How we handle the personal data that passes through Renderly.

Renderly is a software-as-a-service (SaaS) that generates documents — PDFs and images — from HTML and templates, through an API. This policy applies to the Renderly website, the dashboard and the API.

For the purposes of this document, and in line with the LGPD and the GDPR, we adopt the following definitions:

Personal data

any information relating to an identified or identifiable natural person (e.g., name, email).

Data subject

the natural person to whom the personal data relates.

Processing

any operation performed on personal data — collection, storage, use, sharing, deletion, etc.

Controller

the party that decides how data is processed. Renderly is the controller of its users’ account and billing data.

Operator / Processor

the party that processes data on behalf of the controller. With respect to the content sent by our customers (render payloads), Renderly acts as the customer’s operator.

Organization (tenant)

the billing and isolation unit. Every account belongs to an Organization, isolated from the others on the server.

We collect the minimum necessary to operate the service. Specifically, we process the following categories:

1.1 Account data

When you create an account, we collect name, email and password. The password is never stored in clear text: we keep only a hash generated with Argon2id, from which the original password cannot be recovered. Each account belongs to an Organization (tenant), isolated from the others.

1.2 Content you create (templates)

The templates you create — the HTML and document structure — are stored in our database, linked to your Organization. They may contain text, markup and variables you define. We recommend you do not embed third-party personal data directly in the body of the template; variable data should travel in the render payload (see 1.3).

1.3 Render data (payload) — zero-retention

On each render call, you send a payload (the data field) that is combined with the template to generate the document. That payload and the generated PDF/image are processed in memory and discarded at the end of the request. We do not persist the payload content or the generated document. Of this, we retain only:

• Metadata: document size, render duration, status (success/error) and date/time.
• A SHA-256 hash of the document, to allow integrity verification later (see Security page).

1.4 Billing data

Payments are processed by Stripe. We do not store card numbers on our servers; Stripe handles payment-method data as its own controller/operator. We keep customer and subscription identifiers, the contracted plan, payment status and invoice history necessary for the contractual relationship.

1.5 API credentials

The API keys are shown in plain text only once, at the moment of creation. In our database we keep only a hash of the key — we cannot recover the original key and you can revoke it at any time.

1.6 Technical and log data

For security and operations, we record limited technical data, such as IP address, request identifier, timestamps and authentication events. These logs do not contain the content of your payloads.

We process personal data for the determined and legitimate purposes below, and for no others:

• Provide the service: authenticate you, maintain your account, store your templates and run renders.
• Billing and invoicing: manage subscriptions, process payments and issue invoices.
• Security and abuse prevention: detect fraud, quota abuse and unauthorized access; keep audit logs.
• Support: respond to requests and resolve technical issues.
• Operation and improvement: monitor availability and performance using aggregated metadata — never the content of your documents.
• Compliance with legal obligations: meet tax, accounting and regulatory requirements.

Under the LGPD (arts. 7 and 11) and the GDPR (art. 6), all processing relies on a legal basis. We map each purpose to its basis:

When processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal. When it is based on legitimate interest, we carry out a balancing test between our interest and your rights and freedoms, and you can object (see the rights section).

We do not sell or rent personal data. We share data only with providers strictly necessary to operate the service, under contract and on our instructions. Our current sub-processors:

A transactional email provider may be added in the future (e.g., for confirmations and password recovery). When that happens, we will update this list before starting the processing. Changes to the sub-processor list are communicated with reasonable advance notice.

We may also disclose data when required by law, court order or competent authority, or to protect the rights, security and integrity of the service and of third parties — always limiting disclosure to what is strictly necessary.

Part of the infrastructure is located in the United States (the Neon database operates in the US-East/AWS region; Stripe is a global company). This means that personal data of data subjects in Brazil and the European Union may be transferred and processed outside the country of origin.

• LGPD (art. 33): transfers rely on adequate contractual safeguards with the sub-processors and on the necessity of performing the contract with you.
• GDPR (Chapter V): we use the European Commission’s Standard Contractual Clauses (SCCs) and/or other valid mechanisms for transfers to third countries.

Regardless of where data is processed, the technical safeguards described in the Security section and the principle of zero-retention of render content apply.

We retain each category only for as long as necessary for its purpose:

Once the purpose has ended or upon a valid deletion request, the data is erased or anonymized, except in cases of mandatory retention provided for by law.

We adopt technical and organizational measures proportionate to the risk, including:

• Encryption in transit: all traffic over TLS (HTTPS).
• Encryption at rest: persisted data is encrypted with AES-256 by the managed database provider.
• Protected passwords and keys: passwords with Argon2id; API keys stored only as a hash.
• Multi-tenant isolation: every query is scoped by Organization on the server; one tenant’s data does not cross into another’s.
• Content zero-retention: payload and generated document exist only in memory during the render.

You have rights over your personal data. The exact set varies according to the regime applicable to you. We list them by regime, transparently.

8.1 LGPD — Brazil (Law 13.709/2018, art. 18)

• Confirmation that processing exists and access to the data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary, excessive or non-compliant data;
• Portability of the data to another provider;
• Deletion of data processed on the basis of consent;
• Information about the entities with which we share data;
• Information about the possibility of withholding consent and the consequences thereof;
• Withdrawal of consent.

8.2 GDPR — European Union

• Access to the data (art. 15);
• Rectification (art. 16);
• Erasure / right to be forgotten (art. 17);
• Data portability (art. 20);
• Objection to processing, including processing based on legitimate interest (art. 21);
• Restriction of processing (art. 18);
• Right to lodge a complaint with a supervisory authority.

8.3 CCPA / CPRA — California (USA)

• Right to know what personal information we collect and how we use it;
• Right to delete personal information;
• Right to correct inaccurate personal information;
• Right to opt out of the “sale” or “sharing” of personal information — we do not sell or share personal data within the meaning of the CCPA/CPRA, so there is no sale to opt out of;
• Right to non-discrimination for exercising your rights.

We use the minimum cookies necessary for the service to work. By default, we set a single essential session cookie (renderly_session), marked as HttpOnly — inaccessible to JavaScript — to keep you authenticated. It does not serve advertising or tracking.

Set-Cookie: renderly_session=<token-opaco>;
  HttpOnly;
  Secure;
  SameSite=Lax;
  Path=/;
  Max-Age=2592000

We do not use third-party trackers by default. Full details about each cookie, its purpose and duration are in our Cookie Policy.

Renderly is a tool for developers and businesses; it is not directed at minors and we do not knowingly collect children’s data. Under the LGPD (art. 14), processing the data of children and adolescents requires specific care and, where applicable, the consent of at least one parent or guardian. If we become aware that we have collected a child’s data without the appropriate basis, we will delete that data.

We may update this policy to reflect changes in the service, in legislation or in our sub-processors. When there are material changes, we will update the effective date and the version number at the top and, where appropriate, notify you by reasonable means. Continued use of the service after the changes take effect constitutes awareness of the updated version.

For questions about privacy, exercising your rights or to reach our Data Protection Officer (DPO), use the channel below: