Privacy Policy

Refinery is operated by [TO CONFIRM: registered company name], a company registered in [TO CONFIRM: jurisdiction] under company number [TO CONFIRM], with its registered office at [TO CONFIRM: registered address]. For the purposes of UK GDPR and EU GDPR we are the data controller for the personal data described in this policy.

For any question about this policy or about how we handle your data, contact [TO CONFIRM: privacy contact email].

Website. If you book a call, that booking is handled by our scheduling provider and we receive the name, email address and any notes you supply. We do not run advertising or cross-site tracking on this site.

Product. Refinery accounts hold a username, a credential and, where multi-factor authentication is enabled, an MFA secret. The product keeps a hash-chained activity log recording which user performed which action and when; this is a deliberate audit-integrity feature, not analytics.

Your source code is not personal data we collect. Refinery is designed to run inside your own environment. In a self-hosted deployment the COBOL you analyse, and the evidence produced from it, stay on your infrastructure and are never transmitted to us. [TO CONFIRM: confirm this holds for every deployment model you intend to offer, including any hosted option.]

We process booking details to respond to your enquiry and arrange a conversation (legitimate interests, and steps taken at your request prior to entering a contract). We process product account and activity data to operate the service, authenticate users and maintain the audit trail our customers rely on (performance of a contract, and compliance with our customers’ own legal obligations).

We use a small number of processors to run the business: [TO CONFIRM: list every sub-processor (hosting, scheduling, email, analytics if any) with the country each operates in]. We do not sell personal data, and we do not share it for advertising.

Website enquiry data is held in [TO CONFIRM: region] and retained for [TO CONFIRM: period]. Where Refinery is self-hosted, retention of product data is under your control: the activity log supports a tiered policy, with a standard retention window and a longer compliance window for records that must be kept for regulatory purposes. [TO CONFIRM: state the default periods you want to commit to publicly.]

You can ask us for a copy of your personal data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable form. Contact [TO CONFIRM: privacy contact email] and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner’s Office, or to your local supervisory authority in the EEA. [TO CONFIRM: confirm the correct lead supervisory authority for your establishment.]

If we change this policy we will update the date at the top of this page and, where the change is significant, tell affected customers directly.