Privacy Policy
Key points
- We do not train AI models on your content, and we do not sell it.
- Your security level decides where your content may go. Guests, and accounts that have not chosen a level, use “All models”. Under that level, your prompts and files may be sent to Google (free Gemini API) and Meta (Muse Spark contributor tier). Those companies may use the content to train their models, and their staff may review it. Do not use “All models” for confidential documents. Choose “No training” or “Zero retention” in your account instead.
- To do the work you ask for, your content is sent to the AI, translation and document-conversion providers that the task needs. Section 4 names them.
- Your content is deleted automatically after the retention period you choose. If you have not chosen one, the default is 90 days of inactivity for guests and free accounts and 3 years for paying accounts.
- Our staff look at your content only in the situations listed in Section 5, for example when you report a problem with a result.
- Our servers and main database are in Singapore. Some providers process data in other countries, including the United States.
1. Who we are
The OneTurn service at oneturn.ai, formerly refi.ne (the “Service”), is provided by Fast Law LLC, a Delaware limited liability company (Delaware file number 6643043), registered office 8 The Green, Suite A, Dover, DE 19901, United States (“we”, “us”). We are the controller of the personal data described in this policy, except where we process personal data in Your Content on your behalf. In that case you or your organisation decide why it is processed, and we act on your instructions as set out in the Terms of Service.
For privacy questions or requests, email [email protected].
2. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Email address; password (stored only as a one-way hash); name, email address and profile picture from Google if you sign in with Google; account type; preferred language; security level and retention choices; the version of the Terms you accepted and when you accepted it. | You and Google |
| Payment data | Stripe customer ID, purchases, subscriptions, credit balances and credit transactions. Your card details are collected and held by Stripe, not by us. | You and Stripe |
| Your Content | Prompts, chat messages, uploaded files and images, generated and modified files, and the working data created while a task runs. This includes exercise sets and class assignments, which may contain student names that a teacher types in. | You |
| Technical and security data | IP address, browser and device information (user agent), referring page, and the time of account actions such as sign-up, sign-in and purchases; a device identifier stored in a cookie; bot-check results; server and error logs. | Your browser and our systems |
| Marketing and analytics data | Campaign parameters from the link you arrived through (UTM codes); where you have consented or consent is not required, usage and advertising data collected by Google Analytics, Google Ads and Google AdSense. | Your browser and Google |
| Communications | Emails you send us, Report & Refund submissions and feedback. | You |
You do not have to give us personal data. Without an email address, however, you cannot create an account, and without Your Content we cannot carry out tasks.
3. Why we use it, and our legal basis
The legal bases below apply where the EU or UK General Data Protection Regulation (GDPR) or a similar law applies to you.
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the Service: running your tasks, storing your files and history, sending your content to the providers a task needs | Account data, Your Content, technical data | Performance of our contract with you |
| Billing, credits, subscriptions, refunds and accounting | Account and payment data | Contract; legal obligation |
| Security and fraud prevention, and enforcing free-credit and guest limits (device identifier, bot checks, the deletion record in Section 8) | Account data, technical data | Our legitimate interest in protecting the Service and preventing abuse |
| Support, troubleshooting and handling reports | All categories, as needed for the request | Contract; legitimate interest |
| Service emails, such as account verification, receipts and important notices | Account data | Contract |
| Marketing emails about our products | Email address, account data | Your consent, where the law requires it; otherwise our legitimate interest. You can unsubscribe at any time. |
| Analytics and advertising measurement | Marketing and analytics data | Your consent where required, including in the EEA, the UK and Switzerland; otherwise our legitimate interest |
| Complying with law, and establishing or defending legal claims | As needed | Legal obligation; legitimate interest |
We do not use Your Content to train our own models. We do not use it in marketing, case studies or showcases without your separate, express consent. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
4. AI processing and the providers we use
4.1 How a task is processed
To carry out a request, the Service may store your content temporarily and process it repeatedly across several model calls, tools and worker processes. This is how it keeps context, carries out multi-step work, recovers from failures and returns the result to you. We send each provider only the content that its part of the task needs.
4.2 Security levels
| Level | Providers it allows | What that means for your content |
|---|---|---|
| All models (used by guests and by accounts that have not chosen a level) | Every provider below, including Google’s free Gemini API tier and Meta’s Muse Spark contributor tier and Muse Image | Google and Meta may use content sent through these tiers to train and improve their models, and their staff may review it. |
| No training | Providers whose terms say they do not train on content sent through their programming interfaces, such as OpenAI, Anthropic and paid Google Gemini, plus every Zero-retention provider | Not used for training. It may be kept for a limited period, often up to 30 days, for abuse monitoring. |
| Zero retention | Hosts of open-weight models that state they keep no content after responding: Nebius, CoreWeave, Together AI, Novita and DeepInfra | Not kept by the provider after the response, except where the law requires |
We classify providers from their published terms, and we apply your level on a best-efforts basis. We cannot verify that a provider complies with its own terms, and providers may change their terms. Each provider’s current terms govern what it does with content it receives. You can change your level at any time in your account.
4.3 Providers that may receive your content
- OpenAI (United States). OpenAI states that content sent through its API is not used for training unless the customer opts in. Its abuse-monitoring logs may be kept for up to 30 days. OpenAI API data usage
- Anthropic (United States), reached directly or through Amazon Web Services Bedrock (United States). Anthropic states that commercial API content is not used for training by default and is normally deleted within 30 days. Anthropic data retention
- Google Gemini (United States and other Google locations). For unpaid (free-tier) services, Google may use submitted content and responses to improve its products, and human reviewers may read them. For paid services, Google states that it does not. Gemini API Additional Terms
- Meta Model API (Muse Spark and Muse Image) (United States). Content sent to Meta’s contributor or discounted services may be used to train, develop and improve Meta’s models. Meta does not publish a separate data-use statement for Muse Image, so we treat it the same way. Meta Model API Terms
- Nebius, CoreWeave (Weights & Biases Inference), Together AI, Novita AI and DeepInfra. These companies host open-weight models such as Qwen, GLM, DeepSeek, Kimi, Gemma and Nemotron, with zero data retention configured or stated. Nebius · CoreWeave · Together AI · Novita AI · DeepInfra
- Adobe PDF Services (United States or European Union). Documents may be sent to Adobe for OCR and for conversion between PDF and Office formats. Adobe Privacy Policy
- Brave Search (United States). When the assistant searches the web, the search query is sent to Brave. Brave Search privacy
- Decodo (network proxy). Some of our connections to model providers pass through Decodo’s proxy network. Traffic is encrypted end to end between us and the provider, so Decodo carries the connection but cannot read its content. Decodo Privacy Policy
4.4 Models developed in China
Some open-weight models we offer were developed by companies based in mainland China, for example Zhipu AI (GLM), Alibaba (Qwen), DeepSeek, Moonshot AI (Kimi) and Xiaomi (MiMo). We run these models only through the independent hosts listed above. We have no inference accounts with those developers. We do not send your content to servers in mainland China or to the developers themselves.
We may add, remove or replace providers as the Service changes. When a new provider would receive content under a different policy category, we will update its classification in the Service and in this policy.
5. When our staff can see your content
Our systems process your content automatically. Authorised staff may view a conversation, the files in it and the related logs only:
- when you submit Report & Refund or contact support about it;
- to investigate suspected abuse, fraud, a security incident or a breach of the Terms;
- to diagnose and fix a failure that you report or that affects the Service; or
- when the law requires it.
Access is limited to staff who need it for one of these purposes.
6. Other companies that process data for us
- Stripe handles payments, subscriptions and fraud screening.
- Supabase hosts our database in its Singapore region.
- Cloudflare provides encrypted file storage with an Asia-Pacific location preference, network protection, bot checks (Turnstile), our connection to the internet, and short links on g8.hk. Some older files may remain in private Amazon S3 storage until they are migrated or deleted.
- Purelymail sends and receives our email.
- Google provides Google sign-in, and, subject to your cookie choices, Google Analytics, Google Ads, Google Tag Manager and Google AdSense.
We may also disclose personal data: to comply with a law, court order or lawful request from an authority; to protect the rights, safety or property of our users, the public or us; or to a buyer or successor if our business is sold or reorganised, in which case this policy continues to apply to the data.
We do not sell personal data. Google’s advertising cookies may count as “sharing” for cross-context behavioural advertising under California law. You can refuse them through our cookie settings or your browser’s Global Privacy Control signal.
7. Cookies and similar technologies
| Cookie or storage | Purpose | Type | Lasts |
|---|---|---|---|
| session | Keeps you signed in | Necessary | 90 days |
| device_id | Recognises your browser to enforce guest and free-credit limits and prevent abuse | Necessary | 400 days |
| guest_uuid | Links your browser to your guest account | Necessary | Up to 90 days |
| locale, next_path, theme setting | Remember your language, where to return after sign-in, and light or dark mode | Necessary | Up to 1 year |
| cookie_consent | Remembers your cookie choice | Necessary | 180 days |
| Cloudflare security cookies | Bot and attack protection | Necessary | Session to 1 year |
| UTM cookies | Record which campaign link brought you to us | Analytics | 7 days |
| Google Analytics (_ga, _ga_*) | Measure how the site is used | Analytics | Up to 2 years |
| Google Ads and AdSense (_gcl_*, __gads, __gpi and others) | Measure advertising and show ads | Advertising | Up to 13 months |
In the EEA, the UK and Switzerland, we load analytics and advertising technologies only after you accept them in our cookie banner. You can change your choice at any time through the “Cookie settings” link in the site footer. Elsewhere they load by default, and you can turn them off the same way. We do not respond to “Do Not Track” signals, because there is no common standard for them. We do honour Global Privacy Control signals where the law requires us to.
8. How long we keep data
| Data | How long |
|---|---|
| Your conversations and files | The period you choose in your account, between 1 hour and 180 days after last activity. If you have not chosen one: 90 days after last activity for guest and free accounts, and 3 years for paying accounts. Expired content is normally deleted within about 15 minutes. Choosing a period is a complete deletion and applies to starred files too. |
| Files you put in the trash | Deleted permanently after 7 days, or 30 days for paying accounts |
| Working data of a paused task | 72 hours |
| Shared links, QR codes, published pages, exercise sets and class assignments | Until the expiry you or we set (QR links default to 90 days; published pages last up to 7 days), or until you turn them off |
| Guest accounts | Deleted after 90 days without activity |
| Registered accounts | Until you delete the account. Deleting it removes your account, conversations, files, credit history and cookie records straight away. |
| Deletion record | When you delete an account, we keep your email address, your last sign-in IP address and your unused paid credit balance. We use this record to stop deleted accounts from re-registering for free credit and to deal with payment disputes. It is kept without a fixed end date. You can ask us to delete it, and we will do so unless we need it for one of those purposes. |
| Payment records held by Stripe | Under Stripe’s own legal and tax obligations |
| Backups | Database backups held by our database provider expire on its normal rotation schedule |
| Data held by AI and conversion providers | Under each provider’s own schedule (Section 4). This is often up to 30 days, longer for content flagged for safety review, and nothing at all for zero-retention providers. |
We may keep limited data for longer where reasonably necessary to finish a task in progress, investigate abuse, resolve a dispute, comply with the law or preserve legal claims. We may keep aggregated or de-identified information that can no longer identify you.
9. Where your data is processed
Our application servers and primary database are in Singapore. Files are stored with an Asia-Pacific location preference. Depending on the task and your security level, providers may process data in the United States, the European Union and other countries where they or their sub-processors operate. Where the law requires safeguards for these transfers, we rely on the providers’ data-processing terms, including Standard Contractual Clauses where they offer them.
10. Security
Data is encrypted in transit using TLS. Stored files are encrypted at rest. Access to production systems is restricted to authorised staff. Code that the assistant writes runs in an isolated sandbox with no network access. No system is perfectly secure, and we cannot guarantee the security of data sent over the internet. If a personal-data breach occurs, we will notify affected users and the authorities where the law requires us to.
11. Your rights
- Everyone. You can change your retention period, delete conversations and files, download your files, and delete your account yourself in your account settings. You can unsubscribe from marketing emails using the link in any of them.
- EEA, UK and Switzerland. You have the right to access, correct, delete, restrict or object to our processing of your personal data. You can ask for a portable copy of data you gave us, and withdraw consent at any time. You can also complain to your local data-protection authority.
- Hong Kong. Under the Personal Data (Privacy) Ordinance, you can ask for access to and correction of your personal data.
- Singapore. Under the Personal Data Protection Act, you can ask for access and correction, and you can withdraw consent.
- California and other US states with privacy laws. You can ask what personal data we hold about you, and ask us to delete or correct it. You can opt out of the “sharing” of personal data for targeted advertising, and you will not be treated differently for using these rights.
To make a request, email [email protected] from the address registered to your account. We may need to verify your identity. We respond within 30 days, or sooner where the law requires.
12. Children and students
Accounts are for people aged 18 or over. We do not knowingly create accounts for, or collect personal data directly from, children. Students may take part in exercises and assignments through a link that a teacher or school shares with them, without an account. The teacher or school is responsible for the student information they enter and for any consent it needs. If you believe a child has given us personal data, email [email protected] and we will delete it.
13. Changes to this policy
We may update this policy. Each version is dated at the top of this page. For material changes, we will tell you by email or in the Service before the change takes effect.
14. Language
Translations of this policy are provided for convenience only. The English version is the only one with legal effect, and it controls if there is any conflict.
15. Contact
Fast Law LLC · 8 The Green, Suite A, Dover, DE 19901, United States · [email protected]