v0.1 — review pending

Privacy Policy

Last updated: 2026-05-07

1. Who we are

rendfly is operated by DFMENDES TECNOLOGIA LTDA (CNPJ 66.624.968/0001-05), based in São Paulo, Brazil. You can reach us at hello@rendfly.com.

2. What we collect

To provide production-time monitoring for your AI agents, we collect:

  • Account data — email, password (Argon2id-hashed), workspace identifiers.
  • Conversation samples — agent inputs and outputs you route through rendfly. Personally identifiable information (PII) is automatically redacted before storage.
  • System messages — the natural-language prompt that defines your agent's behavior. Treated as Customer intellectual property.
  • Provider credentials — read-only API keys for the LLM providers you connect (encrypted at rest with AES-256-GCM).
  • Operational telemetry — usage metrics, error logs, and audit events.

3. Why we collect it

We use this data to deliver the monitoring service, debug issues you report, secure the platform against abuse, and (in aggregate, never per-customer) improve detection quality. We do not sell your data, and we do not use your conversations to train third-party models.

4. Where it's stored

Primary storage: PostgreSQL with row-level security scoped to your workspace. High-volume conversation data: ClickHouse (planned). All sensitive fields — provider keys, system messages — are encrypted at rest with AES-256-GCM. All traffic is TLS 1.3.

5. Retention

  • Raw conversation samples (PII redacted): 30 days, then deleted.
  • Aggregated metrics and audit log: 12 months.
  • Account data: kept while your account is active; deleted within 30 days of account closure unless legal obligations require retention.

6. Your rights

Under Brazilian LGPD (Law 13.709/2018) and EU GDPR, you have the right to access, correct, delete, or port your data, and to object to or withdraw consent for specific processing. To exercise any of these rights, email privacy@rendfly.com. We respond within 15 days.

7. Changes to this policy

We will notify customers by email of any material change at least 30 days before it takes effect. Past versions are available on request.