Legal

Privacy Policy

Last updated: September 29, 2026

This policy explains what personal data we process when you visit renderstudio.app or use the Render Studio platform (app.renderstudio.app), why we use it, and the rights you have. In short: we use your data only to provide the service, we don’t sell it, we don’t use it for advertising, and we don’t use your designs to train artificial intelligence models.

1. Who is responsible for your data

The data controller is Laracha Studio CRC Limitada, a company incorporated in Costa Rica with its address in San José, Costa Rica, which operates the Render Studio service (“Render Studio”, “we”, “us”).

For any privacy matter, email us at [email protected].

2. What data we collect

  • Account data: name, email address, password (stored only as a secure hash, never in readable form), company, country, language and, if you belong to a team, your role in it.
  • Sign in with Google or Microsoft: if you choose this option, we receive only your name, your email address, whether the email is verified and an account identifier. We do not access your emails, files, contacts or calendar.
  • Two-step verification: your authenticator app key, stored encrypted, and your recovery codes.
  • Project content: the images you upload (models, plans, sketches, references, photos), the text instructions you write, the results you generate, project names and the defect reports you send us.
  • Payment and billing: plan, payment history, name or company name, tax ID and the details needed to issue electronic invoices. Your card details are received and processed directly by our certified payment processor (Tilopay); Render Studio never sees or stores your full card number, only the card brand and last four digits.
  • Technical and security data: IP address, browser and device type, sign-in date and time, account activity log (for example, invitations, role or plan changes, deleted projects) and error logs.
  • Communications: the messages you send to support and our replies.

We do not request or process sensitive data (health, religion, ethnic origin, etc.). Please do not upload images that contain it.

3. How we use your data

  • To provide the service: create and maintain your account and team, store your projects and generate the images and videos you request.
  • Billing: process subscriptions, packs and payment retries, and issue the invoices required by law.
  • Security: protect accounts, detect suspicious access, alert you to sign-ins from new devices and prevent fraud and abuse.
  • Support and quality: answer your questions and review the results you report as defective, both to fix them and to improve the quality of the service.
  • Service communications: notices about your account, billing, security and important changes. We only send marketing communications if you agree, and you can unsubscribe at any time.
  • Legal compliance: tax and accounting obligations and requests from competent authorities.

We do not sell your personal data, do not use it for advertising or commercial profiling, and do not use your content to train artificial intelligence models. We will never publish your designs or results (for example, as examples on our website) without your express permission.

Staff access to your project content is limited to authorized people, and only happens when needed to support you, review a report you sent, keep the service secure or comply with the law.

4. Legal basis

We process your data based on: (a) your consent, given when you create your account and accept this policy; (b) the performance of the service contract you accept in the Terms of Service; (c) compliance with legal obligations; and (d) our legitimate interest in keeping the service secure and running. This follows Costa Rica’s Law 8968 on the Protection of Individuals regarding the Processing of their Personal Data and, where applicable, the laws of your country.

5. Who we share your data with

We only share what is strictly necessary, with providers acting on our behalf and under our instructions:

  • Cloud infrastructure providers: servers, storage, backups, networking and attack protection.
  • Artificial intelligence processing providers: for each generation, they receive only the images and instructions needed to produce the result, never your name or email address. We select and configure these services so that they use this data only to return the result and, where the option exists, without retaining it or using it for training.
  • Payment processor (Tilopay), for card payments.
  • Email delivery service, for account notices.
  • Google or Microsoft, only if you choose to sign in with them.
  • Costa Rica’s Ministry of Finance (Ministerio de Hacienda), for electronic invoices.
  • Authorities, when required by law or a valid court order.
  • A potential buyer or successor, if Render Studio is merged, sold or reorganized, who will be bound to honor this policy.

Within your team: if your user belongs to a company account, that account’s owner and administrators can see the team’s projects and its activity log.

For reasons of commercial confidentiality, we do not publish the name of each technology provider. If you need more detail for a compliance review, email us at [email protected].

6. International transfers

Your data is stored in data centers located in the United States, and some providers may process it in other countries. In every case we require an adequate level of protection, including encryption, restricted access and contractual confidentiality commitments. By using the service, you consent to these transfers.

7. How long we keep your data

  • Account and projects: while your account is active or in archive mode. Anything you delete inside a project goes to a trash where you can restore it.
  • After cancellation or suspension for non-payment: we keep your projects for 90 days in case you come back. They are then deleted.
  • Account activity log: 12 months.
  • Backups: refreshed continuously; deleted data is gone from them within 30 days at most.
  • Billing records: for the period required by tax and accounting law.

If you ask us to delete your account, we will do so within 30 days, except for data the law requires us to keep.

8. How we protect your data

We use encrypted connections (HTTPS), passwords stored with strong hashing algorithms, encryption of credentials and secrets, two-step verification, isolation between different customers’ accounts, activity logging, role-based access controls, firewalls and backups kept outside the main server. No system is infallible: if an incident affects your data, we will notify you and the authorities within the time frames required by law.

9. Cookies and browser storage

We only use essential cookies that the service needs to work:

  • Session (rs_sess): keeps you signed in for up to 30 days.
  • Sign in with Google or Microsoft (rs_oauth): lasts a few minutes and protects that process.
  • Trusted device: if you check this option, we won’t ask for your verification code on that device for 30 days.

The platform also stores a few preferences in your browser (for example, the last tab you used). We do not use third-party advertising or analytics cookies. The website loads fonts from Google Fonts, so your browser connects to Google’s servers to download them.

10. Your rights

At any time, you can:

  • Access your data and learn how we process it.
  • Correct inaccurate data. You can change most of it yourself from your account.
  • Delete your account and your data, except what the law requires us to keep.
  • Object to processing or withdraw your consent. If you do, we may no longer be able to provide the service.
  • Portability: download your complete projects (.zip) from the platform, or ask us for a copy of your data.

Email us at [email protected] from your account’s email address. We will respond within the legal time frames. If your user belongs to a company account, some requests may be coordinated with that account’s owner.

If you are not satisfied with our response, you may contact Costa Rica’s data protection agency (PRODHAB) or the data protection authority in your country.

11. Additional information by country

We honor the rights granted by the data protection laws of your country of residence, including those of Mexico, Colombia, Argentina, Brazil (LGPD), Canada (PIPEDA and, in Quebec, Law 25) and U.S. state privacy laws. In particular: we do not sell or “share” personal information for targeted advertising, and we do not make decisions with legal effects on you based solely on automated processing. If a law grants you an additional right, you can exercise it the same way.

12. Data received from Google

If you sign in with Google, we only request basic identity permissions (name, email address and basic profile), and we use them solely to identify you and give you access to your account. Render Studio’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this data to third parties for advertising or use it to train artificial intelligence models.

13. Children

Render Studio is a service for professionals and businesses. It is not directed to anyone under 18, and we do not knowingly collect data from minors. If we find an account belonging to a minor, we will delete it.

14. Changes to this policy

We may update this policy. If the change is significant, we will notify you by email or within the platform before it takes effect. The date of the latest update appears at the top of this page.

15. Contact

Laracha Studio CRC Limitada · Render Studio · San José, Costa Rica · [email protected]