What we collect, why, who sees it, and how to change your mind. Written to be read.
Effective 2 October 2026
This policy explains how Refinery.co collects, uses, and shares personal information when you visit refinery-agi.com, contact us, apply for a role, or use MAG, Alloy, Clueless, OI, or a Refinery.sol engagement. It applies to the information Refinery controls. Where a client engages Refinery.sol to process their own customers' data, that client's policy governs and Refinery acts on their instructions.
We collect what you give us, what our products need to work, and a small amount of technical data from hosting the site.
We process this because you asked us to (a contract or a request you made), because you consented on a form, because the law requires it, or because we have a legitimate interest in running and protecting the site. We do not sell personal information and we do not train general AI models on user data.
Connecting Google is optional and separate from signing in. These are the scopes Clueless requests, and the exact data each one covers.
We use this Google user data only for student-facing planning features: your course list, your deadlines, your study plan, your week view, and deadline events and reminders on the Clueless calendar. We do not use it for advertising. We do not use it to develop, improve, or train AI or machine learning models.
We never sell Google user data.
Supabase, our account provider, receives only sign-in data: your email, your name, and your Google account ID. Classroom data and Calendar data are stored on your Mac, not on our servers.
When you ask the assistant about your schedule, deadlines, or classes, or you ask it to add or change something on your calendar, Clueless includes only the relevant Google Calendar or Classroom details in that request. The request goes to the AI service you use: Clueless Cloud, via OpenRouter, routed to DeepSeek, or your own AI provider key. That service uses the details only to answer the request.
We may also disclose Google user data where the law requires it, and to a successor if the business is merged, financed, acquired, or dissolved. The successor takes that data under this policy, and any Google user data transferred that way stays subject to the Limited Use commitments below. Apart from the assistant request above, and these legal and merger cases, we do not transfer Google user data to anyone else.
Classroom and Calendar data is kept on your Mac only while Google is connected.
Disconnect revokes the token, deletes the token, and deletes imported Calendar events and all Classroom data from your Mac. Settings can clear app data.
To delete your account, email [email protected]. We complete that deletion within 30 days.
You can revoke Clueless at any time at https://myaccount.google.com/permissions. Deleting the Clueless calendar in Google Calendar removes the events Clueless wrote.
The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Clueless's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Account data for as long as your account exists, then deleted within 90 days of closure. Contact and application messages for two years. Payment records are kept for as long as Thai tax and accounting law requires. Abandoned checkout records are deleted with the account. Data stored on your device by Clueless and Alloy is deleted when you remove the app or clear it in Settings.
Encryption in transit and at rest, access limited to the people who need it, and signed and notarized desktop builds. No system is perfectly secure. If a breach affects your data, we will tell you as the law requires and as quickly as we can.
Under Thailand's Personal Data Protection Act, and where the GDPR or similar law applies to you, you may ask to access, correct, export, or delete your personal information, withdraw consent, or object to processing. You may also close your account at any time. Delete your Clueless account from Settings → Account, or by writing to us. Write to [email protected] and we will respond within 30 days.
Refinery operates from Bangkok. Some providers we use store data in Singapore, the European Union, or the United States. Where data leaves Thailand we rely on contractual safeguards that meet PDPA requirements.
Our products are for people 16 and older. Clueless is built for university students. We do not knowingly collect information from children under 16, and we delete it if we learn we have.
We will post the new version here with a new effective date. If a change materially affects how we use data you have already given us, we will email you before it takes effect.
The controller is Sirawit Yingcharoen, operating as Refinery.co, Bangkok 10230, Thailand. Data protection questions and requests: [email protected], or message our LINE Official Account. We will ask enough to confirm it is you, then respond within 30 days. You may also complain to the Personal Data Protection Committee in Thailand, or to your local authority if you live in the EEA or the UK.
This policy applies to Refinery.co and the products it operates. Where local data-protection law grants you additional rights, those rights are not affected.