Who we are
Refract is operated from Barcelona, Spain. We are the controller of the personal data described here, for the Refract website and app at refract-ad-flow.base44.app and any domain we move them to.
Agencies use Refract on behalf of their own clients. For data an agency adds about its clients (client profiles, campaigns, imported results and the people it invites), the agency decides what goes in and why, so the agency is the controller and Refract processes that data on its behalf under our data processing agreement (/dpa).
What we collect
- Account details: your name, email address and sign-in details, and the one-time codes we email to confirm your address.
- Workspace and clients: workspace and client names, websites and the descriptions you write, plus who on your team can open each client.
- Campaign content: personas, conversation maps, ad groups, context hints, ads, landing page links and images you upload.
- Results: daily impressions, clicks, spend and conversions by campaign, ad group, ad and country, from reports you import or sync from OpenAI Ads Manager. These are totals; they contain nothing about the people who saw the ads.
- Ads Manager connection (optional, per client): the account name and the API key you paste. The key is stored encrypted and never shown again.
- Billing: your plan, billing status and a Stripe customer reference. Card details are entered on Stripe's own page and never reach Refract.
- Usage and technical data: which pages are opened and for how long, device and browser type, and server logs such as IP address and error reports, used to keep the service secure and working.
- Messages: what you send us by email.
What we don't do
- We never read anyone's ChatGPT conversations. Conversation maps are simulated from your brief, and results come only from Ads Manager reports you choose to import or sync.
- We don't sell, rent or trade personal data, and we don't use data brokers.
- We don't use advertising trackers or outside analytics services. Fonts are served by Refract itself.
- We don't pool one customer's data with another's. Benchmarks are the only exception, they are opt-in, and they share rates only (see below).
Why we use it, and our legal basis
Under the GDPR we rely on these legal bases:
- To provide the service you signed up for (performance of a contract): your account, workspaces, campaign builds, exports, Conversation Intelligence, billing and support.
- Legitimate interests: keeping Refract secure (sign-in checks, rate limits, fraud and abuse prevention), fixing problems, and understanding how features are used so we can improve them. We balance these against your rights and keep the data involved to a minimum.
- Consent: benchmarks. Your workspace's owner or admin chooses to contribute, and can switch it off at any time from the Trust centre.
- Legal obligations: keeping invoices and accounting records, and responding to lawful requests.
AI in Refract
Some campaign-builder steps use AI: summarising a web page, drafting personas, the conversation map, context hints, ad copy and market estimates in the explorer. For these steps, the campaign brief, the text of the public pages you ask us to scan and the builder content for that step are sent to the AI service provided by our hosting provider, Base44, which uses AI model providers it chooses under its own terms. Your imported results are never sent to an AI service.
Conversation Intelligence (theme health, signals, suggestions, forecasts, briefs and benchmarks) is calculated by Refract's own code from your data, with fixed rules and no AI. Nothing in Refract makes decisions about people that have legal or similarly significant effects.
International transfers
Our hosting provider stores data in the United States, and some other providers also process data outside the European Economic Area. Where they do, we rely on the safeguards they provide, such as the European Commission's Standard Contractual Clauses or an adequacy decision, including the EU-US Data Privacy Framework.
Benchmarks
If your workspace opts in, Refract calculates click-through rates by funnel stage, market and campaign objective from your real results and combines them with other contributing workspaces. A benchmark is shown only when at least 5 workspaces contribute, rounded so no single workspace's rate shows. Client names, websites, hints, ads and raw results never leave your workspace. Sample results are never included.
How long we keep it
- Account and workspace data: while your account is open. When you ask us to close it, we delete it within 30 days.
- Client data, campaigns and results: until you delete them or the client, or close your account.
- Ads Manager API keys: until you disconnect the account or delete the client.
- Billing records: as long as Spanish tax and accounting law requires.
- Logs and usage statistics: for a limited period, then deleted or kept only in aggregate.
Deleted data can remain in encrypted backups for a short period before those backups are overwritten.
Your rights
You can ask to access, correct or delete your personal data, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Owners and editors can export everything stored for a client from the Trust centre. For anything else, email info@refractads.com and we will reply within one month.
If you are a client of an agency that uses Refract, please contact that agency first, as it controls that data. We will help it respond.
You also have the right to complain to a data protection authority. In Spain that is the Agencia Española de Protección de Datos (aepd.es), or you can contact the authority where you live or work.
Security
Access is checked by the database on every record, so people only see the workspaces and clients they belong to, and every change goes through server-side checks. Connections are encrypted in transit, Ads Manager API keys are encrypted at rest, and sensitive actions are rate limited. No system is perfectly secure; if we become aware of a breach that affects you, we will tell you and the authorities as the law requires.
Children
Refract is a business tool and is not meant for anyone under 18. We don't knowingly collect data about children.
Changes to this policy
We will update this page when how we handle data changes, and tell account owners by email before material changes take effect. Last updated: 17 October 2026.
Contact
Email info@refractads.com with any question or request about your data.