Privacy Policy

This Privacy Policy explains how Refix Reputation Solutions LLC (“Refix”, “we”, “us”) collects, uses, discloses and protects personal information when you visit getrefix.com or use our cloud software-as-a-service platform (the “Service”). It also outlines your privacy rights and how you can exercise them.

1. Who we are

• Controller: Refix Reputation Solutions LLC
• Managing Director: Matin Gholipour Borhani
• 5 Judith Drive
• Englewood Cliffs, NJ 07632
• United States of America
• Email: info@getrefix.com

2. EU Representative (Art. 27 GDPR)

3. What information we collect and why

Below you will find the main categories of personal information we process and the purposes for doing so. We always process only the information needed to achieve these purposes.

3.1 Website visit

• Typical data: truncated IP address, date and time, requested page, browser and device information.
• Purpose: technical delivery of the website and IT security.
• Legal basis (GDPR): legitimate interests (Art. 6 (1)(f)).

3.2 Account creation and contract performance

• Data: company name, contact person, business email, address, Stripe payment token, Amazon API keys, login credentials.
• Purpose: set-up and administration of your account, provision of the Service, billing.
• Legal basis: contract (Art. 6 (1)(b)).

3.3 Use of the platform and review analysis

• Data: product identifiers (e.g. ASINs), review text and pseudonyms, timestamps, removal status.
• Purpose: identify and handle potentially illegitimate product reviews.
• Legal basis: contract (Art. 6 (1)(b)) and our legitimate interest in combating fake reviews (Art. 6 (1)(f)).

3.4 Optional legal enforcement via partner law firms

• Data: your contact details, the affected reviews and products.
• Purpose: pursue legal removal of reviews through our partner law firms when you choose that option.
• Legal basis: contract (Art. 6 (1)(b)).

3.5 Payments via Stripe

• Data: cardholder name, last four digits, expiry date, transaction ID.
• Purpose: collect success-based fees.
• Legal basis: contract (Art. 6 (1)(b)).

3.6 Support and chat (Crisp)

• Data: chat messages, email address, technical metadata.
• Purpose: respond to support enquiries.
• Legal basis: contract (Art. 6 (1)(b)).

3.7 Email delivery (Resend)

• Data: email address, message content, delivery status; for emails from our application also whether and when you clicked a link in the email.
• Purpose: send transactional emails (for example account emails and replies to enquiries you submit through our forms); newsletters are sent only with opt-in consent. Click measurement runs on our own servers without a tracking pixel and shows us which emails are useful.
• Legal basis: contract (Art. 6 (1)(b)), legitimate interests in B2B direct marketing and in improving our emails (Art. 6 (1)(f)), or consent for newsletters (Art. 6 (1)(a)).

3.8 Web analytics (cookieless)

• Data: aggregated, anonymous usage statistics (page views, referrer, approximate region, device and browser type). No cookies are set and no information is stored on or read from your device; no cross-site tracking and no advertising profiles.
• Purpose: measure reach and improve our website.
• Legal basis: legitimate interests (Art. 6 (1)(f)). Because the measurement is cookieless and stores nothing on your device, no consent is required.

3.9 Product analytics and session recordings (PostHog)

• Data: usage events such as page views without query strings, clicks, scroll depth, approximate region, and device and browser type, processed exclusively on EU servers (Frankfurt am Main).
• Purpose: understand how our website and application are used (aggregated statistics, heatmaps, click analysis) and improve them.
• Website: measurement runs cookieless and memory-only: PostHog stores no identifier, entry URL or analytics data in cookies or browser storage, IP addresses are discarded at ingestion, and visits are not linked across sessions (legitimate interests, Art. 6 (1)(f)). With your consent (Art. 6 (1)(a) GDPR, Sec. 25 (1) TDDDG), we additionally record sessions (mouse movement, clicks, pages visited and the content of our website shown on them) to analyse usability problems. PostHog remains cookieless. Everything you type into form fields is masked on your device and never transmitted. Areas that reflect your input (such as the product you checked in the rating check) and embedded third-party content are excluded from the recording, and e-mail addresses in page text are redacted. You can withdraw this consent at any time via "Cookie settings" in the footer.
• Application: for signed-in users, privacy-filtered usage events are linked to an internal account ID and masked sessions may be recorded so we can provide, secure and improve the Service (contract, Art. 6 (1)(b), and legitimate interests, Art. 6 (1)(f)). PostHog remains memory-only and receives no authentication cookies, access tokens, email addresses, page query strings or form content.
• Browser extension: Our servers and, once you have connected it, the extension itself send usage events to PostHog, for example opening its window or overview, an approval and its outcome, reporting a competitor or a failed request. They are linked to your internal account ID and contain only fixed values such as the view, a count or an error code, never product numbers, page addresses, product titles, review content, company names, search terms or names. In addition, the extension sends once a day how many product pages were opened and how many had problems, without any link to you. To find problems in the extension’s window, we also record how you use it (clicks, scrolling and the sequence of views). All content is masked in this recording; only fixed labels and the Refix logo remain visible. We do not record which Amazon pages you open, and we never record Amazon pages or other websites. The legal basis is our legitimate interest in a working extension and in improving it (Art. 6 (1)(f) GDPR). Disconnecting the extension ends the recording; you can object at any time by email to info@getrefix.com.

3.10 Appointment booking (Cal.com)

• Data: information entered in the booking form such as name, business email, selected appointment and optional details, as well as time zone and, where present, campaign parameters from the page URL.
• Purpose: select, book and organise a demo appointment and attribute the enquiry to its source.
• Legal basis: steps prior to entering into a contract (Art. 6 (1)(b)) and our legitimate interest in efficient appointment scheduling (Art. 6 (1)(f)).

3.11 Sign in with Google

• Data: your Google account identifier, email address, first and last name, and profile picture, to the extent your Google account provides them.
• Purpose: registration and sign-in without a separate password, and linking an existing account to your Google account.
• Legal basis: performance of a contract and steps prior to entering into a contract (Art. 6 (1)(b)).
• Voluntary: signing in with an email address and password remains fully available. A connection to Google is established only once you select "Continue with Google"; Google then learns that you are signing in to Refix. Google processes this as an independent controller under its own terms. You can disconnect an existing link at any time in your account settings.

3.12 Review invitations (Trustpilot)

• Data: name, business email address and a reference number (such as the invoice number); for automatic invitations, also the content of the email in which we copy Trustpilot.
• Purpose: inviting our customers to review their experience with Refix on Trustpilot. Who we invite follows a fixed rule and does not depend on how satisfied someone is.
• Legal basis: our legitimate interest in feedback from our customers and in showing genuine customer reviews (Art. 6 (1)(f)). You can object at any time, via the unsubscribe link in the invitation or by email to info@getrefix.com.
• Trustpilot’s role: Trustpilot A/S processes invitation data on our behalf (Art. 28 GDPR). If you write a review, Trustpilot processes it as an independent controller under its own terms.

3.13 Browser extension

• Data: sign-in data (email address and session tokens, stored locally in your browser); on product and review pages you open on the Amazon shops the extension runs on (amazon.de, .com, .co.uk, .fr, .it and .es), the product identifier (ASIN), the marketplace, the selected company and the identifiers of the visible reviews, including products of other sellers, for which it also sends the title and category; search terms you enter in the extension’s window; new reviews with 1 to 3 stars of your company’s products, with the details listed in Section 13; on pages of your company’s products, the star rating, the number and distribution of ratings and the Buy Box (seller, notice); your approvals (identifiers of the case, review, product and company); competitor products you report, with your optional note; your agreement when connecting (time and version of the text); usage statistics and the recording of the window (Section 3.9).
• Purpose: make the functions of your Refix account available directly on Amazon, check new critical reviews of your products right away, keep your company’s product data current, handle reported competitors (our team may contact you about them) and improve the extension.
• Legal basis: contract (Art. 6 (1)(b) GDPR) where you are our contract partner, otherwise our legitimate interest and that of your company in providing the service it booked (Art. 6 (1)(f) GDPR). Reading Amazon pages and storing data in the browser are strictly necessary for the extension you asked for (Sec. 25 (2) no. 2 TDDDG). Insofar as consent is required (Sec. 25 (1) TDDDG), you give it by connecting and withdraw it by disconnecting the browser. For the data of review authors, see Section 13.
• Retention: page requests only in our server logs; everything else as described in Section 7.

Details are in the privacy notice of the browser extension.

4. Cookies

We keep cookies to a minimum. Essential cookies and storage only do three things: keep you signed in to the application, remember your language, and remember your consent choice. They are strictly necessary (Art. 6 (1)(f) GDPR; Sec. 25 (2) TDDDG) and contain no tracking data.

The analytics described in Sections 3.8 and 3.9 use no PostHog cookie and no PostHog browser storage, either on the website or in the application. Your consent choice itself is stored locally so the website can respect it. Giving consent enables only the session recording described in Section 3.9; it does not create an analytics identifier. You can change that choice at any time via "Cookie settings" in the footer.

We use no advertising cookies and no cross-site tracking. You can also manage or block cookies in your browser settings at any time.

5. Who has access to your data

We never sell personal information. We disclose it only when necessary for the purposes set out above:

• Supabase, Inc. (USA): database and back-end of our platform; our database is hosted in the EU (AWS region eu-west-1, Ireland).
• Google Cloud (Google LLC, USA): cloud infrastructure and back-end services, operated in the EU (region europe-west1, Belgium).
• Google Ireland Limited (Ireland): sign-in with Google, if you choose that route; Google acts as an independent controller.
• Stripe Payments Europe Ltd. (Ireland) / Stripe, Inc. (USA): payment processing.
• Vercel Inc. (USA): hosting of our website and application, and cookieless reach measurement; server-side processing runs in the EU (Dublin), static content is delivered via a global edge network.
• PostHog Inc. (USA), EU Cloud: web and product analytics; event data is hosted in the EU (Frankfurt).
• Cal.com, Inc. (USA): appointment scheduling and handling of demo bookings.
• Crisp IM SARL (France): chat support.
• Resend, Inc. (USA): transactional email delivery.
• Trustpilot A/S (Denmark): sending review invitations on our behalf; independent controller for published reviews.
• Our partner law firms: independent controllers for legal enforcement, engaged only with your approval.
• Amazon: relevant EU or US entities receive takedown requests on your behalf.
• Legal authorities or potential acquirers: only if required by law or in the context of a corporate transaction.

6. International transfers

We host our core infrastructure in the European Union: the platform database in Ireland, cloud services in Belgium, analytics in Frankfurt am Main and server-side compute in Dublin. Some recipients are nevertheless located in countries without an EU adequacy decision, notably the United States. Transfers rely on:

• certification under the EU-US Data Privacy Framework (where available), and/or
• the European Commission’s Standard Contractual Clauses, and/or
• contractual necessity under Art. 49 (1)(b) GDPR when data is sent directly to us in the USA.

7. How long we keep information

We store personal information only as long as needed:

• Server logs: 90 days, then anonymised.
• Account and contractual data: for the lifetime of the account; deleted 30 days after termination unless legal retention applies.
• Billing and tax records: 10 years (statutory obligations).
• Review data: until the removal process concludes or 30 days after contract end.
• Support chats: 12 months after ticket closure.
• Review invitations: Trustpilot deletes copies of invitation emails after 30 days and other invitation data after 2 years at the latest.
• Web analytics: no personal data retained; statistics are aggregated and anonymous.
• Session recordings: deleted after 30 days.

8. Your rights

If you are located in the EEA or UK, you have the right to request access, rectification, deletion, restriction, portability and to object to processing based on legitimate interests, as well as the right to withdraw consent at any time. Contact info@getrefix.com (or our EU representative named in Section 2). We respond within one month.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work, or the place of the alleged infringement.

If you reside in California and the California Consumer Privacy Act (CCPA/CPRA) applies to us in the future, you may request to know or delete personal information. We do not sell or share personal information for cross-context behavioural advertising.

9. Security measures

We employ appropriate technical and organisational safeguards, including TLS encryption, access controls, firewalls and regular backups. No internet transmission or storage system is completely secure; therefore, we cannot guarantee absolute security.

10. Children’s privacy

Our Service is intended for users aged 18 and older and is not directed to children under 13. We do not knowingly collect data from children. If we learn that a child’s data was collected, we will delete it promptly.

11. Changes to this Policy

We may update this Policy when our practices change or legal requirements evolve. We will post the new version here and, if the changes are significant, provide advance notice via the Service or email.

12. Contact

For questions or concerns about this Policy, email info@getrefix.com or write to the address in Section 1.

13. Information for authors of Amazon reviews

This section is addressed to people whose Amazon reviews we process (Art. 14 GDPR). The controller and the EU representative are named in Sections 1 and 2.

• Data: title, text, star rating, date and country of the review, variant, your displayed name and the link to your public Amazon profile, the “Verified Purchase” and Vine labels, helpful votes, and photos and videos. To detect coordinated manipulation, we may also evaluate the public details of your profile. We do not have contact details of authors.
• Source: public pages on Amazon that we retrieve ourselves, and reviews a seller’s browser extension sends to us when the seller opens a page of their product.
• Purpose: identify and handle potentially illegitimate product reviews, and establish, exercise and defend legal claims.
• Legal basis: legitimate interests of ours and of the sellers concerned (Art. 6 (1)(f) GDPR). Where a review contains health data or other special categories of personal data, the legal basis is Art. 9 (2)(e) GDPR insofar as you have manifestly made the information about yourself public, and otherwise Art. 9 (2)(f) GDPR.
• Process and automated assessment: Our software, including AI, makes a preliminary assessment of every review. A review is pursued only after the seller concerned has approved it, individually or through an automatic approval the seller has set up. With an automatic approval, a review flagged by the software can be pursued without a human deciding on that specific review. One of our partner law firms then examines it on its own responsibility, or we report it under Amazon’s Community Guidelines. Amazon decides whether a review is removed.
• Recipients: the sellers concerned; our service providers for hosting and database (Vercel, Supabase, Google Cloud), AI checks (Google Gemini, Langfuse), retrieval of public Amazon pages (Oxylabs), internal notifications (Slack), case list (Google Workspace) and error monitoring (Sentry); after an approval, our partner law firms and Amazon.
• Third countries: transfers to the United States rely on the EU-US Data Privacy Framework or the Standard Contractual Clauses of the European Commission (Section 6). You can obtain a copy of the safeguards by writing to info@getrefix.com.
• Retention and rights: as described for review data in Section 7 and in Section 8.
• No individual notification: We do not have contact details of authors, and Amazon offers no way to reach them. Notifying each individual is therefore impossible for us; we inform the public instead (Art. 14 (5)(b) GDPR).

Right to object (Art. 21 GDPR): You may object to the processing of your data at any time on grounds relating to your particular situation, by email to info@getrefix.com. We will then stop processing it unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or need it for the establishment, exercise or defence of legal claims.

End of Privacy Policy