01Overview
This policy covers the refract website, the free in-browser image tools, and the paid Google Drive automations (together, the “service”), operated by refract (“we”, “us”). By using the service you agree to this policy and our terms of service.
02What we never do
- Free tools run entirely in your browser. Images you convert, cut out, or center on the free tool never leave your device. We cannot see them, and no account is needed.
- We never sell your personal data or share it with advertisers.
- We never use your images to train machine-learning models, for marketing, or for anything other than running the pipeline you configured.
- We run no third-party advertising or analytics trackers.
03Information we collect
If you sign in or subscribe, we collect the minimum needed to run the service:
- Account details. When you sign in with Google we receive your name, email address, and profile picture, and we store a session so you stay signed in.
- Google Drive connection (paid plans only). If you connect Google Drive, we store the OAuth tokens Google issues us so your automations can run on a schedule. We use them solely for that.
- Automation and job records. Your automation settings (source and destination folder IDs, pipeline type, output format) and processing metadata: file names, Drive file IDs, input/output sizes, timestamps, and any errors. Not the image content itself.
- Billing records. Payments are processed by Paystack. We store your plan, subscription status, and Paystack customer/subscription references. We never see or store full card numbers or M-Pesa credentials.
- Usage counts. A monthly tally of server-side conversions, used to enforce plan quotas.
04How we handle your images
In the browser: processing happens locally on your device. Nothing uploads, full stop.
In Drive automations: our servers download each new photo from your chosen source folder, process it, and upload the result to your chosen destination folder. Image data is held only for the duration of the job and is not retained afterwards — we keep only the metadata listed above.
05Google user data
refract’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Drive access is used only to list your folders, read new files in the source folder you selected, and upload processed results to the destination folder you selected. It is never used for advertising, and humans do not read your files except with your permission for support, for security reasons, or where required by law. You can revoke refract’s access at any time from your Google account permissions.
06Cookies & local storage
We use cookies only for sign-in (session and CSRF protection). Your theme and accent-colour preferences are kept in your browser’s local storage and never sent to us. There are no advertising or cross-site tracking cookies.
07When we share information
Only with the providers needed to operate the service: Google (sign-in and Drive), Paystack (payments), and our hosting and database providers. Each receives only what its role requires. We may also disclose information if the law requires it or to protect the service and its users.
08Retention & deletion
We keep your data while your account is active. Disconnecting Google Drive stops automations from accessing it, and you can additionally revoke access from Google’s side at any time. If you ask us to delete your account, we remove your profile, Drive connection and tokens, automations, job history, and usage records; billing records may be retained where required for tax or accounting law. Email support@conceptualai.pro: to request deletion.
09Your rights
Under Kenya’s Data Protection Act, 2019 (and similar laws elsewhere) you may request access to, correction of, or deletion of your personal data, object to or restrict its processing, and request a copy in a portable format. Contact us and we will respond within the timelines the law sets. You may also lodge a complaint with the Office of the Data Protection Commissioner of Kenya or your local supervisory authority.
10Security
Data in transit is encrypted with TLS, access to production systems is restricted, and payment details are handled entirely by Paystack. No system is perfectly secure, but we collect little precisely so there is little to lose.
11Where data is processed
Our servers and service providers may be located outside Kenya. Where personal data is transferred internationally, we rely on providers that offer appropriate safeguards for it.
12Children
The service is not directed at children under 18, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.
13Changes to this policy
If we change this policy, we will update the date at the top and, for material changes, notify signed-in users. Continued use of the service after a change means you accept the updated policy.
14Contact
Questions about privacy: support@conceptualai.pro:.