Privacy Policy

This policy explains what personal data rendra.app collects, why, on what legal basis, and the rights you have under the EU General Data Protection Regulation (GDPR). It applies to our public link-in-bio pages and to our paid companion chat service.

1. Controller

Julian Burkardtc/o 2087Voltairestraße 1110179 BerlinGermany

Privacy contact: hello@rendra.app. Full provider details are in our Imprint.

2. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• rectify inaccurate data (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time, without affecting prior processing (Art. 7(3)).

To exercise any of these rights, contact hello@rendra.app free of charge. You also have the right to lodge a complaint with a data-protection supervisory authority, in particular the authority of your habitual residence or the competent authority for our establishment (Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin).

3. Data we process

• Chat content & relationship memory. When you chat with our companion service we process your messages and derive a persistent profile (e.g. your name, preferences, recurring topics, conversation history) so the persona can remember you across sessions. This is a core feature of the service and may include data you choose to reveal about yourself.
• Messaging identifiers. The chat runs over Telegram, so we receive the identifiers Telegram exposes (e.g. your Telegram user/chat ID and username).
• Payment data. Membership and pay-per-view purchases are processed by Stripe. We receive transaction metadata (amount, currency, status, a purchase reference); we do not receive or store full card details.
• Usage & technical data. When you open a bio page or follow a link we log technical data such as IP address, timestamp, user agent, referrer, and click/view events to provide and secure the service (Art. 6(1)(f) GDPR; security log data is deleted after a short period unless needed to investigate an incident).
• Cookies / device data. See section 7.

4. Purposes & legal bases

• Providing the chat and link-in-bio services — performance of a contract (Art. 6(1)(b) GDPR).
• Processing payments — performance of a contract and compliance with legal (e.g. tax) obligations (Art. 6(1)(b), (c) GDPR).
• Security, abuse prevention, and analytics — our legitimate interest in operating and protecting the service (Art. 6(1)(f) GDPR).
• Age confirmation and any optional cookies — your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG), where required.
• Where adult-content data reveals data of a special category, processing is based on your explicit consent (Art. 9(2)(a) GDPR).

5. Automated processing by AI providers

Our companion chat is operated by an AI persona, not a human. To generate replies, the content of your messages and the relevant relationship-memory context is sent to third-party large-language-model and embedding providers acting as our processors. They generate responses on our behalf; where the option exists, we instruct them not to use your data to train their own models. The service is for entertainment and companionship and does not make automated decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

6. Recipients & processors

We share data only with the providers needed to run the service. Some are located outside the EU/EEA; such transfers are safeguarded by an adequacy decision (e.g. the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses (Art. 44 ff. GDPR).

Image generation and photographs of real people. If you upload a reference photograph of an identifiable person to the Studio, that image is transmitted to the generation provider named above. Where such an image is used to recognise or reproduce a specific individual, it constitutes biometric data within the meaning of Art. 9 GDPR, and we process it only on the basis of the separate, explicit consent recorded for that persona (Art. 9 (2) (a) GDPR), which can be withdrawn at any time. Purely synthetic personas involve no personal data of a real person.

7. Cookies & device data

We store and read information on your device only where strictly necessary to provide the service you requested. Under § 25 (2) TDDDG this does not require your consent, and correspondingly there is nothing here for you to opt out of. We set no tracking and no advertising cookies.

• bio18 — stores your 18+ age confirmation so you are not asked again (strictly necessary for the adult-content gate).
• cookieok — remembers that you dismissed our cookie notice.
• Session cookies — keep you signed in to the operator console.
• Stripe / Turnstile cookies — set by those providers on checkout and protected pages for fraud prevention and security.

Reach measurement. We do measure how often a public page is viewed, but entirely on our servers and without storing anything on your device: we derive a coarse country from your IP address and a non-reversible hash of your browser identification, and we do not build a profile or recognise you across sites. Your IP address itself is used for security and abuse prevention (Art. 6 (1) (f) GDPR) and is not retained in the view records.

8. Retention

Because persistent memory is a core feature, chat history and the associated profile are retained for as long as the relationship is active; we do not auto-delete them. Payment and invoicing records are kept for the periods required by law. You can ask us to erase your data at any time (section 2); erasure is carried out as a single atomic operation across our systems. Any copy of the conversation stored in your own Telegram client is outside our control.

9. Data security

We use transport encryption (TLS) and appropriate technical and organisational measures to protect your data against manipulation, loss, and unauthorised access. Access to the underlying data is restricted to what is necessary to operate the service.

10. Children

The service is intended exclusively for adults. It is not directed to anyone under 18, and we do not knowingly process the data of minors.

11. Changes

We may update this policy as the service evolves. The current version always carries the effective date shown at the top of this page.