Privacy Policy

Effective date: March 21, 2026
Last updated: October 21, 2026

This Privacy Policy describes how Refract Logic LLC ("Refract Logic", "we", "our", or "us"), the developer and operator of REFRACT Platform, handles data in connection with your use of REFRACT Platform, including REFRACT PDF, REFRACT eSign, REFRACT Delivery, REFRACT Workflow, REFRACT Audit, and REFRACT Lifecycle.

REFRACT operates two kinds of infrastructure: components that run inside your own Microsoft Azure subscription, and REFRACT Shared Services, which Refract Logic operates. In this policy, REFRACT Shared Services refers collectively to licence validation and usage reporting, the signer and recipient portal, and the notification service.

REFRACT PDF, REFRACT Audit, REFRACT Lifecycle, and the dispatcher and processor that REFRACT eSign, REFRACT Delivery, and REFRACT Workflow run on, are components that run inside your own Azure subscription. They hold your documents, templates, and audit records, and Refract Logic has no access to them. REFRACT Shared Services holds none of your document content; REFRACT eSign, REFRACT Delivery, and REFRACT Workflow use it when a document is sent to a signer or recipient, or when an invitation or verification message is sent, described in Section 4a.

Please read this policy carefully. By installing and using REFRACT Platform you acknowledge the practices described below.

---

1. Tenant-Hosted Architecture

REFRACT PDF, REFRACT Audit, and REFRACT Lifecycle run entirely on the customer side. REFRACT PDF's document generation is deployed and operates entirely within your organisation's Microsoft Azure tenant, and all document generation and data processing occur inside your secure Azure environment.

This means:

• Document templates are stored in a SharePoint document library that you own and administer.
• Generated PDF outputs are written back to SharePoint folders designated by your administrator.
• All orchestration and rendering logic runs in compute resources inside your Azure subscription.

A render request that carries its own template (direct mode) is rendered without reading SharePoint. Every other render reads its template from a SharePoint library you own. The rest of this policy describes a deployment configured with SharePoint.

Because you control the underlying infrastructure, your organisation's own data-governance policies, retention rules, and access controls apply to all document content.

REFRACT Audit's evidence packages, hash chains, and audit trail are likewise generated and stored entirely in your Azure subscription, the same as REFRACT PDF. REFRACT Lifecycle is a SharePoint web part and command set that runs entirely within your own SharePoint environment; it authenticates with your own Microsoft Entra tenant and calls only your own dispatcher. Neither REFRACT Audit nor REFRACT Lifecycle sends anything to REFRACT Shared Services beyond the licence validation and usage-reporting calls described in Section 3.

---

2. Information We Do Not Collect

For REFRACT PDF rendering, REFRACT Audit, and REFRACT Lifecycle, all of which run on the customer side, we do not collect, process, or have access to:

• The content of any documents you generate.
• The JSON data payloads you submit for rendering.
• Employee, customer, or any other personally identifiable information (PII) contained in your documents.
• Files or metadata stored in your SharePoint environment.

REFRACT eSign, REFRACT Delivery, and REFRACT Workflow are different where they use REFRACT Shared Services: its signer and recipient portal and its notification service do briefly receive and hold personal data, specifically signer and recipient contact details and session and verification data. What is received and how long it is held is described in Section 4a.

---

3. Licence Validation and Usage Reporting

Licence validation and usage reporting are one of the three parts of REFRACT Shared Services. To maintain a valid licence, REFRACT Platform performs a lightweight check with our secure licensing server approximately once every 24 hours. Usage reporting runs only when your deployment is configured for it. A deployment installed with the standard templates is not configured for it and sends no usage reports.

This metadata is used exclusively to:

1. Confirm your licence is active and has not been revoked.
2. Enforce any seat, volume, or feature entitlements associated with your licence tier.
3. Track usage of metered features (REFRACT eSign and REFRACT Delivery) for billing and entitlement purposes.

A daily retention run deletes a licence's records 90 days after the licence has ended (when every one of its entries has passed its end date), together with the trial reminders, suspension notices, and usage alerts sent for it. Monthly usage counts are kept for billing for 7 years (2,555 days) after the licence ended, with a record of the end date and billing terms but no contact details. A licence that is switched off or suspended, or has no end date, has not ended and is not deleted. The daily deletion run currently only counts what it would delete; deletion is switched on after that count has been reviewed, and until then these records are kept. The licensing service also keeps the account details listed in Section 6. None of it is sold, rented, or shared with third parties.

---

4. SharePoint Integration

REFRACT PDF uses a Managed Identity (a credential-free Azure authentication mechanism) to interact with your SharePoint environment on behalf of your tenant.

The scope of this access is limited to:

• Reading template files from SharePoint folders configured by your administrator.
• Writing generated PDF outputs to SharePoint output folders configured by your administrator.

No SharePoint content is transmitted outside your tenant during rendering: the application reads templates from, and writes generated PDFs to, only the SharePoint folders your administrator configures, using a Managed Identity that authenticates within your own tenant. Access is governed by the least-privilege permissions granted during the installation and setup process, which your administrator controls.

If a rendered document is later distributed through REFRACT Delivery or REFRACT Workflow, or signed through REFRACT eSign, its interaction with REFRACT Shared Services is described in Section 4a, not this section.

---

4a. Inside REFRACT Shared Services

REFRACT Shared Services has three parts: licence validation and usage reporting, described in Section 3 above; a signer and recipient portal; and a notification service. This section covers the portal and the notification service.

REFRACT eSign, REFRACT Delivery and REFRACT Workflow generate, seal, and store your documents and audit trails inside your own environment, the same as REFRACT PDF: your Azure subscription and your SharePoint libraries. They use REFRACT Shared Services' portal and notification service when a document is sent to a signer or recipient, or when an invitation or verification message is sent.

The signer and recipient portal. When a REFRACT eSign signer, or a REFRACT Delivery or REFRACT Workflow recipient, opens a link you send them, they land on the portal. The portal:

• For REFRACT eSign, holds each signer's contact details, session state, and verification data (such as a one-time code). Signing session data for completed, declined or partially signed requests is retained for at least 7 days after the request finishes, or until its signing deadline if that is later, and then deleted automatically. Requests the sender cancelled are kept until their original signing deadline plus about 1 hour. Unsigned requests that expire are deleted after their deadline; the cleanup runs once a day, so this happens within about a day of expiry.
• Keeps some records longer than that. A signing request whose signature was still being submitted at its deadline is kept until your deployment reconciles it. A cross-device transfer link that is never used is not removed (it holds identifiers, not contact details). When an eSign email cannot be handed to your deployment straight away, the portal holds it, encrypted, to retry; after 24 hours only its identifiers and outcome are kept, retries continue only while your deployment contacts the portal, and some of these records have no scheduled deletion. All of the portal's deletion runs in a daily cleanup started by REFRACT eSign deployments; it does not run on its own.
• For REFRACT Delivery and REFRACT Workflow, stores nothing about the recipient: it passes each request to your deployment, and a workflow form in progress is kept only in the recipient's browser tab.
• Keeps operational logs for 90 days. They include the recipient's email address for each eSign email sent through the notification service, and Azure's web request records, which include the requesting IP address and the link opened.
• For document previews and downloads, across REFRACT eSign, REFRACT Delivery, and REFRACT Workflow alike: redirects the signer or recipient directly to your own deployment. The portal does not receive or forward the document's bytes.
• Gates Delivery and Workflow downloads, like eSign downloads, on one-time-code verification where your configuration requires it.
• For REFRACT eSign: when a signer submits their signature, the signature image and any field values they entered pass through the portal on their way to your deployment, where the document is actually sealed. The portal does not store the signature image or the field values.
• For REFRACT Workflow: an attachment a participant uploads passes through the portal in memory on its way to your deployment, and is never written to our storage.

The notification service. Invitation and verification messages, such as a signing invitation or a one-time verification code, are sent through the notification service, which receives the recipient's contact details and the content of the message being sent. Messages never contain the document itself; they carry a secure link to it, and the document is served from inside your own environment, your Azure subscription or your SharePoint libraries, when the recipient opens it. The notification service keeps:

• Each message in its queue until it is sent. A message that still cannot be sent after its retries, or within 14 days, moves to a dead-letter queue with the recipient's address and the full message. It is removed from there 7 days after it was first recorded, once any batch delivery result for it has been filed; only a record of its identifiers, type, reason code, and times is kept.
• A duplicate-check record for each message (no address) for 24 hours.
• A delivery record for each message: identifiers, status, an error code (not the email service's error text), and a keyed (HMAC-SHA256) hash of the recipient's address, whose key is held in REFRACT Shared Services' Key Vault. A daily run deletes these records 90 days after they were written. The daily deletion run currently only counts what it would delete; deletion is switched on after that count has been reviewed, and until then these records are kept. Records written before 12 October 2026 can instead hold an unkeyed SHA-256 hash of the address, which can be matched against a known address, and the email service's error text, which can include the address.
• Batch delivery results held by REFRACT's notification service contain record identifiers, the outcome (sent or failed), the failure stage and error code, timestamps, your licence key, and a keyed hash of the recipient address (no email addresses or document content). They are deleted when your deployment collects them, or after 30 days if they are never collected.
• Operational logs for 30 days. Since 12 October 2026 they do not record recipient addresses, names, or phone numbers; error text that might quote an address is masked. Earlier lines that do record them are removed as they pass 30 days.

---

5. Security Standards

5.1 Licensing API Communication

Communication between REFRACT PDF and our licensing API uses a JSON Web Signature (JWS) token, signed with ES256 (ECDSA on the P-256 curve). This ensures:

• Integrity: the payload cannot be tampered with in transit without invalidating the signature.
• Non-repudiation: each token is signed with a private key held only by the licensing API, and independently verified against the corresponding public key.

Confidentiality of the request and response is provided by HTTPS/TLS on the connection itself, not by the token. The token is signed, not encrypted.

5.2 Azure Infrastructure Security

Because REFRACT PDF runs inside your Azure tenant, it inherits the security controls you have already configured, including:

• Azure Role-Based Access Control (RBAC).
• Virtual Network (VNet) integration and private endpoints (if configured).
• Microsoft Defender for Cloud recommendations applicable to your subscription.
• Your organisation's existing conditional access and identity protection policies.

---

6. Data Retention

We do not impose a retention schedule on data held in your tenant. Retention of data held on our servers follows our internal data-management policy, which is available upon request.

---

7. Third-Party Services

REFRACT Platform does not share your data with third-party advertising, analytics, or marketing services.

For a deployment using REFRACT PDF rendering only, the application makes licence validation calls to REFRACT Shared Services, and usage-reporting calls only when usage reporting is configured, as described in Section 3.

For a deployment that also uses REFRACT eSign, REFRACT Delivery, or REFRACT Workflow, the platform additionally makes calls to REFRACT Shared Services' portal and notification service, described in Section 4a.

REFRACT Audit and REFRACT Lifecycle do not add any further external call beyond those described in Section 3.

---

8. Your Rights

Depending on your jurisdiction, you may have rights in relation to personal data we hold.

Where you use REFRACT PDF rendering only, Refract Logic holds the licence metadata described in Section 3 (Licence Key, Tenant ID, deployment hostname, and usage counts; an identity token is checked but not stored) and the licence account details listed in Section 6, which include contact names, email addresses, and phone numbers. Data-subject rights requests can apply to those details.

Where you use REFRACT eSign, REFRACT Delivery, or REFRACT Workflow, REFRACT Shared Services additionally holds signer and recipient contact details and related session and message data as described in Section 4a, for the periods in Section 6. Data-subject rights requests can apply to that data.

Using REFRACT Audit or REFRACT Lifecycle does not, by itself, add to what Refract Logic holds beyond what this section describes.

If you believe we hold personal data about you, or if you have any privacy-related questions, please contact us at the address below.

---

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, notify licence administrators via email or in-app notice. Continued use of REFRACT Platform after changes are published constitutes acceptance of the revised policy.

---

10. Contact

If you have questions or concerns about this Privacy Policy, please contact:

Refract Logic LLC
https://refractlogic.com/contact

---