Privacy Notice

Who we are

RefinedOS is operated by RefinedOS Ltd, a company incorporated in the United Kingdom. In this notice, “RefinedOS”, “we” and “us” mean RefinedOS Ltd.

If postal address, company registration or ICO details are not yet displayed above, they will be published here as soon as completed.

Our roles: controller and processor

Under UK data protection law, RefinedOS acts in different roles depending on the data. We are not always one or the other.

RefinedOS as controller

We decide why and how we use personal data for:

• RefinedOS accounts and sign-in, including business owners, managers and staff who use the service;
• billing, subscription administration and messaging credit pack purchases;
• security, abuse and fraud prevention;
• support, feedback and communications with business users;
• business contact information, and running and administering the platform;
• improving the service, where we decide the purpose.

RefinedOS as processor

For data that a business puts into RefinedOS about its own customers and team, the business is the controller and RefinedOS generally acts as its processor, handling the data on the business’s documented instructions. This includes:

• customer records and contact details;
• bookings, appointment history, cancellations and no-shows;
• notes and other information the business enters or imports via CSV;
• booking-related messages sent on the business’s behalf (email, SMS, and push; WhatsApp once connected);
• customer marketing campaigns and recipient preferences;
• waitlist records;
• service, staff and working-hours information.

The terms for that processing are in our Data Processing Agreement.

The personal data we process

Depending on how you use RefinedOS, this can include:

We do not use personal data to build advertising profiles, and we do not sell personal data.

Why we use it

• creating and administering accounts and signing people in;
• making and managing bookings, calendars, customers, staff schedules and services;
• sending booking confirmations, changes, cancellations and reminders, and waitlist alerts;
• sending notifications to staff devices that have turned notifications on;
• billing and managing subscriptions;
• keeping the service secure, preventing misuse and investigating problems;
• supporting business users and answering requests;
• maintaining and improving the service;
• meeting our legal obligations.

Our lawful bases

For data where we are the controller, we rely on:

• Contract, to provide the service you have signed up to and to take payment for it;
• Legitimate interests, to keep the service secure, prevent abuse, provide support and maintain and improve the service, where these are not overridden by your rights;
• Legal obligation, for example tax and accounting records;
• Consent, only where we ask for it, for example turning on device notifications. You can withdraw it at any time.

For data we process as a business’s processor, the business decides its own lawful basis for handling its customers’ data, and is responsible for it.

Booking messages and marketing

RefinedOS sends transactional messages for businesses: booking confirmations, reschedules, cancellations, reminders and waitlist availability. These are part of delivering the booking, not marketing. Depending on the business’s plan and settings they can be sent by email, SMS, WhatsApp or push notification.

Separately, a business on a suitable plan can use RefinedOS to send marketing (offers and news) by SMS, WhatsApp or email, but only to customers who have agreed to receive marketing on that channel. A booking is never treated as agreement to marketing. RefinedOS records each customer’s choice for each channel with its source and date, honours STOP replies and unsubscribe links, and does not send marketing to anyone who has opted out. The business decides what to send and is responsible for having a lawful basis; RefinedOS sends it on the business’s behalf. A marketing opt-out never affects booking confirmations and reminders.

Customer indicators

To help a business run its diary, RefinedOS shows operational indicators next to customers, such as Regular and Needs attention. They are worked out from the customer’s actual appointment history with that business: for example completed bookings, late cancellations and missed appointments. They come from fixed counting rules applied to that history; there is no artificial-intelligence or hidden score involved, and no information from other businesses or outside RefinedOS is used. An owner or manager can also mark a customer as Regular by hand.

They are a prompt for the business, shown only to that business’s team. RefinedOS does not use them to make decisions with legal or similarly significant effects about anyone, and does not refuse bookings automatically because of them. The business remains responsible for how it uses them.

Who we share data with

We use the following providers to run RefinedOS. Some are only used when a business turns the relevant feature on. We do not list a provider unless RefinedOS actually uses it.

We may also share data where the law requires it, to protect people or our service from harm, or as part of a transfer of the service to a new operator (in which case this notice and your rights continue to apply).

International transfers

Some of our providers may process data, or allow access to it, outside the United Kingdom. Where that happens and the law requires it, we rely on appropriate safeguards for the transfer. Details depend on each provider’s own terms, and we will give more information on request.

How long we keep data

We keep personal data only for as long as it is needed for the purposes above.

• Business data is generally kept while the business uses RefinedOS, and for a limited period afterwards while its closure is handled.
• When a business removes a customer, the record is archived rather than permanently erased, and is erased on the business’s request.
• Some operational records, such as message delivery status and security logs, are kept for a limited time that is not yet enforced automatically. We are putting set limits in place.
• Billing records may be kept for as long as tax and accounting law requires, and security, backup and legal records may be kept for a further period. Deleted copies may remain in backups for a short time.
• A business can ask us to delete or return its data when it stops using the service (see the DPA). At present we do this manually.

We do not publish fixed retention periods yet. As limits are put in place we will state them here.

How we protect data

We use technical and organisational measures that include:

• separation of each business’s data, enforced in the database as well as in the application;
• role-based access controls for business users and restricted access for RefinedOS administrators;
• encrypted connections (HTTPS) between you and the service;
• password-protected accounts and managed authentication;
• verification of signed messages from payment and messaging providers;
• keeping provider credentials out of the application code;
• logging of administrative and security-relevant actions.

No online service can be guaranteed completely secure. If you think your account has been compromised, please tell us straight away.

Your rights

Under UK data protection law you can ask for:

• access to your personal data;
• correction of inaccurate data;
• erasure of your data in certain circumstances;
• restriction of how it is used;
• to object to certain uses, including those based on legitimate interests;
• a copy of data you provided in a portable format, where applicable;
• to withdraw consent at any time, where we rely on it.

If you are a customer of a business, please contact that business first because it controls your booking data. If you contact us, we will help, or pass the request to the business, and tell you we have done so.

Businesses can remove a customer from their customer list in the Customers area, which archives the record. Customers can cancel or change their own booking and leave a waitlist using the link in their messages, but there is no self-service export or erasure of personal data for customers or businesses, and no automated request tool at present: permanent erasure and exports are handled by us manually. Write to us using the contact details below, and tell us which business you booked with if it applies. We may need to verify who you are.

Cookies and device storage

RefinedOS uses only cookies and similar storage that are needed to keep you signed in and secure, or that remember a setting you chose in the dashboard. It does not use analytics or advertising cookies. The full list is in the Cookie and Device Storage Policy.

Children

RefinedOS is a business service and is not aimed at children. Businesses decide who they take bookings from.

Changes to this notice

We will update this notice when our processing changes, and show the date at the top. For significant changes we will tell business users in the service or by email.

Contact and complaints

For privacy questions or to make a request:

If you are unhappy with how your data has been handled, please contact us first so we can put it right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.