Privacy Policy

1. The short version

Three things are worth knowing before the detail.

We ask you for one thing: an email address. No name, no postal address, no phone number. A file, some settings and a way to reach you is the whole account.

Your files are rendered and then deleted. Thirty days after you last touch a project, the .blend and the frames are gone from our storage. We never show them to anyone, never publish them, and never use them to train machine-learning models.

Your data is processed outside the EU. Not "possibly" and not "in some cases". Our servers and our database are in the United States, and the GPUs that render your file are wherever our GPU providers have capacity at the time, which can be outside the United States. Section 4 says where each part runs, and what protects the transfer. If that is a problem for your project, tell us before you upload.

2. Who is responsible

The controller under Art. 4(7) GDPR is:

We have not appointed a data protection officer. A sole proprietorship with nobody else permanently engaged in automated processing does not need one under Art. 37 GDPR or §38 BDSG. Writing to the address above reaches the person who makes the decisions.

3. What we collect, and why

Abuse-prevention signals, specifically

Analysis and price calculation are free to you, and the price calculation burns real GPU time on our account. To keep that from being drained, every free calculation is counted against four budgets:

• a random id kept in your browser (rd_anonymous_id), which you can clear whenever you like
• the first 24 bits of your IP address, plus your network operator's ASN
• your email address, hashed
• the contents of your .blend file, hashed

The hashes are keyed and are never stored in a form we can read back. We do not fingerprint your browser: no canvas, no WebGL, no font probing. Fingerprinting would raise a §25 TDDDG consent question for a signal we do not need.

We also put Cloudflare Turnstile in front of uploads to check that a person is at the keyboard. Turnstile receives your IP address and browser characteristics and returns a pass or a fail. It sets no tracking cookie and does not follow you around the web.

Our interest here is keeping a free thing free without going broke, which we take to be legitimate under Art. 6(1)(f). You can object under Art. 21; see section 9.

Ad conversion measurement, specifically

We buy ads on Google, inside ChatGPT, on Reddit and on Microsoft's Bing. When you arrive through one, the address bar carries a click id the platform minted for that click (gclid for Google, oppref for ChatGPT, rdt_cid for Reddit, msclkid for Bing). We keep it with the project you create, and if that project becomes a purchase we report the click, the amount and the currency back to the platform that sold us the click, together with a SHA-256 hash of your email address, because all four platforms match purchases to ad clicks by hashed identifiers as well as by click id. Each receives the hash, not the address, and can only match it against email addresses it already holds. Google and Microsoft get the hash only if you accepted marketing cookies; OpenAI gets it either way, with an opt-out flag if you declined; Reddit gets it with every report, and receives no report at all without your consent (below).

This happens whether or not you accepted marketing cookies, and that deserves a plain sentence rather than a buried one. Knowing whether our advertising pays for itself is a legitimate interest under Art. 6(1)(f): what travels is a click identifier, a number and a hash, and without them a small advertiser is flying blind. Your banner choice still matters twice. Nothing is stored on your device without marketing consent (section 6), and Google, OpenAI and Microsoft receive your choice with every report: Google and Microsoft as a consent signal, OpenAI as an opt-out flag if you declined, which limits what each may do with the data on its side — Microsoft states that a report marked as denied is not used for any advertising purpose. Reddit offers no such signal, so we do the filtering ourselves: if you declined marketing cookies, we do not report a Reddit-attributed purchase to Reddit at all.

If you do not want your purchases reported at all, object under Art. 21 by emailing us. For this we treat a plain "stop" as enough — no balancing test, no questions. Section 9 has the address.

What we do not do

We do not sell your data. We do not use your uploaded files or your rendered frames to train machine-learning models, and we do not put them in marketing without asking you first. The statistical models we do fit are built on job metadata, which describes the work rather than the artwork: timings, settings and complexity measurements, never image data, geometry or textures.

4. Where your data is processed

Mostly in the United States; the table says where each part runs. GPU rendering has no fixed place: it runs wherever our GPU providers have capacity at the time, and that can be outside the United States. This section exists because the honest answer is uncomfortable and burying it would be worse.

What protects it. Each provider that takes data out of the EU is certified under the EU-US Data Privacy Framework, which the European Commission found adequate in July 2023, or is bound by the Commission's Standard Contractual Clauses, or both. All of them are under an Art. 28 data processing agreement with us, and each receives only what it needs for its part of the job. The Data Privacy Framework covers transfers to the United States only; for a GPU machine in another country, what applies is our agreement with the provider that rented it to us. You can get a copy of the Standard Contractual Clauses we rely on by emailing support@renderday.com.

What that does not do. No contract stops a US authority making a lawful demand of a US company, or another country's authorities making one where a GPU machine sits. That is the known limit of any transfer to a third country and we are not going to pretend otherwise. What we can tell you is how little travels: an email address, a record of a render, and a file that is deleted after thirty days.

If your project genuinely cannot leave the EU, email us before you upload. There may be something we can arrange, and if there is not we will say so rather than take the job.

5. Who else handles your data

Beyond this list we pass your data on only where performing the contract requires it, where you have consented, where the law compels us, or to protect somebody's vital interests.

Stripe is worth a note of its own. For fraud prevention and its own regulatory obligations Stripe acts as an independent controller, not merely as our processor, so its own privacy policy applies to the payment alongside this one. Your card number never touches our systems; we receive a confirmation, the last four digits and a transaction id.

6. Cookies, local storage and analytics

We use very few cookies. Most of what we keep on your device is browser local storage, which does the same job and which §25 TDDDG treats the same way.

Always present

• cookieConsent in local storage: the choice you made in the banner, so we stop asking
• session and CSRF tokens: so you stay signed in to your project and nobody else can act as you
• rd_anonymous_id and rd_attribution in local storage: the random id from section 3, used for the free-tier budgets and, if you consent, to join analytics events across a visit

These are strictly necessary for a service you asked for, so §25(2) Nr. 2 TDDDG lets us store them without consent. You cannot switch them off and keep using the site, though your browser can block them.

Only with your consent

Analytics and advertising tags run through Cloudflare Zaraz. Given consent it loads Google Analytics 4, Google Ads conversion and remarketing tags, the ChatGPT Ads measurement pixel, the Reddit pixel and the Microsoft Advertising UET tag, which set their own cookies (_ga, _gcl_aw, __oppref, _rdt_uuid, _rdt_cid, _uetsid, _uetvid, _uetmsclkid and similar) and send data to Google, OpenAI, Reddit and Microsoft in the United States. Without consent it loads none of them.

With marketing consent we also keep the ad click id itself in local storage (rd_gclid for Google, for 90 days at most; rd_oppref for ChatGPT, for 30 days at most; rd_rdtCid for Reddit, for 28 days at most; rd_msclkid for Bing, for 90 days at most), so a purchase you come back for days later still counts against the ad that brought you. Decline marketing and none is written; withdraw consent and all are removed.

We also record our own funnel events in our own database rather than somebody else's: which step you reached, which campaign brought you, whether a quote became a payment. They carry the anonymous id, not your name.

Your choice, and changing it

In the EU we ask before setting anything non-essential, and nothing loads until you answer. Elsewhere the tags default to on.

You can change or withdraw your choice at any time using the Cookie settings link in the footer of every page.

Do Not Track

There is still no agreed meaning for the DNT header, so we act on the choice you make in our banner rather than guessing from a header.

7. How long we keep things

Backups can hold a copy for a short while after something is deleted from the live systems. They are encrypted, are used only for disaster recovery, and roll over on their own schedule.

8. Automated decisions

Three things happen without a person in the loop.

Your price is calculated automatically, from measurements of test frames of your own scene. Nobody sets it by hand and nobody adjusts it according to who you are.

Free work is metered automatically against the budgets in section 3. When a budget runs out, a free price calculation queues behind paid work, or we ask you to confirm your email address before starting it. Nothing is refused outright, and paid work is never affected.

When a job of a paid render fails, a Claude model (Anthropic, see section 5) reads the job's settings, its error messages and the last lines of the render log, and suggests what happens next: try again on the same machine, on another machine or on one with more GPU memory, or stop. Fixed rules set the limits, such as how often a job may be tried, and they always win over the suggestion; if the model gives no usable answer, those rules decide alone. If a paid render is stopped, the message telling you why may be written by the model, and section 8 of our Terms applies: when we fail to deliver, you get your money back.

None of these produces a legal effect on you or anything similarly significant, so Art. 22 GDPR is not engaged. Even so: if a decision looks wrong, email us and a person will look at it.

9. Your rights

Exercise any of these by emailing support@renderday.com. There is no form and no fee, and we answer within a month as Art. 12(3) requires. If it is going to take longer, we will tell you why before the month is out.

• Access (Art. 15): a copy of what we hold and what we do with it
• Rectification (Art. 16): correct anything wrong
• Erasure (Art. 17): delete it, apart from what tax law makes us keep
• Restriction (Art. 18): freeze it while something is in dispute
• Portability (Art. 20): your data in a machine-readable file, or sent straight to another provider
• Objection (Art. 21): to anything we do on the basis of legitimate interests, on grounds relating to your situation. For direct marketing there are no grounds to give and no balance to strike, so saying stop is enough — and we treat the ad conversion measurement in section 3 the same way
• Withdrawing consent (Art. 7(3)): at any time, without affecting what we did lawfully beforehand

We may ask you to write from the address we already have on file before handing anything over. Giving your data to the wrong person would be the worse failure.

10. How we protect your data

Everything travels over TLS. Files and database contents are encrypted at rest by the providers that hold them.

There are no passwords to steal. You get into a project through a one-time link sent to your email address, so there is no password database to breach.

Rendering machines run in an isolated network, can reach only our storage and our API, and are destroyed when the job finishes. Blender's Python auto-execution is switched off on them, so an uploaded file cannot run code on our infrastructure.

Access to production data is limited to the operator named in section 2. Providers are picked partly on their security posture, and every one of them holds a data processing agreement with us.

None of that makes a system unbreakable. If a breach ever puts your rights at risk we notify the supervisory authority within 72 hours under Art. 33, and tell you directly under Art. 34 where the risk to you is high.

11. Changes to this policy

We update this page when what we do changes, and the date at the top moves when the wording does. If a change materially affects you and we have your address, we will email you rather than hope you re-read the page.

Ask and we will send you the version that was in force on a given date.

12. Complaints

Write to us first, at support@renderday.com. It is faster, and we would rather know.

If that does not settle it, you can complain to a supervisory authority: the one where you live, where you work, or where you think the problem happened. Ours is: