Privacy policy
Last updated: 23 October 2026
Refuge is the shared account for the Sharpa apps: Topo, Balise and Sharpa. Agency teams log in once, then enter their agency's apps without typing their password again. This page explains what data Refuge processes, why, for how long, and how to exercise your rights.
Who are we?
Refuge is published by Camelidae Group SRL (alpaga agency), Rue d'Havré 140, 7000 Mons, Belgium, company number BE 0500.585.029.
For any question about your data: hello+privacy@alpaga.agency.
Who is responsible for your data?
Camelidae Group is the controller for Refuge accounts. Each app then has its own privacy policy for what happens inside it: projects in Topo, posts in Balise.
What data do we process?
- Your account: name, email address, chosen language, password (stored as an irreversible hash), two-factor authentication settings.
- Your agencies: the agencies you belong to and your role in each, along with each agency's name, logo, default language and apps.
- Your sessions: for each signed-in device, the browser used, the IP address, the opening date and the last activity. You can see them in "My account" and close them.
- The log: logins, invitations, team changes, agencies' access to apps and security settings, with the date, the author and the IP address.
Refuge contains no tracking, audience measurement or advertising tools. Data is never sold, shared with third parties or used to train artificial intelligence models.
What the apps receive
When you open an app, Refuge hands it a signed ticket, valid for one minute, containing your name, email address, language, the agencies that have access to this app, your role in each and the list of your apps. The app uses it to open your session and to sign your actions with your name. These apps are published by Camelidae Group: nothing leaves our hands.
Why, and on what basis?
- Logging you in to your agency's apps: performance of the contract between your agency and Camelidae Group.
- Security (two-factor authentication, attempt limits, session list, log): legitimate interest in protecting accounts and tracing who did what.
- Emails (invitations, new access to an agency, forgotten password): performance of the service. These emails contain no advertising.
Where is the data?
Refuge is hosted in the European Union, and the data does not leave it. Fonts are served by Refuge itself, without calling any third-party service.
How long?
- Your account is kept as long as you belong to an agency, or until you ask for it to be deleted.
- A session closes by itself after 30 days without activity, and its data goes with it.
- The log is used for account security. When an account is deleted at your request, your name and IP address are removed from it.
Cookies
Refuge uses a single cookie, needed for it to work, which requires no consent: a session cookie, valid for 30 days and extended on each visit, which keeps you logged in and remembers your language. Whether the menu is collapsed is remembered in your browser, without a cookie.
Your rights
You can ask to access your data, correct it, receive it in a file, have it erased or restrict its processing, and object to processing based on legitimate interest. Write to hello+privacy@alpaga.agency: we reply within one month.
If you believe your rights are not respected, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels.
Changes
We will update this page if Refuge changes the way it processes data. The update date is shown at the top of the page.