Legal · Terms
Terms of Service
Last updated 28 July 2026
The rules that apply when you connect a repository to Refact: what we do with it, what we ask of you, what our security scan does and does not promise, and how billing works. Written to be read rather than skipped.
The agreement
These terms are an agreement between you and Refact Ltd, a company registered in England & Wales. By creating an account or connecting a repository you accept them. If you are accepting on behalf of a company, you confirm you are authorised to bind it.
You must be at least 16 years old to use Refact.
What Refact does
Refact analyses a repository you connect, generates deployment configuration for it, runs security scans over it, and deploys the result to a third-party hosting provider on your behalf. It then monitors what it deployed.
The generated configuration (Dockerfile, CI workflow, compose file and environment template) arrives in your repository as a pull request. Nothing is merged without your approval.
Your account
You are responsible for keeping your credentials secure and for everything that happens under your account. Tell us at security@refact.app if you think it has been compromised.
You are responsible for the repositories you connect and for having the right to deploy the code in them.
Acceptable use
You may not use Refact to build, deploy or host:
- anything unlawful, or anything that infringes someone else's intellectual property.
- malware, phishing pages, or infrastructure for attacking other systems.
- cryptocurrency mining, or workloads whose purpose is to consume compute rather than serve an application.
- content that is defamatory, harassing, or that we are legally required to remove.
You also may not attempt to circumvent the security gate, interfere with other customers' deployments, or resell Refact as your own service without a written agreement.
We may suspend a deployment that breaches this section, and we will tell you why.
Your code stays yours
You keep all rights in your code. You grant us a limited licence to clone, store, analyse, build and deploy it strictly for the purpose of providing the service to you, and that licence ends when you disconnect the repository or close your account.
We do not use your code to train machine-learning models, and we do not share it with anyone other than the processors listed in our Privacy Policy.
What the security scan promises
Refact runs secret detection, static analysis and a dependency audit on every deploy, and a critical finding blocks the release. That is a genuine gate, not a warning.
It is not a guarantee that your application is secure. Automated scanning finds known classes of problem in known places; it does not find every vulnerability, and a clean scan is not a certification. You remain responsible for the security of your own code, and a passing scan does not shift that responsibility to us.
Fix pull requests are suggestions. Review them before merging, particularly dependency upgrades, which can change behaviour.
Plans and billing
The Free plan requires no card. Paid plans are billed monthly in advance, in pounds sterling, and renew automatically until cancelled.
You can cancel at any time; your plan then runs to the end of the period you have already paid for and does not renew. We do not pro-rate refunds for partial months, but if we have billed you in error, write to billing@refact.app and we will put it right.
We do not charge for a deploy that failed. If we change our prices, we will give you at least 30 days' notice by email before it affects your renewal.
Availability
We work to keep Refact available, but we do not offer an uptime commitment on the Free, Pro or Team plans. Enterprise agreements may include a separate SLA.
Your deployed applications run on third-party providers. An outage at that provider affects your app, and is outside our control.
Suspension and termination
You can close your account at any time. We may suspend or close an account that breaches these terms, that is being used to harm others, or that has an unpaid balance, with notice unless the breach makes immediate action necessary.
On termination we delete your data as described in the Privacy Policy. Deployments running on your own provider accounts are not affected.
Liability
The service is provided as it is. To the extent the law allows, we exclude implied warranties, and we are not liable for lost profits, lost data, or indirect or consequential loss.
Our total liability to you in any 12-month period is limited to the amount you paid us in that period, or £100 if you are on the Free plan.
Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited.
Changes
We may update these terms. If a change materially affects your rights we will email you at least 30 days before it takes effect, and continuing to use Refact after that date means you accept it. If you do not, you can close your account.
Governing law
These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Questions about them go to legal@refact.app.