Refractr
Security and data handling
What happens to the documents you send Refractr, in plain terms. Written for the IT and security people who have to approve it. Last updated 8 November 2026.
In short
- Your documents and results are not stored, unless you opt in to model training.
- Your documents are not used for training, unless you opt in.
- The application, database and model run on our own hardware in the Netherlands.
- Documents are not sent to OpenAI, Anthropic or any other model provider.
- Traffic is encrypted over HTTPS.
- A data processing agreement (DPA) is available on request.
Where your data goes
Your system → HTTPS → Cloudflare (network edge) → Refractr, the Netherlands → response
The extraction model is Refractr's own and runs on our own machines in the Netherlands. There is no third-party AI or cloud processing of document content.
Requests pass through Cloudflare's network for encryption in transit and protection against abuse. Cloudflare does not store document content.
Retention
| Data | Kept for |
|---|---|
| Document, schema and extraction result | Not stored. Processed to answer your request. An asynchronous result is held for a limited time so you can retrieve it. |
| Same, with Help improve Refractr switched on | Stored and used for training. Personal data is removed or pseudonymized from training examples. |
| Usage metadata (timestamps, job IDs, sizes, status, IP addresses for rate limiting) | As long as needed for billing, support and abuse prevention |
| Account and billing records | As long as the account is active, plus legal and accounting retention |
| Database backups | Encrypted, on our own hardware in the Netherlands |
Training is off by default for new accounts. Once an example has been used to train a model, it cannot be removed from that model.
Training
- Off by default. The switch is Help improve Refractr, at signup or under Profile in the dashboard.
- Opted-in accounts get 100 free extractions a day instead of 20.
- Switching it off stops new requests from being stored. Content stored while it was on remains part of the training data.
- While opted in, do not send identity documents or special-category personal data (Article 9 GDPR). This is part of our Terms of Service.
Access and accounts
- All traffic to the website and API is encrypted over HTTPS.
- Passwords are hashed and never stored in plain text.
- API keys are secret tokens you can revoke at any time from the dashboard. New accounts confirm their email address before their keys work.
- Access to production systems is restricted to the Refractr team.
- Deleting your account removes your account data and revokes your API keys.
Subprocessors
| Subprocessor | Purpose | Sees document content? |
|---|---|---|
| Cloudflare | Network edge, encryption in transit, abuse protection | In transit only, not stored |
| Stripe | Payments for credit purchases | No |
| Ahrefs | Cookie-free statistics on public web pages | No |
| Zoho (EU) | Email for account messages and support | Only what you email us yourself |
Company and legal
- Operated by Refractr B.V., KvK 42191009, the Netherlands, under the GDPR. Supervisory authority: the Autoriteit Persoonsgegevens.
- For business use, Refractr acts as your processor for the documents you submit. A data processing agreement is available on request: [email protected].
- Security questions, or reporting a vulnerability: [email protected].
- Full details: Privacy Policy and Terms of Service.
Reviewing Refractr for your company? Email us your questions and we will answer within one working day.