Privacy Policy

Refinery is run by Atilade Oke, trading as Refinery, based in London, United Kingdom. Refinery is not yet a registered company. For the personal data described here, we are the data controller.

For any question about this policy, or to use any of your rights, email okeatilade@gmail.com.

When you book a call. Bookings are made on Cal.com. We receive the name, email address and any notes you give there, and the time you chose.

When you email us. Your name, email address and whatever you choose to write.

When you visit this site. Our hosting provider keeps short-lived request logs, such as IP address, browser type and the page requested, to deliver and protect the site. We do not use them to identify or profile you.

We do not run analytics, advertising or cross-site tracking on this site, and it sets no cookies. See our Cookie Policy.

Refinery is installed and run inside the customer’s own environment, on-premise or in the customer’s own cloud. We do not host it. The COBOL it analyses, the evidence it produces, and the account and activity records it keeps stay on the customer’s infrastructure and are not sent to us. The core engine, certificates and sign-off run fully offline.

Some features can connect to outside services if the customer turns them on: an AI model provider for summaries and suggested fixes (which may then receive excerpts of the code), a hosted memory service for past decisions, and the customer’s own code host, ticketing and security monitoring tools. Those connections are made from the customer’s environment, under the customer’s own accounts and contracts with those providers. Each of these stays off until the customer configures it with its own credentials, and code host and security monitoring connections go only to systems the customer points them at.

Where we help a customer with support, the customer controls that data and our data processing terms apply. See our Data Processing Addendum.

Replying to enquiries and arranging calls: our legitimate interest in responding to people who contact us, and steps you ask us to take before a possible contract.

Running and securing the website: our legitimate interest in keeping the site available and protected from abuse.

Keeping records we are required to keep: compliance with a legal obligation, where one applies.

We do not rely on consent for any of the above. If we ever do, you can withdraw it at any time.

We use these providers to run the website and handle contact:

• Vercel Inc. (United States) hosts the website and keeps its request logs. Pages are served from Vercel’s global network, including its London location.
• Cal.com, Inc. (United States) runs the booking page.
• Google LLC (United States) provides the email inbox we use (Gmail).

Links to LinkedIn and Cal.com take you to their own sites, where their privacy policies apply. We do not sell personal data or share it for advertising.

These providers are based in the United States, so your data may be processed there. Where that happens we rely on a recognised safeguard: the UK Extension to the EU-US Data Privacy Framework where the provider is certified to it, or otherwise the UK International Data Transfer Addendum and the EU Standard Contractual Clauses in the provider’s data processing terms. Email okeatilade@gmail.com for more detail.

Enquiry, booking and email data: up to 24 months after our last contact with you, unless it becomes part of a customer relationship, in which case we keep the records we need for the length of that contract and as the law requires afterwards. Website request logs are kept by Vercel for the short period set by its own policies.

You can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or give it to you in a portable form. Email okeatilade@gmail.com. We will reply within one month.

You can complain to the UK Information Commissioner’s Office at ico.org.uk. If you are in the EU or EEA, you can also complain to the data protection authority where you live or work. We would be grateful for the chance to put things right first.

If we change this policy we will update the date at the top of this page and, where the change matters to you, tell you directly.