Privacy policy

1. Who we are and what this covers

Refrendo is operated by PAPACITO PTY LTD (ABN 44 669 345 500). In this policy, “we” and “us” mean that company, and “you” means whoever we are talking about at the time: the person with an account, or the person who has been sent something to sign.

This policy covers refrendo.com.au and the Refrendo application at app.refrendo.com.au. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and we hold ourselves to them whether or not the Act’s small business exemption happens to apply to us in a given year. It is easier to run one standard than two.

2. The two kinds of information we handle

This distinction runs through the whole policy, so we set it out first.

Information about our customers. The people who open accounts and send documents. We decide what we collect about them and why, and this policy is our account of it.
Content our customers put into Refrendo. The documents they upload and the details of the people they send them to. We hold this and act on it for the customer. We do not decide what is in a document, who it goes to, or why. The customer does, and the customer is responsible for having the right to give us those details in the first place.

If you were sent a document to sign and you want to know why someone has your email address, or you want your details changed or removed from a document, the person or organisation that sent it is who to ask. We will help you reach them, and we will act on their instruction, but it is not our document to change.

3. What we collect

To give you an account: your name, email address, and the organisation you say you belong to. If you set a password we store a cryptographic hash of it, never the password itself. If you use a passkey we store the public key. If you turn on two-step verification we store what is needed to check your codes.

When you send a document: the document and every version of it, the fields placed on it, and for each recipient the name and email address you provide.

When you open a request: that you agreed to use electronic records and signatures, the disclosure you were shown, and when. If the sender asked for an access code, we record that one was entered, never the code itself.

When you approve or sign: your signature and initials as you made them, whether typed, drawn or uploaded, along with your name and the date. This is stored as part of the completed document. If you sign in to Refrendo, you can choose to save a signature and initials to reuse.

When you witness a signature: your name and email address, whether you saw the signing in person or over a video call, and the declaration you made.

The audit trail. We record more here than you might expect, so it is set out in full. For every step of a request, including sending, opening, approving, signing, declining and downloading, we record who did it, when, the IP address it came from, the approximate location that IP address suggests, the browser and device, and the exact consent wording shown to that person in the language they saw it. Each record is linked to the one before it by a hash. The approximate location is looked up on our own server from a copy of GeoLite2 data; no address is sent anywhere to do it. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Billing: the plan you are on, your billing contact and your invoices. Card details are handled by our payment processor and never reach our systems.

Support: whatever you tell us when you email us, and our replies.

Automatically: ordinary server logs, which carry identifiers, addresses and timestamps. They do not carry document contents or signature images.

4. How we collect it

Mostly from you, directly, when you create an account, send a request or sign something. Some comes from other places:

From our customers, about you. If someone sends you a document, we received your name and email from them, not from you. That is the ordinary way a recipient’s details reach us.
From your identity provider. If you sign in with Microsoft, Google or your organisation’s single sign-on, we receive the details that provider releases to us, typically your name, email address and a stable identifier.
Automatically, as you use the service, for the audit trail and the logs described above.

5. Why we use it

To run the service: to move a document through the people who have to approve and sign it, and to produce the completed document and its certificate.
To prove what happened. The audit trail and the completion certificate exist so that the parties, and if it ever comes to it a court or a tribunal, can establish who signed what and when.
To keep accounts secure: sign-in, two-step verification, detecting abuse, and rate-limiting attempts to guess a signing link.
To email the people involved in a request, and to remind them if they have not acted.
To bill you, and to answer you when you contact support.
To meet our own legal obligations, including tax and record-keeping ones.
To measure and advertise Refrendo: to see how the website is used, to learn which of our ads lead someone to request an invite, and to show our ads to people who have visited the website. Only activity on the website is used for this, never anything inside the application or in your documents.

We do not sell personal information. We do not trade in it, we do not rent mailing lists, and we do not use the contents of your documents to train machine learning models.

With the other people on a request: everyone who approves, signs, reviews or receives a copy sees the document and, on the completion certificate, the names of the others on it. A witness sees only the pages they act on.

With the suppliers who help us run the service, each of whom gets only what they need. This is the complete list:

Amazon Web Services, which runs the server the application and its database run on, in Sydney.
Cloudflare, which hosts the website, serves the application, stores documents in encrypted form, and provides the Turnstile check on our forms. Cloudflare stores documents in its Oceania region, which is a preference rather than a guarantee that they never leave Australia.
Resend, which delivers our email, and therefore handles recipient names, email addresses and the text of the messages we send.
Stripe, which processes payments and holds the card details we never see. No card is taken during the closed beta, so until paid plans begin there is nothing for Stripe to hold.
Google (Analytics, Tag Manager and Ads), which tells us how the marketing website is used and which of our ads work, and shows our ads to people who have visited it. It runs on refrendo.com.au, not inside the application, so it never sees your documents or what you do there.
Sentry, which receives an error report when something breaks, so we can find out why. A report carries the page, the account identifier and technical details of the failure.

We will also disclose information where the law requires it: a subpoena, a warrant, a court order or a regulator’s lawful demand. Where we are allowed to tell you that it has happened, we will.

If the business is ever sold or merged, information may transfer with it. Any buyer would be bound to this policy for information collected under it, and we would tell you before anything moved.

7. Sending information overseas

Yes, some of it goes overseas, and you should know where.

The application’s server and database run in Sydney, with Amazon Web Services.

Cloudflare operates a global network and serves the site from whichever location is closest to the person using it, so requests are processed in many countries. Resend, Stripe, Google and Sentry are all based in the United States, so information passing through them is handled there.

Before disclosing personal information to an overseas recipient we take reasonable steps to ensure they handle it in a way consistent with the Australian Privacy Principles, as APP 8 requires, and our agreements with them are written to that standard. We cannot promise that the law of another country will never allow its government access to information held there.

8. How we protect it

Traffic runs over TLS. Every stored file (documents, signatures, completed documents and certificates) is encrypted by Refrendo with its own key, locked by a key belonging to the organisation it came from, before it reaches storage, so the storage provider only ever holds scrambled data. Files sit in private storage, reachable only through links that expire within minutes, and nothing is publicly addressable. Every uploaded file is checked for malware before it is accepted. Each signer’s link is high-entropy, stored only as a hash, expires, stops working when a request is retracted or revised, and is rate-limited against guessing. Every read is checked on the server against the signed-in person’s organisation. Document versions and the audit trail cannot be edited or deleted, by us or by anyone else. Our application logs carry identifiers only, never document contents or signature images. There is more detail on our security page.

We describe our audit trail as tamper-evident rather than tamper-proof, and we will not tell you a system is unbreakable. No system is. What we can tell you is that a change made after the fact is detectable, which is the property that matters when a signature is questioned.

9. How long we keep it

Completed documents and their certificates are kept for at least the retention period of the plan the sender was on, which is set out on our pricing page. Everyone who signs is emailed a link to download the completed document and, unless the sender turned it off, its certificate when the last signature is in, so your own copy is yours to keep regardless of what happens to anyone’s account or plan.

Two limits on deletion:

The audit trail is append-only by design. It is the evidence that the signing happened properly, and a record that could be edited afterwards would be worth nothing. We cannot selectively rewrite it, and we would not, because that is the feature.
A completed document belongs to everyone who signed it, not only to the person who sent it. So closing your account does not remove documents you have signed from the records of the other parties to them.

Beyond that we destroy or de-identify personal information when we no longer need it for a purpose set out in this policy and no law requires us to keep it.

10. Accessing, correcting and deleting

You can ask us for the personal information we hold about you, and ask us to correct it if it is wrong. Most of it you can get yourself: Profile → Your data → Download my data gives you your details, your email addresses, your workspaces and the list of your documents, and each document and certificate can be downloaded from My documents. Delete my account removes your sign-in, your email addresses and your memberships, and retracts requests still waiting in workspaces only you belong to.

Otherwise, email support@refrendo.com.au. We will ask enough to be satisfied you are who you say you are, then respond within 30 days. There is no charge. If we refuse access or a correction, we will tell you why in writing and how to challenge it.

If the information is inside a document someone else sent, see section 2: ask the sender, and we will act on their instruction.

11. Cookies and measurement

The application sets cookies that are necessary for it to work, principally to keep you signed in and to protect against cross-site request forgery. You cannot turn these off and still have a working service.

On the marketing website we use Cloudflare Turnstile on our forms, which is a privacy-preserving alternative to a CAPTCHA and does not track you across other sites.

We also load Google Analytics and Google Ads on the marketing website, through Google Tag Manager. They set cookies that give your browser a random identifier:

Analytics uses it to tell a returning visit from a new one and to see which pages people read.
Ads uses it to tell us when someone who clicked one of our ads goes on to request an invite, and to show our ads to people who have visited the website while they use Google’s services and other sites that carry Google ads. That is called remarketing.

Google handles what these cookies collect under its own privacy policy. You can turn off personalised ads from Google at myadcenter.google.com, and block or clear cookies in your browser; the website works the same without them. If you visit from the European Economic Area, the United Kingdom or Switzerland, Google’s tags run without analytics or advertising cookies.

We do not connect what you do on the website with what you do inside the application, and neither Analytics nor Ads runs inside the application at all.

12. Data breaches

If personal information we hold is lost, or accessed or disclosed without authorisation, and it is likely to result in serious harm, we will investigate promptly, notify the affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires, and tell you what happened and what to do about it. We will not wait for certainty before we start telling people, and we will not describe a breach as something else.

13. Making a complaint

Email support@refrendo.com.au with what happened. We will acknowledge you within 5 business days and give you a written answer within 30 days, including what we found and what we are doing about it.

If you are not satisfied with our answer, you can take it to the Office of the Australian Information Commissioner, which is free: oaic.gov.au, 1300 363 992, or GPO Box 5288, Sydney NSW 2001. You do not need our permission and you do not have to come to us first, although it is usually quicker if you do.

14. Changes to this policy

When we change this policy we will change the date at the top. If a change materially affects how we handle your personal information, we will tell you by email before it takes effect.

15. Contact us

Privacy questions, access requests and complaints: support@refrendo.com.au. We are PAPACITO PTY LTD (ABN 44 669 345 500).