Privacy Policy

This Privacy Policy explains how Refix Reputation Solutions LLC (“Refix”, “we”, “us”) collects, uses, discloses and protects personal information when you visit getrefix.com or use our cloud software-as-a-service platform (the “Service”). It also outlines your privacy rights and how you can exercise them.

1. Who we are

• Controller: Refix Reputation Solutions LLC
• Managing Director: Matin Gholipour Borhani
• 5 Judith Drive
• Englewood Cliffs, NJ 07632
• United States of America
• Email: info@getrefix.com

2. EU Representative (Art. 27 GDPR)

3. What information we collect and why

Below you will find the main categories of personal information we process and the purposes for doing so. We always process only the information needed to achieve these purposes.

3.1 Website visit

• Typical data: truncated IP address, date and time, requested page, browser and device information.
• Purpose: technical delivery of the website and IT security.
• Legal basis (GDPR): legitimate interests (Art. 6 (1)(f)).

3.2 Account creation and contract performance

• Data: company name, contact person, business email, address, Stripe payment token, Amazon API keys, login credentials.
• Purpose: set-up and administration of your account, provision of the Service, billing.
• Legal basis: contract (Art. 6 (1)(b)).

3.3 Use of the platform and review analysis

• Data: product identifiers (e.g. ASINs), review text and pseudonyms, timestamps, removal status.
• Purpose: identify and handle potentially illegitimate product reviews.
• Legal basis: contract (Art. 6 (1)(b)) and our legitimate interest in combating fake reviews (Art. 6 (1)(f)).

3.4 Optional legal enforcement via partner law firms

• Data: your contact details, the affected reviews and products.
• Purpose: pursue legal removal of reviews through our partner law firms when you choose that option.
• Legal basis: contract (Art. 6 (1)(b)).

3.5 Payments via Stripe

• Data: cardholder name, last four digits, expiry date, transaction ID.
• Purpose: collect success-based fees.
• Legal basis: contract (Art. 6 (1)(b)).

3.6 Support and chat (Crisp)

• Data: chat messages, email address, technical metadata.
• Purpose: respond to support enquiries.
• Legal basis: contract (Art. 6 (1)(b)).

3.7 Email delivery (Resend)

• Data: email address, message content, delivery status.
• Purpose: send transactional emails (for example account emails and replies to enquiries you submit through our forms); newsletters are sent only with opt-in consent.
• Legal basis: contract (Art. 6 (1)(b)), legitimate interests in B2B direct marketing (Art. 6 (1)(f)), or consent for newsletters (Art. 6 (1)(a)).

3.8 Web analytics (cookieless)

• Data: aggregated, anonymous usage statistics (page views, referrer, approximate region, device and browser type). No cookies are set and no information is stored on or read from your device; no cross-site tracking and no advertising profiles.
• Purpose: measure reach and improve our website.
• Legal basis: legitimate interests (Art. 6 (1)(f)). Because the measurement is cookieless and stores nothing on your device, no consent is required.

3.9 Product analytics and session recordings (PostHog)

• Data: usage events such as page views, clicks, scroll depth and referrer, processed exclusively on EU servers (Frankfurt am Main).
• Purpose: understand how our website and application are used (aggregated statistics, heatmaps, click analysis) and improve them.
• Website: measurement runs cookieless by default: nothing is stored on or read from your device, IP addresses are discarded at ingestion, and visits are not linked across sessions (legitimate interests, Art. 6 (1)(f)). Only with your consent (Art. 6 (1)(a) GDPR, Sec. 25 (1) TDDDG) do we additionally set a cookie and record sessions (mouse movement, clicks, pages visited) to analyse usability problems; text you type into input fields is masked on your device and never transmitted. You can withdraw this consent at any time via "Cookie settings" in the footer.
• Application: for signed-in users, usage events are linked to your account and sessions may be recorded so we can provide, secure and improve the Service (contract, Art. 6 (1)(b), and legitimate interests, Art. 6 (1)(f)). Passwords, email addresses and verification codes are always masked and never transmitted.

3.10 Appointment booking (Cal.com)

• Data: information entered in the booking form such as name, business email, selected appointment and optional details, as well as time zone and, where present, campaign parameters from the page URL.
• Purpose: select, book and organise a demo appointment and attribute the enquiry to its source.
• Legal basis: steps prior to entering into a contract (Art. 6 (1)(b)) and our legitimate interest in efficient appointment scheduling (Art. 6 (1)(f)).

4. Cookies

We keep cookies to a minimum. Essential cookies and storage only do three things: keep you signed in to the application, remember your language, and remember your consent choice. They are strictly necessary (Art. 6 (1)(f) GDPR; Sec. 25 (2) TDDDG) and contain no tracking data.

On the website, our analytics run cookielessby default (see Sections 3.8 and 3.9). Only if you agree via the consent banner do we set a single analytics cookie (PostHog, valid for up to twelve months) to enable the features described in Section 3.9; you can withdraw that choice at any time via "Cookie settings" in the footer, which deletes the cookie immediately. In the application, cookies additionally support the product analytics described in Section 3.9.

We use no advertising cookies and no cross-site tracking. You can also manage or block cookies in your browser settings at any time.

5. Who has access to your data

We never sell personal information. We disclose it only when necessary for the purposes set out above:

• Supabase, Inc. (USA): database and back-end of our platform; our database is hosted in the EU (AWS region eu-west-1, Ireland).
• Google Cloud (Google LLC, USA): cloud infrastructure and back-end services, operated in the EU (region europe-west1, Belgium).
• Stripe Payments Europe Ltd. (Ireland) / Stripe, Inc. (USA): payment processing.
• Vercel Inc. (USA): hosting of our website and application, and cookieless reach measurement; server-side processing runs in the EU (Dublin), static content is delivered via a global edge network.
• PostHog Inc. (USA), EU Cloud: web and product analytics; event data is hosted in the EU (Frankfurt).
• Cal.com, Inc. (USA): appointment scheduling and handling of demo bookings.
• Crisp IM SARL (France): chat support.
• Resend, Inc. (USA): transactional email delivery.
• Our partner law firms: independent controllers for legal enforcement, engaged only with your approval.
• Amazon: relevant EU or US entities receive takedown requests on your behalf.
• Legal authorities or potential acquirers: only if required by law or in the context of a corporate transaction.

6. International transfers

We host our core infrastructure in the European Union: the platform database in Ireland, cloud services in Belgium, analytics in Frankfurt am Main and server-side compute in Dublin. Some recipients are nevertheless located in countries without an EU adequacy decision, notably the United States. Transfers rely on:

• certification under the EU-US Data Privacy Framework (where available), and/or
• the European Commission’s Standard Contractual Clauses, and/or
• contractual necessity under Art. 49 (1)(b) GDPR when data is sent directly to us in the USA.

7. How long we keep information

We store personal information only as long as needed:

• Server logs: 90 days, then anonymised.
• Account and contractual data: for the lifetime of the account; deleted 30 days after termination unless legal retention applies.
• Billing and tax records: 10 years (statutory obligations).
• Review data: until the removal process concludes or 30 days after contract end.
• Support chats: 12 months after ticket closure.
• Web analytics: no personal data retained; statistics are aggregated and anonymous.
• Session recordings: deleted after 30 days.

8. Your rights

If you are located in the EEA or UK, you have the right to request access, rectification, deletion, restriction, portability and to object to processing based on legitimate interests, as well as the right to withdraw consent at any time. Contact info@getrefix.com (or our EU representative named in Section 2). We respond within one month.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work, or the place of the alleged infringement.

If you reside in California and the California Consumer Privacy Act (CCPA/CPRA) applies to us in the future, you may request to know or delete personal information. We do not sell or share personal information for cross-context behavioural advertising.

9. Security measures

We employ appropriate technical and organisational safeguards, including TLS encryption, access controls, firewalls and regular backups. No internet transmission or storage system is completely secure; therefore, we cannot guarantee absolute security.

10. Children’s privacy

Our Service is intended for users aged 18 and older and is not directed to children under 13. We do not knowingly collect data from children. If we learn that a child’s data was collected, we will delete it promptly.

11. Changes to this Policy

We may update this Policy when our practices change or legal requirements evolve. We will post the new version here and, if the changes are significant, provide advance notice via the Service or email.

12. Contact

For questions or concerns about this Policy, email info@getrefix.com or write to the address in Section 1.

End of Privacy Policy