Hosting and the app platform
Refract is built and hosted on Base44. Base44 stores and processes all customer data in the app, and engages its own providers listed in the next section.
| Company | What it does for Refract | Location | Transfer safeguard |
|---|---|---|---|
| Base44, Inc. | App hosting, database, file storage (ad images), sign-in, transactional emails (sign-in codes and invitations), basic usage statistics, and the AI service used for builder steps | United States | Standard Contractual Clauses or EU-US Data Privacy Framework (Base44 DPA) |
Providers engaged by Base44
Base44 publishes these as its sub-processors (base44.com/dpa/exhibitc). They process customer data only to run the Base44 platform that Refract is built on.
| Company | What it does | Location |
|---|---|---|
| MongoDB | Database storage and hosting | United States |
| Render | Server hosting | United States |
| Supabase | Media hosting (uploaded images) | United States |
| Twilio SendGrid | Sending emails | United States |
| Google Cloud | Analytics services | United States |
| Datadog | Logging | United States |
| OpenAI | AI model used for builder steps | United States |
| Anthropic | AI model used for builder steps | United States |
| Wix.com Ltd. | Base44's parent company: providing and improving the platform | Israel (EU adequacy decision) |
For builder steps, only the campaign brief, public page text, claims, existing-ad text and the content of that step are sent to the AI model. Imported results, API keys and invited people's email addresses are never sent.
Providers for Refract's own account and billing
These handle data about Refract's customers (the workspace owner's billing details), not the data customers add about their clients.
| Company | What it does | Location |
|---|---|---|
| Stripe | Payments, invoices and the billing portal. Card details are entered on Stripe's own page. Stripe acts as an independent controller for fraud prevention and legal compliance. | Ireland and United States |
Services you connect yourself
If you connect an OpenAI Ads Manager account to a client, Refract uses the API key you provide to read that account's delivery and conversion reports. OpenAI processes that account's data under your own agreement with OpenAI, so it isn't a Refract sub-processor. Refract never changes campaigns through the connection.
Changes
When we add or replace a sub-processor we update this page and email workspace owners at least 14 days beforehand (or as soon as we're told, if one of our providers gives us less notice). You can object on reasonable data protection grounds by emailing info@refractads.com, as set out in the data processing agreement.