions about this policy, contact privacy@refyner.com.

2. Our two roles

Our relationship to personal data depends on the context:

• As a processor. When you use Refyner to prep and schedule data in your own Snowflake, that data remains in your environment and you are the controller. We process it only on your instructions, under our Terms and our Data Processing Agreement. We do not copy your warehouse data into our systems beyond the configuration and metadata needed to run your dataflows.
• As a controller. For data we collect directly – account details, billing information, website analytics, and support correspondence – we are the controller, and this policy describes how we handle it.

3. Information we collect

Information you provide

• Account information – name, work email, company, role
• Billing information – processed via our payment provider; we do not store full card details
• Support and sales communications

Information collected automatically

• Product usage and log data (pages, actions, dataflow run metadata)
• Device and connection data (IP address, browser type)
• Cookies and similar technologies – see Section 8

Dataflow metadata

To run the service we store dataflow definitions, schedules, run logs, and schema/structural metadata. This is the instruction set for your dataflows – not your customers' records.

4. How we use information

• To provide, operate, and maintain the service
• To authenticate users and secure accounts
• To provide support and respond to requests
• To process payments and manage subscriptions
• To improve the product and understand usage – using aggregated or de-identified data where we act as your processor
• To send service and, where permitted, marketing communications (you can opt out)
• To comply with legal obligations

Our lawful bases under UK GDPR include performance of a contract, legitimate interests, consent (where required), and legal obligation.

5. AI features

AI authoring assistance is a forthcoming feature. When released, it will send schema and structural metadata, and only the sample rows you explicitly approve, to Microsoft Azure OpenAI running within our own Azure tenancy under Microsoft’s enterprise terms. Your full datasets are not sent, and this content is not used to train foundation models.Security page for detail.

6. Sharing and sub-processors

We do not sell, trade or otherwise transfer your personal data to outside parties. We share it only with trusted service providers and sub-processors who help us operate, under contract and on a need-to-know basis – including Microsoft (Azure application hosting, Microsoft 365 services, Azure OpenAI for AI authoring assistance, and Clarity for product usage analytics), Cloudflare (website hosting and cookieless website analytics), Amplitude (product usage analytics), Calendly (meeting scheduling), and our payment, email and error-monitoring providers. Snowflake is not a Refyner sub-processor: your warehouse is an account you hold and contract for directly, and your data stays inside it. All of our sub-processors are required to meet UK GDPR standards. A current sub-processor list, and our commitment to notify customers of changes, is maintained in our Data Processing Agreement at refyner.com/dpa.html. We may also disclose information where required by law or to protect rights, property or safety; where legally compelled, we strive to limit disclosure and, unless prohibited, will notify you.

7. International transfers

The Refyner control plane is hosted on Microsoft Azure in the United States (East US 2), so the personal data we hold – account, billing and support data, and the configuration and metadata we use to run your dataflows – is stored in the United States. Your warehouse data stays in the Snowflake account and region you control; we do not move it. Microsoft, Cloudflare, Amplitude and Calendly may also process data in the United States. As a UK company transferring personal data outside the UK, we rely on the UK International Data Transfer Agreement (IDTA) or Addendum to the Standard Contractual Clauses, the EU Standard Contractual Clauses, or an applicable adequacy decision – including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified. A UK region is on our roadmap, and Refyner Self-Hosted keeps everything inside your own cloud today.

8. Cookies

We use strictly necessary cookies to operate the site and product. Our website analytics is cookieless, so we set no analytics or advertising cookies on this site. You can manage cookies through your browser settings. See our Cookies Policy.

9. Data retention

We keep personal data only as long as we actually need it:

• Workspace, dataflow and account data – for the life of your account, then deleted within 30 days of closure. Ask us and we will delete it sooner.
• Billing and invoice records – six years from the end of the relevant accounting period, as UK tax and company law require.
• Support correspondence – up to two years after your last contact with us.
• Run logs and security logs – up to 12 months, for troubleshooting, audit and security investigation.
• Aggregated, de-identified statistics – kept indefinitely. These are not personal data and cannot be linked back to you or your customers.

10. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise these, contact privacy@refyner.com. You may also lodge a complaint with your supervisory authority – in the UK, the Information Commissioner's Office (ICO).

11. Security

We apply technical and organisational measures to protect personal data, described on our Security page – including encryption in transit and at rest, role-based access control, a least-privilege role scoped to your warehouse, and confidentiality obligations on our personnel and subcontractors. No method of transmission or storage is completely secure.

Where we are the controller and a reportable personal data breach occurs, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it, and affected individuals without undue delay where the breach is likely to result in a high risk to their rights. Where we act as your processor, we will notify you without undue delay after becoming aware of a breach, with the information available to us at the time, so that you can meet your own notification obligations – see our Data Processing Agreement.

12. Children

Refyner is a business product not directed to children, and we do not knowingly collect personal data from anyone under 16.

13. Where you are based

We sell worldwide on one set of terms. Where local law adds to UK GDPR, the following apply automatically – there is nothing extra for you to sign.

• European Economic Area – the EU GDPR applies to processing relating to people in the EEA, and the EU Standard Contractual Clauses are built into our Data Processing Agreement. Where the law requires it, we will appoint an Article 27 representative in the EEA and name them here.
• Switzerland – the Swiss FADP applies, supervised by the Federal Data Protection and Information Commissioner.
• United States – where state privacy laws such as the CCPA/CPRA apply, we act as a service provider or processor. We do not sell or share personal information, we do not use it for cross-context behavioural advertising, and we do not use it for any purpose other than providing the Service. To exercise a state privacy right, email privacy@refyner.com.
• Elsewhere – we apply UK GDPR standards as our global baseline, which in most cases meets or exceeds local requirements.

14. Changes to this policy

We may update this policy from time to time. Material changes will be notified through the service or by email, and the "last updated" date will change.

15. Contact

CXDATA LTD, 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ · privacy@refyner.com.