Privacy Policy

refactorlabs.net is operated by REFACTOR LABS LTD (company number 17470752), 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We are the data controller for the information described here, under UK GDPR and the Data Protection Act 2018.

For any privacy question, or to exercise any right described below, email [email protected].

We only collect what we need to run a course for you. That is a short list.

• Enrolment details — your name, email address, phone number and, if you choose to give them, your company, role and country.
• What you tell us about your background — the free text you write about your experience and goals, and your preferred call time. This exists so your mentor can prepare.
• Course activity — work you submit for review and notes your mentor keeps about your progress.
• Correspondence — emails and messages you exchange with us or your mentor.

We do not collect card numbers. Payments are handled by a third-party payment provider that processes them directly.

• To respond to your enrolment request and arrange the introductory call.
• To plan your track at the right level and schedule your sessions.
• To deliver the course, review your work and answer your questions.
• To take payment and keep the accounting records the law requires.
• To send you service messages about your course. We do not send marketing email unless you ask us to.

Where the UK GDPR or EU GDPR applies to you, we rely on the following bases:

• Contract — to deliver a course you have enrolled in, and to take the steps you asked for before that contract exists.
• Legitimate interests — to keep the service secure, prevent abuse, and improve our courses. We balance this against your interests and use aggregated data where we can.
• Legal obligation — to keep tax and accounting records.
• Consent — for anything optional, such as being quoted in a testimonial. You can withdraw consent at any time.

This site does not set advertising cookies and does not use cross-site tracking. We store one thing in your browser: your light or dark theme preference, kept in local storage on your own device so the site does not flash the wrong colours on your next visit. It never leaves your browser.

Our hosting provider keeps standard server logs, including IP addresses and request times, for security and debugging. These are retained for a short period and are not used to build a profile of you.

We do not sell your data, and we do not share it for advertising. We do share the minimum necessary with:

• Your mentor — your name, background and goals, so they can teach you properly.
• Our payment provider — to take payment and issue refunds.
• Our email and video-call providers — to contact you and hold sessions.
• Authorities — only where we are legally required to, and we will tell you unless we are prohibited from doing so.

Some of these providers operate in the United States. Where data leaves the UK or EEA, we rely on standard contractual clauses or an equivalent safeguard.

• Enrolment requests that do not become courses — 12 months, then deleted.
• Student records — for the duration of your course and three years afterwards, so we can support you and honour lifetime access.
• Financial records — seven years, as required by tax law.
• Correspondence — three years from the last message.

Depending on where you live, you have some or all of the following rights over your data: to access a copy of it, to correct it, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format.

If you are in California, you also have the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined by the CCPA.

To exercise any right, email [email protected]. We will respond within 30 days. If you are unhappy with our response, you may complain to the Information Commissioner's Office (ICO) or your local data protection authority.

The site is served over HTTPS, access to student records is limited to the people who need it, and we review that access periodically. No system is perfectly secure — if a breach ever affects your data, we will notify you and the relevant authority within the timeframes the law requires.

This service is not intended for anyone under 16. If you believe a child under 16 has given us personal data, email us and we will delete it.

If we change how we handle your data in a way that matters, we will email current students before the change takes effect and update the date at the top of this page. Related documents: Terms & Conditions and Refund Policy.