InRef privacy notice

Who is responsible for your information

Arcurial Studios Ltd is the controller for personal information used to provide InRef, its website, accounts and related services. Contact Admin@Arcurial.com for privacy questions or requests to access, correct, export or delete your information. Arcurial.com is our parent-company domain; this notice is published on the InRef website.

This notice describes the account and online-service processing we control. If an organisation uses InRef to process information about other people in its own content, that organisation is responsible for explaining its use of that information.

Information we use and where it comes from

When you register or sign in, we receive account identifiers, your email address and verification status, display/profile information, authentication and session records, and any invitation or team membership information. Our identity service handles passwords and enrolled authentication factors. If you choose Google or Microsoft sign-in, that provider supplies the identity and profile information authorised through its sign-in screen; it does not give InRef your provider password.

We record licence and device identifiers, device names you provide, entitlements, purchases, asset ownership, test-credit activity, and the version and time of agreement acceptance. A payment provider may send us payment status and transaction references when you place a paid order. InRef does not need your full payment-card number; payment details are entered with the checkout provider.

We process the content and messages you deliberately submit to hosted collaboration, community or support services, including issue descriptions and diagnostics you choose to share. Service records can include network addresses, request times, errors and actions needed to operate and protect accounts. Local boards are not uploaded merely because you sign in; using a hosted or sharing feature can transmit the content required by that feature.

Why we use it

We use account, licence, membership and transaction information to provide the service you request and administer our agreement with you. We use submitted support information to investigate and answer your request. These activities rely on performance of a contract or steps you ask us to take before a contract.

We also use limited service and authentication records for our legitimate interests in preventing misuse, diagnosing faults, maintaining reliable services and defending legal claims. We balance these interests against your rights and minimise the information involved. Records needed for applicable tax, accounting or other legal obligations are retained on that basis.

Accepting an agreement is not consent to unrelated marketing. Optional choices, such as remembering an email on your device or selecting an external sign-in provider, do not give us permission to use your data for unrelated purposes. We do not sell account information.

Who can receive information

Access is limited to authorised people and service providers who need it for the purposes above. InRef account, identity, website and community services are operated on infrastructure managed for Arcurial Studios Ltd. Keycloak is the identity software used by our service; using it does not itself send your account to an external Keycloak account provider.

Email delivery involves the mail systems handling the sender and recipient addresses. If you choose external sign-in, Google or Microsoft processes that sign-in under its own notice. If you use a direct website checkout, Paddle processes payment and purchase information under the notice shown at checkout. We share the minimum service identifiers needed to connect that checkout to your InRef account. If you buy InRef through Microsoft Store, Microsoft processes the purchase under its own terms and privacy statement. The desktop requests the app licence status from Windows to enable or restore the included desktop tools. This check does not require an InRef account and does not send your Microsoft payment details or Microsoft account credentials to InRef account services.

If you choose Create AI variation, InRef sends the selected reference image and your prompt to OpenAI using the API key you provide. OpenAI processes that request under its own terms and privacy policy and bills the account associated with the key. If you choose Remember securely on this PC, InRef stores the key in Windows Credential Manager; it is not included in board files.

Accepted team membership makes the membership and profile information needed to manage that team available to its owner. Information you deliberately publish or share is visible to the audience selected for that feature. We may disclose information where required by law or where necessary and proportionate to protect rights and investigate serious misuse.

External providers may process information in other countries. Where we arrange a restricted international transfer, we use an applicable adequacy decision or appropriate contractual safeguards. Contact us for information about the providers and transfer arrangements relevant to your account. The provider's own privacy information also explains processing it controls independently.

How long we keep information

We keep an active account's profile and service records for as long as needed to provide that account and its purchased rights. When an account is closed, we remove or anonymise operational profile information and stop account access. Some purchase, licence, agreement and audit records must remain to establish existing rights, meet legal obligations or handle disputes; access to retained records is restricted.

Retention depends on the purpose, whether a request or dispute remains open, the period for which a purchased right must be evidenced and applicable legal record-keeping requirements. We review support and diagnostic information when the issue no longer needs it and remove unnecessary personal detail. Ask us for the retention criteria and records applicable to your account.

Recovery copies are held separately from active account records and removed under the applicable backup retention schedule. A deletion request may therefore take longer to disappear from recovery copies. If a backup is restored, account closures and restrictions must be reapplied before normal service resumes. Uninstalling InRef does not close your online account.

Cookies and information on your device

The website uses essential session and sign-in cookies to authenticate requests and protect your account. The desktop stores sign-in credentials using operating-system protection and can remember an email if you choose that option. You can sign out and clear remembered account details in the app. Clearing a local session does not erase server records or cancel purchased rights.

Your browser and operating system may retain their own history, backups or authentication information. Those controls are separate from InRef's own remember and clear settings.

Optional website measurement

When enabled, the public website counts page views, visits to the download page through a link, installer-link clicks and starter-board download clicks in daily totals. Each total contains a public page path, event type and broad source category such as Google, Bing, referral or direct. The measurement endpoint does not store visitor identifiers, account details, network addresses, full referring URLs, search terms or query strings, and the measurement script sets no cookies or browser-storage identifiers.

The script respects browser Do Not Track and Global Privacy Control signals. Totals older than 90 days are removed when the next event is recorded. Counts describe events, not unique people, completed installations, first launches or purchases. Normal operational request records described elsewhere in this notice remain separate.

Your rights and how to contact us

Depending on applicable law, you may request access to, correction or deletion of your personal information, restriction of processing, or a portable copy. You may object to processing based on legitimate interests, including direct marketing if it is ever offered. Where we rely on consent, you can withdraw it without affecting processing that was lawful before withdrawal.

Email Admin@Arcurial.com with your request. We may need proportionate information to verify that the request concerns your account, and we will explain any lawful limitation or retention requirement. Do not send passwords, authentication codes or payment-card details. You may complain to the UK Information Commissioner's Office at ico.org.uk, or to the relevant data-protection authority where applicable.

InRef is a general-purpose creative and reference tool and is not restricted to adults aged 18 or over as a whole. Store age ratings and parental controls apply to the version distributed through that store. The current hosted-service alpha remains invitation-only. Account creation and optional external services are subject to applicable legal eligibility requirements and any parental or guardian permission required by law. Contact us if you have a concern about a child's personal information so we can review and address it under applicable law. We do not use account information to make solely automated decisions with legal or similarly significant effects on you. We update this notice when our processing changes and identify the current version on this page.