What the site keeps.

The early-access form

The form on refiroo.com asks for three things: your e-mail address, your organisation, and, if you choose, what you would use refiroo for. We do not store your IP address or your browser's user agent.

Why: to answer your request. Legal basis: steps taken at your request before a contract (GDPR Art. 6(1)(b)).

Who processes it: the form's server code passes your request to our own control plane, which runs on a server in Sweden operated by Microsoft Ireland Operations Limited (Azure) and stores it there. Resend (Plus Five Five, Inc.) sends us a notice of it by e-mail, and sends you an invitation when we can take you on.

How long: 12 months from the day the request arrives. If you ask us sooner, we delete it sooner, and the notice in our mailbox too.

Hosted refiroo

When your organisation signs up for hosted refiroo (refiroo.com only), we keep the organisation's name, address and VAT or registration number, your name and work e-mail, the address of your instance, and the version of the terms you accepted.

Why: to create your instance, to write to you about it, and to invoice. Legal basis: the contract with your organisation (GDPR Art. 6(1)(b)); keeping invoices is a legal duty (GDPR Art. 6(1)(c), the Czech VAT act).

Who processes it: Microsoft Ireland Operations Limited (Azure) runs the server that holds it (Sweden); Resend (Plus Five Five, Inc.) (Plus Five Five, Inc., US) sends our e-mails to you; Cloudflare carries the form. The VAT number is checked in the European Commission's VIES service.

How long: a sign-up that is not confirmed is deleted after 24 hours. The rest is kept while your organisation is a customer and deleted with the instance; invoices are kept 10 years, as the law asks.

The data inside your instance is your organisation's: we process it on its behalf, as the data processing agreement says.

The host's logs

Cloudflare, Inc. serves both sites. Like any host, it sees each request. Its privacy policy says this may include your IP address, traffic routing data and system configuration information. We do not read these logs for anything but running and protecting the site.

The form's server code writes a short message when passing a request on fails. The messages hold no part of your entries. Cloudflare's Workers Logs keeps such messages for 3 days on its free plan and 7 days on its paid plan.

Legal basis: our legitimate interest in running the site (GDPR Art. 6(1)(f)). You may object.

How long: Cloudflare's privacy policy states no period for these logs, only that it keeps personal information for a period consistent with its business purposes. We cannot name a number it does not give.

Analytics

We count visits with Cloudflare Web Analytics. Cloudflare says it uses no cookies or local storage and does not fingerprint visitors by IP address, user agent or any other data. The page loads one script from Cloudflare for it.

The script reports each page view when the page has loaded and when you leave it. Query strings are not logged. Cloudflare's documentation does not list every field the script sends.

Legal basis: our legitimate interest in knowing which pages are read (GDPR Art. 6(1)(f)). You may object at any time: write to the address below.

How long: Cloudflare keeps the unsampled data for 7 days, then about a tenth of it. Its dashboard reaches back six months. It states no end date for the reduced data.

Theme choice

If you pick light or dark, your browser keeps the choice in local storage under the name rdm:theme:v1. It is never sent to us. Clear your site data and it is gone.

Fonts

The fonts are served from this site. Your browser makes no request to a font service.

Transfers

Cloudflare, Inc. serves both sites and counts visits with its Web Analytics. Your browser may contact these of its hosts: static.cloudflareinsights.com, cloudflareinsights.com, challenges.cloudflare.com. Microsoft Ireland Operations Limited (Azure) runs the server of our control plane in Sweden, which stores early-access requests and sign-ups. Resend (Plus Five Five, Inc.) sends our e-mails: the notice of a request to us and the invitation to you.

Cloudflare, Inc. is based in the US. For transfers from the EU to the US it states that it complies with the EU-U.S. Data Privacy Framework, and that it relies on standard contractual clauses if that certification lapses or is invalidated. Its privacy policy and its data processing addendum say so.

Resend is run by Plus Five Five, Inc., which is based in the US and processes mainly there. Its data processing addendum relies on standard contractual clauses and on the EU-U.S. Data Privacy Framework for transfers from the EU.

Your rights

You can ask us for:

• Access: a copy of what we hold about you.
• Correction: a fix to anything that is wrong.
• Deletion: removal of what we hold.
• Restriction: that we stop using it while a question is open.
• Objection: to anything we do on the basis of our legitimate interest.
• Portability: what you gave us, in a form you can reuse.

Write to the address below. We answer within one month.

Complaints

You can complain to the Czech authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. Or to the authority where you live.

Contact

Krisztian Toth runs the site. Write to krisztian.toth@refiroo.org. Who we are, in full: the Legal notice.