Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Refiner is an in-product micro-survey tool built for SaaS and B2B applications. It uses an identify() call and cookies to tie survey responses directly to user traits, enabling highly targeted NPS, CSAT, and feature feedback surveys. As it sets cookies and transfers user-linked data to US servers, explicit consent under GDPR and the ePrivacy Directive is required for European users.
Refiner is an in-product micro-survey platform designed for SaaS and B2B software companies. Unlike traditional website survey tools that target anonymous visitors, Refiner is built around user identity: operators call refiner.identify(userId, traits) when a user logs in, passing an identifier and optional user trait data such as plan type, account age, feature usage counts, company name, or any other product metadata. This identify call links all subsequent survey interactions to a specific, named user. Survey responses, NPS scores, and verbatim feedback are stored against the individual user record in Refiner''s platform.
The Refiner JavaScript SDK, loaded from cdn.refiner.io, communicates with api.refiner.io to evaluate survey eligibility rules, determine the correct survey to display, and submit responses. Eligibility conditions are built on the trait data provided at identification, allowing operators to target specific segments such as users on a Pro plan who have been active for more than 30 days. Surveys are displayed as in-app widgets, banners, or slide-in panels without navigating the user away from the product.
Refiner collects: the user identifier (typically a UUID or email address) passed at identify(); all user trait data provided in the identify() call; survey responses including numeric scores and verbatim text answers; timestamps and metadata of survey interactions; and technical information such as page URL and browser details. The SDK uses both cookies and localStorage to persist the user''s identification state and survey history across sessions, ensuring that a user who has already responded to a particular survey is not shown it again during the suppression window.
Under the ePrivacy Directive, setting cookies on a user''s device requires prior consent unless the cookie is strictly necessary for a service the user has requested. The cookies and localStorage entries set by Refiner are used for tracking and targeting purposes and are not strictly necessary, so prior consent is required before loading the SDK. Under GDPR, the identify() call constitutes processing of personal data (user ID and traits). Because the tool systematically creates profiles of individual users and ties survey results to them, this is a form of profiling under GDPR Article 4(4). Consent under Article 6(1)(a) is the most appropriate legal basis, as it is transparent, gives users meaningful control, and is proportionate to the level of data linkage involved.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Refiner processes data on US-based cloud infrastructure. There is no adequacy decision covering the United States as a whole, so transfers from the EEA require an appropriate safeguard under GDPR Chapter V. Refiner relies on Standard Contractual Clauses (SCCs) as its primary transfer mechanism. Operators should request and execute Refiner''s Data Processing Agreement (DPA), confirm which version of SCCs is in use, and ensure that a Transfer Impact Assessment (TIA) has been conducted where required by their data protection authority. This is particularly important given the volume of user trait data that may accompany each identify() call.
The Refiner SDK must be gated behind user consent. In a SaaS product context, this typically means: either obtaining consent during the account creation or product onboarding flow, or integrating Refiner SDK loading with a cookie consent banner for authenticated users. The consent should be specific to the use of in-product surveys and identity-linked feedback collection. Users should be told that their account information is used to target surveys and that responses are linked to their user profile. Consent withdrawal must be technically possible, meaning the SDK should be unloaded and any stored identifiers cleared when consent is revoked.
To deploy Refiner compliantly: gate SDK loading behind user consent (CMP or product-level preference); minimise the user traits passed in the identify() call to only what is necessary for survey targeting; list Refiner cookies and localStorage use in your cookie policy; include refiner.io, cdn.refiner.io, and api.refiner.io in your Privacy Policy as data processors; sign Refiner''s DPA and confirm the SCC version; document the transfer mechanism in your RoPA; conduct a DPIA if processing user traits at scale or combining survey data with other analytics; and ensure users can access, correct, or delete their survey data in response to DSARs.
Websites using Refiner must obtain user consent under GDPR regulations.
DPIA considerations
A Data Protection Impact Assessment (DPIA) is recommended before deploying Refiner at scale in a SaaS product, particularly where the identify() call passes rich user trait data (subscription plan, usage metrics, company details) alongside survey responses. Key risk factors include: the systematic linking of survey results to individually identified users; the transfer of personal data and user traits to Refiner's US-based infrastructure without an adequacy decision for the US (relying instead on SCCs); the potential for user trait data to constitute profiling under GDPR Article 4(4); and the collection of verbatim feedback that may contain sensitive personal information. Operators should document the legal basis, conduct a proportionality assessment on the volume of user traits passed, and implement appropriate technical safeguards. If the data is used for analytics beyond simple survey aggregation, a full DPIA under Article 35 may be required.
Sample consent text
We use Refiner to display short in-app surveys to help us improve our product. Refiner uses cookies and your account information to personalise which surveys you see and to link your responses to your user profile. Your data may be transferred to servers in the United States. By clicking "Accept", you consent to this use. You can withdraw your consent at any time in your account settings or by contacting us.
Third-party domains contacted
refiner.iocdn.refiner.ioapi.refiner.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| refiner_user_token | persistent | 1 year | Stores the Refiner user token derived from the identify() call to persist the user's identity across sessions for survey targeting. |
| refiner_surveyed | persistent | 90 days | Records completed or suppressed surveys to prevent repeat display within the configured suppression window. |
| refiner_session | session | Session | Manages survey display state and eligibility checks within the current browsing session. |
| refiner_traits | persistent | 1 year | Caches user trait data passed via identify() locally to allow faster survey eligibility evaluation without repeated API calls. |
Refiner collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Refiner uses both browser cookies and localStorage to persist user identification and survey state across sessions. Cookies typically store a Refiner user token (derived from the ID passed in the identify() call) and a record of which surveys have been completed or suppressed. The localStorage entries mirror this data for resilience. Both the cookies and localStorage entries must be declared in your cookie policy, as they involve storing information on the user's device and accessing it on subsequent visits.
Yes. Consent is required under both the ePrivacy Directive (for setting cookies and localStorage) and GDPR (for processing personal data via the identify() call). Because Refiner ties survey responses to individual user identities and passes user trait data to US servers, this is not a strictly necessary processing activity. Explicit, informed consent must be obtained before the SDK is loaded, and users must be told that their account information is used to target and personalise surveys.
Consent under GDPR Article 6(1)(a) is the required legal basis for Refiner, given that the SDK sets non-essential cookies and the identify() call constitutes profiling of individual users. Legitimate interest is unlikely to be a defensible basis given the level of identity linkage and the cross-border data transfer involved. Consent should be granular, specifying that the user agrees to in-product surveys linking their account identity, and should be obtainable and revocable at any time through clear product-level controls.
Yes. Refiner is hosted on US-based cloud infrastructure, and all survey response data, user identifiers, and trait data passed via the identify() call are processed on US servers. There is no adequacy decision for the United States as a whole, so the transfer relies on Standard Contractual Clauses (SCCs). Operators should sign Refiner's Data Processing Agreement, confirm the SCC version in use, and consider conducting a Transfer Impact Assessment to document the level of risk involved in the US transfer.
A DPIA is strongly recommended and may be required under GDPR Article 35 if Refiner is used to systematically profile users by linking survey results with user traits such as plan type, usage data, or company information. The combination of identity-linked responses, cross-border transfer, and potential for sensitive verbatim data creates a risk profile that warrants formal assessment. Even if a full DPIA is not mandated, a documented risk assessment and Legitimate Interest Assessment (if applicable) are good practice before going live.
Gate the Refiner SDK initialisation behind a product-level consent mechanism or your CMP. Only pass the minimum necessary user traits in the identify() call required for survey targeting. Disclose Refiner's use in your Privacy Policy and cookie notice, including that responses are linked to individual user accounts. Sign Refiner's DPA, confirm SCCs are in place, and document the transfer mechanism in your Records of Processing Activities. Provide users with a way to withdraw consent, which should trigger SDK unloading and clearing of stored identifiers.
Alternatives with stronger EU privacy posture include Formbricks (open-source, self-hostable, EU data residency available), which offers similar in-product NPS and CSAT capabilities with full data ownership. Chameleon and Pendo also offer survey features with configurable data residency. For simpler needs, Typeform embedded within your product with EU data processing can reduce compliance overhead. Self-hosted solutions provide the greatest control but require engineering investment to maintain.
Add Refiner to your cookie policy table with entries for the user token cookie and any localStorage keys, including their type (functional/analytics), duration, and purpose. In your Privacy Policy, add Refiner (operated by Refiner.io) as a data processor, describe the identify() call and what user data is sent, note the US transfer and that it is protected by SCCs, and explain user rights including the right to withdraw consent or request deletion of survey data. Scan for Refiner cookies after deployment to capture the exact names, and update your policy at least annually.