Privacy Policy

Effective November 6, 2026 · Rendrax, a product of Cravero Robotics LLC, New Jersey, USA ("Rendrax", "we") · controller of your data

Rendrax reads a business website you give us, builds a brand kit and produces marketing pieces you download. This policy explains what we collect, why, where it goes, and how to delete it. It applies to rendrax.com and app.rendrax.com, worldwide.

1. What we collect and why

What	Why	Legal basis
Website scan: the address you paste, the public text, logo, colors and images of that site, and the brand kit we derive from it.	To build your brand kit and sample piece.	Your request (contract / legitimate interest).
Account data: email, password (hashed), business name, interface language, country.	To create and secure your account, send you the "your month is ready" email.	Contract.
Billing data: handled by Stripe (card, billing address, tax ID). We store only Stripe's customer and subscription IDs, your plan, country and invoice status, never your card number.	To charge your plan and calculate taxes.	Contract / legal obligation (tax).
Your assets: logo, photos and texts you upload or correct in the brand kit, and the posts a business without a website uploads to get its kit (we never log in to your social accounts).	To produce pieces in your brand's style. Used only for your brand.	Contract.
Pieces and usage: the pieces produced, which ones you download, mark as posted or discard, redo requests.	To show your month, enforce your quota, improve what we make for you.	Contract / legitimate interest.
Technical data: IP address, browser, action logs.	Security, abuse and fraud prevention, rate limiting.	Legitimate interest.
Lead data (when you paste your website before buying): your email, your IP address, the approximate country we derive from that IP, and where you came from (UTM parameters or referring site).	To send you your brand kit, show prices and taxes for your country, understand which ads and channels bring customers, and stop abuse of the free scan. We never resell this and we never use it to track you across other sites.	Your request / legitimate interest.
Questions to Rex (the automatic assistant on rendrax.com and in your panel): what you ask, the answer, and, only if you ask Rex to pass your question to our team, the email you give us. Inside your panel, each question is saved together with your account's email and business name, so our team knows who asked, and Rex also reads your plan data (plan, period and pieces used) to answer about your account. In your browser, Rex keeps a conversation number in session storage (`rexs`, not a cookie) so your messages stay together; it is erased when you close the tab. Anthropic, our text provider, receives the question to write the answer and does not use it to train models.	To answer you, to pass what Rex cannot answer to a person on our team who replies by email, and to see what our website does not explain well. Kept up to 12 months, then deleted (including the messages you leave Rex for our team).	Your request / legitimate interest.

We never ask for your social media passwords.

2. Connected social accounts (managed accounts only)

Self-serve customers download their pieces and post them themselves. Rendrax never logs in to, and never publishes on, a self-serve customer's social accounts, and self-serve customers cannot connect them. Connecting a Facebook Page, Instagram business account, TikTok account or YouTube channel is only used for accounts that Cravero Labs manages directly: its own brands, and accounts it manages for a client under a separate written agreement. The connection is made with each platform's official sign-in screen (OAuth) by the account owner or an authorized manager; we receive an access token from that platform, never a password. We use the connection only to:

publish the pieces the account owner approves, at the time they choose;
read the basic profile of that account (its name and ID) to show which account is connected;
read the public statistics of the posts Rendrax published (views, likes, comments, shares) to show how they perform;
read the comments on those posts and post the replies the account owner approves. Our text provider (Anthropic) receives the text of a comment only to draft a reply for review; it is not used to train any model.

Access tokens are stored encrypted. We do not sell, rent or share data from connected accounts, and we never use it for advertising. The owner of a managed account can ask us to disconnect it at any time (hello@craverorobotics.com) and can also revoke Rendrax's access directly in each platform's settings. See Data Deletion.

3. YouTube API Services and Google user data

Rendrax uses YouTube API Services to connect YouTube channels managed by Cravero Labs (see section 2). By connecting a YouTube channel to Rendrax you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

Permission we ask Google for	What we access	Why
`youtube.upload`	Upload videos to your channel.	To publish the videos (Shorts and regular videos) that you approve in Rendrax. We never upload anything you did not approve.
`youtube.readonly`	Your channel name and ID, the list of videos uploaded through Rendrax and their public statistics.	To show which channel is connected and how the published videos perform.
`youtube.force-ssl`	Comments on the videos Rendrax published, and posting replies.	To show you new comments and post only the replies you approve.

Storage and deletion. YouTube statistics are deleted after 30 days; comments are emptied after 30 days (we keep only the comment ID so the same comment is not answered twice). When you disconnect YouTube in Rendrax, we revoke the access at Google and delete the stored YouTube statistics and comments of that project immediately. If you revoke access from your Google account instead, we delete them within 30 days.
Revoking access. You can remove Rendrax's access at any time at myaccount.google.com/permissions (Google security settings).
Sharing. We do not sell YouTube or Google user data, do not share it with third parties except the providers listed in section 4 when needed to run the feature you use, and do not use it for advertising or to train artificial intelligence models.
Limited Use. Rendrax's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Processors we rely on

Your data is processed by providers under contract, only to provide the service: Stripe (payments, tax, invoices), Amazon Web Services (servers and storage, USA), Anthropic and OpenAI (text and image generation from your brand kit), HeyGen and ElevenLabs (animated video and voice), Brevo (transactional email), Cloudflare (bot protection), Backblaze (encrypted backups, USA), Hostinger (hosting of this website), Google Fonts (web fonts) and country.is (approximate country from the IP address of a free scan, over HTTPS), and, only if you connect them, Meta, TikTok and Google/YouTube (to publish what you approve and read its statistics and comments). They receive only what each needs; generation providers receive your brand kit and the brief of each piece, not your account or billing data.

5. International transfers

We operate from the United States. If you are in the EU/EEA, UK, Switzerland, Brazil, Canada, Japan or another country with transfer rules, your data is transferred to the USA under the safeguards those laws accept (standard contractual clauses or equivalent, and our processors' certifications). You can ask us for a copy of the safeguards.

6. Retention

Scans that do not become an account: deleted automatically 30 days after the last visit.
Account, brand kit and pieces: for as long as your account exists. When you close it, your pieces stay available to download until you ask us to delete the account (see data deletion); then everything is removed.
Invoices and tax records: as long as tax law requires (usually 7 years).
Technical logs: 12 months. The instructions our system sends to the engines to make each of your pieces (quality log, visible only to our team): 45 days. Our team may review generated pieces for quality before you see them; a rejected piece is remade and the reason is kept as an internal note for your account.
Data from connected accounts: access tokens until you disconnect; YouTube statistics and comments as described in section 3 (30 days).

7. Your rights

Wherever you are, you can access, correct, export or delete your data, object to or restrict processing, and withdraw consent, by writing to hello@craverorobotics.com or from your account. We answer within 30 days (or sooner where the law requires). These rights include those under the GDPR (EU) and UK GDPR, the LGPD (Brazil), PIPEDA (Canada), the APPI (Japan), the Australian Privacy Act, and US state laws such as the CCPA/CPRA. We do not sell your personal data and we do not use it for advertising to you. EU/EEA, UK and Brazilian users may also complain to their data-protection authority. See also Data Deletion.

8. Children

Rendrax is for businesses and is not directed to children under 18. We do not knowingly collect their data.

9. Cookies

Inside the app we use only strictly necessary cookies (login session, security token, your language), and the Rex chat keeps a conversation number in session storage (rexs) that is erased when you close the tab. On the public site rendrax.com we may use Meta and TikTok measurement pixels when we run ads, to know which campaign brought a visit or a purchase; they set their own cookies under their policies and you can block them in your browser or through those platforms' ad settings. The free website scan is protected by Cloudflare Turnstile, which checks that you are not a bot without showing a puzzle. Details in the Cookie Policy.

10. Security

Encryption in transit (HTTPS), hashed passwords, encrypted secrets, access limited to staff who need it, signed time-limited download links so no one can open another customer's pieces. If a breach affects you, we will notify you and the authorities as the law requires.

11. Changes and contact

We will email you about material changes. Controller: Cravero Robotics LLC, New Jersey, USA · hello@craverorobotics.com.