REFM8 privacy notice
Who is responsible
Fusilair Ltd, company number 16006669 and VAT registration number GB 496 7158 35, operates REFM8 and supplies its subscriptions. Contact admin@fusilair.co.uk or write to 51 Mays Drive, Westbury, England, BA13 3ZA about this notice or your information. We control the use of account, subscription, support and service-security information. A subscribing business normally controls the customer, employee, site and job information that it puts into its workspace; we process that workspace information to provide the service for it. Requests about a subscribing business's records should also be directed to that business.
Information we use and why
We use account names, email addresses, company contact and billing details, authentication and session records, subscription and invoice references, support correspondence and security/audit records. We also store the records, files, photos and signatures that authorised users add or receive through company workflows. Some information comes from your company administrator, an invitation, a customer interaction or a provider that your company connects, rather than directly from you.
Account and subscription information is used to perform our contract, provide access, take payment and respond to support requests. Required accounting and tax records are kept to meet legal obligations. We use proportionate authentication, audit and security information for our legitimate interests in preventing abuse, protecting company workspaces, investigating faults and recovering the service. Where optional marketing relies on consent, it is separate from subscribing and consent can be withdrawn. Required account and company information must be supplied for us to create the account and provide the subscription.
Providers and sharing
Our service providers include Supabase for authentication, database and file storage; Vercel for application hosting; Stripe for payment and subscription processing; and Resend for platform email delivery. Stripe receives payment details directly in its checkout; the REFM8 signup form does not collect card numbers. Company-authorised integrations receive the information needed for the connected workflow. We may also disclose information where legally required, or to investigate misuse and protect legal rights. Company information is shared with its authorised members and workflow recipients according to the company's actions and permissions.
The live Supabase project is in Ireland. Some provider operations may process information outside the UK, including in the United States; a project's region does not determine the location of every support, delivery or other provider operation. Contact us for details of the relevant transfers and safeguards.
Retention and your choices
We retain account and workspace information while it is needed to provide the subscribed service and associated recovery, export or support. After an account closes, the need to retain particular records depends on outstanding support or legal claims, tax and accounting requirements, security investigations, deletion instructions and the lifecycle of retained recovery copies. Cancelling renewal does not itself request deletion. Contact us for the retention or deletion arrangements for your account and records. Necessary authentication cookies maintain sign-in; any locally prepared offline company information is also affected by the device's settings and the user's offline actions.
Your rights
Depending on the information and lawful basis, you may ask for access, correction, deletion, restriction or a portable copy. You may object to processing based on legitimate interests, including relevant security or service administration, and can withdraw consent where we rely on it. We may need to verify a requester's authority before disclosing or changing company information. Contact us using the details above. You can also complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.