Privacy Policy

Refill is for adults 18 and older. It isn't directed to children, and we don't knowingly collect personal information from anyone under 18, including children under 13. If we learn that someone under 18 has an account, we'll close it and delete its information. If you believe a minor is using Refill, email us. AI companions may not be suitable for some minors.

Refill is offered only in the United States, Canada (outside Quebec) and Australia, and access is gated by approximate location.

Account information. When you sign up, we authenticate you with email and password, or with Google sign-in. We receive your email address (and, with Google, a basic profile such as your name). We also record the confirmations you give at sign-up (that you understand the coworkers are AI, that you're 18 or older and live where Refill is offered, and that you agree to the Terms), the version of the Terms and when you gave them.

Billing information. If you subscribe to a plan, Stripe collects your payment card and billing address to take payments. We receive your plan, its status and billing dates, never your full card number. We also keep a record of your agreement to your plan's key terms: when you agreed, the plan and price, and the wording you were shown.

Content you create. The coworkers (personas) you invent, their personality settings, and your chat messages, both in the office group chat and in 1:1 chats.

Memory notes. After a conversation has gone quiet for a few minutes, our AI provider writes short notes on what your coworkers should remember about you and your office, such as a project or a person you mentioned. The notes can include anything you chose to say in chat.

Information about other people. Refill lets you base coworkers on people you know. Anything you type about someone else, such as a name, a habit or something they said, is stored and used like the rest of your content, only to run your game. Please use first names or nicknames, and leave out contact details and anything sensitive about a real person. If you think Refill holds information about you that a player entered, email us and we'll help.

Sensitive topics. You don't have to tell Refill anything sensitive to play. If you choose to talk about your health, your feelings or other sensitive subjects, that text is stored in your chats and may appear in memory notes. We use it only to run your game and to keep you safe, and you can delete it by deleting your account. Our Consumer Health Data Privacy Policy explains how we handle information about your health.

Share cards. If you share a moment, we create a public page and image at a link. It shows the coworker's name and the quoted line. Anyone with the link can see it, and apps you paste it into may show a preview. Deleting your account deletes your share cards; to take one down sooner, email us.

Reports and safety checks. If you report a message, we record the report. Automated safety checks review the messages you send, the persona details you write and every coworker reply (see Safety checks).

Usage and device data. Basic product analytics (pages and actions, via PostHog), tied to your account's random ID rather than your name or email; error and performance diagnostics (via Sentry); and your IP address and approximate location, which we use for the regional access gate and to limit abuse. When you sign up, sign in, reset your password or start playing as a guest, Cloudflare Turnstile checks that you're a person rather than a bot, using signals from your browser and device. We also store your time zone so the morning message arrives at the right hour and your daily message limit resets at your midnight, and, if you turn on notifications, your browser's push subscription.

Messages to us. If you email us, we keep the message and our reply.

Guest play. Where you can play before creating an account, your office is tied to an anonymous session stored in a cookie until you sign up to keep it. Guest sessions that never built an office are deleted after 30 days.

• To provide the Service: create your AI coworkers, generate their replies, keep memory notes so they remember you, send the morning message and overnight story, and run your plan and daily message limit.
• To keep people safe and the Service working: screen content with automated safety checks, act on reports, prevent abuse and fraud, enforce regional availability and our Terms, and fix errors.
• To understand and improve Refill: measure which features people use, with analytics tied to a random ID.
• To contact you: the morning message (by email or push; turn it off in Settings → Notifications or with the unsubscribe link in any morning email), and account, safety and billing emails (your trial's start and end, receipts, plan changes), which we send even when the morning message is off.
• To meet legal obligations: keep billing records, respond to lawful requests and protect our rights.

What we don't do. We don't sell your personal information or share it for targeted advertising, and we don't show ads. We don't use your chats, personas or memory notes to train AI models, and our AI provider doesn't either. If we ever want to, we'll ask you first, and we won't include anything you shared before you agreed. We don't use AI to make decisions about you that have legal or similarly significant effects, such as credit, hiring, pricing or eligibility decisions. The automated processing is limited to running the game: generating replies and memory notes, and the safety checks.

Who can see your chats. Your chats are private to your account, and other players can't see them. Authorized SAPIENSQ staff can access them only when needed to investigate a report, a safety, security or abuse problem, or a technical problem you've asked us to fix, or when the law requires it.

To generate your coworkers and their messages, we send the persona descriptions you write, your chat messages and the memory notes to our AI provider, OpenAI. OpenAI writes your coworkers' replies, updates their memory notes, writes the overnight story and morning messages, and runs the safety checks on your messages, your persona details and every reply. Under OpenAI's API terms, it doesn't use this data to train its models. It may keep the data for up to 30 days to detect and prevent abuse and then deletes it, unless the law requires it to keep it longer. We send only what's needed to generate the experience.

To keep people safe, we automatically check the messages you send for signs of suicide or self-harm, using OpenAI's moderation service. When a check finds such signs, a second automated check scores the message against a standard suicide-risk screener, we show you crisis resources, and we pause your coworkers' morning messages for 7 days; we note the date on your account so the pause works, and that note is deleted with your account. Separately, we count each time crisis resources are shown, with the date, your approximate country and the screener's risk level, but not your message or anything that identifies you, so we can publish and report the yearly total that state laws, including California's and Washington's, require. See our Crisis and safety protocol.

We don't sell your personal information or share it for targeted advertising. We share it only:

• With service providers that help us run Refill, under contracts that limit them to providing their service to us: OpenAI (United States), AI generation and safety checks; Supabase (United States), sign-in and database hosting; Vercel (United States, with a global delivery network), hosting; Cloudflare (global network), bot protection at sign-up and sign-in; Resend (United States), email delivery; Stripe (United States), payments and subscriptions; PostHog (United States), product analytics; Sentry (United States), error and performance monitoring; Google (United States), sign-in with Google; and the push service run by your browser's maker (such as Google, Apple, Mozilla or Microsoft), which delivers notifications whose content is encrypted so that only your device can read it.
• With Stripe and Google as independent companies. When you pay or sign in with them, they also handle your information under their own privacy policies.
• Publicly, when you choose to. A share card is visible to anyone with its link.
• For legal reasons. To comply with a valid legal request or other legal obligation, or when we believe in good faith that disclosure is needed to prevent harm to someone or to protect our rights, our users or the Service.
• In a business transfer: with a buyer or successor if SAPIENSQ is involved in a merger, acquisition or sale of assets. They must keep honoring this policy for the information they receive, and we'll tell you before your information becomes subject to a different policy.

We use a few cookies and similar browser storage:

• Sign-in cookies from Supabase that keep you logged in, and a short-lived cookie that carries your sign-up confirmations through Google sign-in. They're needed for Refill to work.
• Analytics: PostHog stores a random ID in a cookie and in local storage to measure how Refill is used.
• Bot protection: Cloudflare Turnstile reads browser and device signals when you sign up or sign in.

We don't use advertising cookies or ad pixels, and we don't allow ad networks or other third parties to collect information about your activity across other websites through Refill.

Do Not Track. Some browsers send a “Do Not Track” or Global Privacy Control signal. There's no agreed standard for Do Not Track, so Refill doesn't change what it does when it receives one. Refill doesn't track you across other websites and doesn't sell or share your personal information for advertising, so there is no such tracking for these signals to turn off.

• Your account and game: kept while your account is open, including after a plan ends, so your office is there if you come back.
• When you delete your account (Settings → Account → Delete my account): we wait 7 days so you can change your mind, then permanently delete your account, offices, coworkers, chats, memory notes, share cards and notification settings. Asking to delete your account also cancels your plan.
• Plan agreements: the record of your agreement to a plan's key terms, for as long as the plan runs and four years after it ends, even if you delete your account sooner, because the law requires us to be able to show it.
• Deletion record: a record that a deletion took place, which can't be linked back to you, for 30 days.
• Data exports: the download link expires after 7 days.
• Guest sessions that never built an office: deleted after 30 days.
• Backups: deleted data is removed from our database provider's backups within 30 days.
• Diagnostics and analytics: error reports are kept for up to 90 days, and analytics events for up to 7 years. Both are tied to a random ID, not your name or email.
• AI provider: up to 30 days (see AI processing).
• Payments: Stripe keeps payment records for as long as tax and financial laws require, under its own privacy policy, even after your account is deleted.

We may keep specific information longer when the law requires it or to resolve a dispute. When a retention period ends, we delete the information or make it anonymous.

Wherever you live, you can:

• access and download your data (Settings → Your data; we email you a download link);
• correct it (edit your coworkers in the app, or email us about anything else);
• delete it (Settings → Account); and
• object to or ask us to limit a use of your information, or withdraw a consent you gave, by emailing us.

We respond within 30 days, or sooner where your local law requires it, and we won't treat you differently for using these rights. We may need to confirm that you own the account before we act. If you're not satisfied with our answer, you can complain to your local privacy regulator (see Information for your country).

We encrypt your data in transit and at rest, scope every database query to your account so players can't see each other's offices, and limit access to production systems to the people who need it. No method of storage or transmission is perfectly secure. If a security incident affects your information, we'll notify you and the authorities as the law requires.

SAPIENSQ is based in the United States. Your information is stored and processed in the United States by us and by the providers listed above. Some of them, like Cloudflare and Vercel, also route traffic through servers near you. The United States may not have data-protection laws equivalent to those where you live, and information held there can be accessed by US courts, law enforcement and national-security authorities under US law. We transfer your information to these providers because it's necessary to provide the Service you signed up for, and each is bound by a contract that requires it to protect the information and use it only to provide its service to us.

United States. You can use the rights above wherever you live. We don't sell personal information, including covered information as Nevada law defines it, and we don't share it with third parties for their own direct marketing. If you live in Washington or Nevada, our Consumer Health Data Privacy Policy describes your rights over information about your health.

Canada. We handle your information under the Personal Information Protection and Electronic Documents Act (PIPEDA). You can ask for access to your information and for corrections, and withdraw your consent to a use of it, subject to legal and contractual limits (withdrawing consent to the processing the game needs means closing your account). If you're not satisfied with how we handle a request or complaint, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Australia. We handle your information under the Australian Privacy Principles. As described above, we disclose it to providers in the United States and to global delivery networks. If you have a complaint, email us first; we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

We may update this policy as Refill evolves. If we make a material change, especially to how we use or share information we already hold, we'll tell you by email or in the app before it takes effect, and we'll ask for your consent where the law requires it. We won't use information we collected under an earlier version of this policy in a materially different way without your consent. The date at the top shows when this policy last changed.

Questions or requests about your privacy? Email refill.work@sapiensq.com.

SAPIENSQ, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA, is responsible for your personal information. Our Privacy Lead is accountable for how we handle it and can be reached at the same email and address.