What we store, where it lives, and who can see it.
Refine holds two kinds of data: what the assistants say about your brand, and what you connect to make sense of it. This page says plainly how each is handled. Anything not answered here: robin@getrefine.ai.
Your account
You sign in with an email address and a password. Authentication is handled by Supabase Auth; passwords are hashed and never stored or logged in clear. Every request travels over HTTPS, and the domain enforces it (HSTS).
Where your data lives
Brands, prompts, the answers we record and the reports built from them live in a managed PostgreSQL database at Supabase, encrypted at rest and in transit. The application runs on Vercel; this website on Cloudflare. We do not sell data, and no customer sees another’s.
Google Search Console and GA4
The OAuth connection is handled by Pipedream Connect, a managed authentication service. Refine never receives or stores your Google refresh token — only an account reference. We read reporting data; we never write to your properties.
WordPress, Webflow, Shopify, GitHub
The credential you issue for publishing is encrypted with AES-256-GCM before it is stored, and decrypted only at the moment we publish something you approved. Revoke it on your side and the connection stops at once. MCP keys are kept as a SHA-256 hash: shown once, never recoverable from the database.
What goes to AI providers
To measure answers, Refine sends the prompts you monitor to the assistants’ APIs (OpenAI, Google Gemini, Perplexity). Those calls carry the prompt and your brand and competitor names — nothing from your connected accounts. We use the providers’ commercial APIs, whose terms exclude inputs from model training.
Payments
Billing is handled by Stripe. Card numbers are entered on Stripe pages and never pass through our servers; we hold a customer reference and the invoices, which you can download from the app.
Product analytics
Inside the product we use PostHog to see which features are used. On this website, Google Tag Manager and GA4. Neither receives the content of your prompts or reports.
Export and deletion
Your prompts and results are yours: export them from the app at any time. To delete a workspace and everything in it, email us from the account address; we confirm once it is done. A data processing agreement (DPA) is available on request.
Straight answers
Compliance, in one paragraph
We do not hold a SOC 2 report today. If your procurement needs one, tell us and we will walk you through our controls directly, and sign a DPA. See also the privacy policy and terms of service.
Found a vulnerability? Write to robin@getrefine.ai. We read every report, reply personally, and credit researchers who want to be credited. Please give us a reasonable window to fix the issue before publishing it.