Privacy Policy

1. Who We Are

Response Refinery ("we," "us," or "our") is a voice-of-customer analytics platform operated by Blake Allen. You can reach us at support@responserefinery.com.

2. What We Collect

We collect only what is necessary to provide the service:

• Account information: your username, email address, and a hashed (never plaintext) password when you register.
• Content you upload: customer reviews, survey responses, or other text data you upload for analysis. This data is processed and stored to power the clustering and insight features.
• Usage logs: server-side request logs (IP address, timestamp, HTTP method/path) retained for up to 30 days for debugging and security purposes.
• Authentication tokens: short-lived JWT tokens stored in your browser's localStorage to maintain your session.

We do not use tracking pixels, third-party analytics scripts, or advertising cookies.

3. How We Use Your Data

• To create and manage your account.
• To run the analysis pipeline on content you upload and return results to you.
• To send transactional email: email verification when you register, and password reset emails when you request them. We send no marketing email.
• To detect and prevent abuse or unauthorized access.

We do not sell, rent, or share your data with third parties for their own purposes.

4. Third-Party Services

We use the following sub-processors to operate the service:

• Amazon Web Services (AWS): cloud infrastructure (compute, database, storage) in the us-west-2 and us-east-1 regions.
• Resend: transactional email delivery (email verification and password reset only).
• Hugging Face: open-source ML model downloads used in the analysis pipeline; no user data is sent to Hugging Face.

5. Data Retention

Your account data and uploaded content are retained for as long as your account is active. If you delete your account, all associated data — including uploaded content, analysis results, and account information — is permanently deleted within 30 days.

You may request deletion of your account and data at any time by emailing support@responserefinery.com.

6. Security

Passwords are hashed using bcrypt and never stored in plaintext. All data in transit is encrypted via TLS. Access to the production database is restricted to authorized infrastructure only.

If you discover a vulnerability, please disclose it responsibly to support@responserefinery.com.

7. Your Rights

You may request access to, correction of, or deletion of your personal data at any time. Email us at support@responserefinery.com and we will respond within 30 days.

If you are located in the European Economic Area, you have additional rights under GDPR, including the right to data portability and the right to lodge a complaint with a supervisory authority.

8. Children

Response Refinery is intended for business use and is not directed at children under 13. We do not knowingly collect data from children.

9. Changes to This Policy

We may update this policy. When we do, we will update the "Last updated" date at the top and, for material changes, notify you by email or in-app notice.

10. Contact

Questions about this policy? support@responserefinery.com