Data Processing Addendum

You are the controller of the personal data you put into Rendament: you decide why and how it is processed. [Company legal name] is your processor: we process that data only to provide Rendament to you.

For the account data of your workspace members (names, email addresses, sign-in data) we act as a controller ourselves, as described in our Privacy Policy.

• Subject matter and purpose: providing Rendament: storing templates and uploads, importing rows from CSV files and Google Sheets, removing image backgrounds, generating images and delivering them through the app, the API, signed URLs and webhooks.
• Types of personal data: whatever you choose to include in your templates, uploaded images, spreadsheet rows and generated images, plus the related logs.
• Data subjects: the people your content is about, such as your customers, employees, event speakers or contacts.
• Duration: for as long as you use Rendament, and until the data is deleted as described below.

We will:

• process the personal data only on your documented instructions, which are these terms and the way you use Rendament, unless the law requires otherwise, in which case we will tell you if we are allowed to;
• make sure everyone at [Company legal name] who can access the data is bound by confidentiality;
• help you, as far as we reasonably can, to answer requests from data subjects and to meet your own obligations on security, breach notification and impact assessments;
• give you the information you reasonably need to show that this addendum is being followed.

We use these subprocessors:

Background removal and image generation run on our own servers. We will tell you before we add or replace a subprocessor, so that you can object. Each subprocessor is bound by data protection terms that protect your data at least as well as this addendum.

We protect personal data with measures that include:

• encrypted connections (HTTPS) between your browser, our servers and our subprocessors;
• passwords and API keys stored only as secure hashes, and sensitive settings encrypted at rest;
• access separated by workspace, with roles for owners, editors and viewers;
• staff access limited by role to what support needs;
• two-factor authentication and passkeys for user accounts;
• rate limiting and signed, revocable image URLs.

If we become aware of a breach affecting your personal data, we will notify you without undue delay, and tell you what happened, what data is affected, what we are doing about it and what you can do. We will keep you updated as we learn more.

Some subprocessors may process data outside your country. Where the law requires it, such transfers are covered by appropriate safeguards, such as standard contractual clauses.

You can export your generated images and delete your content at any time in the app. When you close your account, we delete it together with any workspace you are the only member of. To have a deleted workspace's remaining data erased permanently, contact us at [legal@your-domain].

Questions about this addendum or requests under it can go to [legal@your-domain]. [Company legal name], [Registered address]. This addendum is governed by [Governing law].