Last updated:
Who we are and what this policy covers
App Renovation is a website and app studio and builder based in Eindhoven, the Netherlands. This privacy policy explains what personal data we collect when you visit our websites (apprenovation.com and its language sites .nl, .de and .fr), use the App Renovation apps for web, iOS, Android and desktop, create an account, build or publish a site in Studio, or contact us.
For the data described here, App Renovation is the controller under the General Data Protection Regulation (GDPR, known in the Netherlands as the AVG). When you build a site for your own customers, you are the controller of your visitors' data and we act as your processor; see the section on sites you publish.
We try to collect only what we need. We do not sell personal data, we do not run advertising, and we do not build advertising profiles.
The personal data we collect
What we hold depends on how you use the service:
- Account data: your name, your email address and a password, which we store only as a one-way hash. When you sign in, we issue a session token that your browser keeps so you stay signed in. When you create an account with a password, we send one verification email (a 4-digit code and a link) through Amazon SES to confirm that the address is yours; the code is stored only as a keyed hash and expires after 30 minutes. No account is created until the code or link is used: until then we hold only the details you entered (name, address and the password as a hash) for those 30 minutes, and they are then deleted automatically.
- Messages and tickets: if you use the contact form or raise a ticket, we store your name, email address, phone number, the message you write and, for tickets, the answers you give, any date you choose and the files you attach (images or PDFs up to 5 MB).
- Newsletter: your email address, once you subscribe in the footer.
- Studio content: the sites, pages, text, images and settings you create, the blocks you save, and the descriptions you type into the AI tools.
- Usage data: a record of the pages you view, described in the next section.
- Device and connection details sent with a message: the page you came from, your language, screen size, time zone, IP address and browser type.
- Pictures and videos (in My Website): the pictures and videos you add (up to five files, 50 MB in total, for each saved information). They are stored in your own media library on our content delivery network. Pictures are resized and compressed when you add them, and the location and camera details inside them are removed. MP4 videos are compressed shortly after you add them. On a Free account, a small App Renovation mark appears on your pictures when they are shown on a published site.
- Orders and payments: when you buy a plan we store the order (the plan and period, the amounts and VAT, your billing name, address, VAT number and phone number, the payment reference and its status) and issue an invoice. Your card or bank details are typed on Stripe's own payment page and are never sent to, or stored by, us: we receive only whether the payment succeeded and a reference for it.
We do not ask for payment card details in the app. We do not knowingly collect special categories of personal data, such as health or political opinions. Please do not put them in messages, tickets or AI descriptions.
If you choose "Sign in with Google", Google tells us your name, your email address (which Google has verified) and an account ID. We store the ID so we can recognise you next time. We never receive your Google password and we do not read your Google contacts or other Google data. Google's button is loaded from Google, so Google sees your IP address when the login or signup page shows it.
What we collect automatically
When you open a page of our public website, your browser sends us a short page-view record: the page path, the page you came from, the page title, your browser language, your screen size and your time zone. Our server adds the time, your IP address and your browser's user-agent string, from which we work out the browser, operating system and device type.
We use this to see which pages are useful, which sources send visitors, whether the site works well on phones, and to spot abuse and automated traffic. For each IP address we keep a single record that is updated on every visit, together with a count of visits. We do not follow you across other websites.
We do not record page views from the admin area, from development builds or from the desktop app. We also honour the Do Not Track and Global Privacy Control signals: if your browser sends either one, we record nothing about your visit.
Why we use your data, and our legal bases
Under the GDPR we need a legal basis for every use of personal data. Ours are:
- To provide the service and answer you (performance of a contract, or steps you ask for before one): running your account, Studio, publishing and hosting, and replying to messages and tickets.
- To keep the service secure and working (our legitimate interest): preventing abuse and spam, finding errors and understanding overall usage so we can improve our pages. We have weighed these interests against your rights. Because we collect little, keep it for a short time and respect Do Not Track, we believe the balance is fair.
- To send our newsletter (your consent): you can withdraw it at any time by unsubscribing or by writing to us.
- To meet legal duties (legal obligation): for example keeping records we are required to keep, or answering a lawful request from an authority.
We do not make decisions about you that have legal or similarly significant effects by purely automated means.
AI features
Some Studio tools use an AI model: Write with AI, the block tools that rewrite, shorten, translate or suggest headlines, and the helper that describes an image. When you use them, the text you type, the content of the block you chose and, for the image helper, the address of the picture are sent to our AI provider, Anthropic, so it can produce the result.
We send only what is needed for the request. We have not agreed to let our provider use this content to train its models. Please do not enter personal data about other people, or anything confidential, into these tools. The results are suggestions for you to review before you publish them.
My Website sends the saved information you choose, your account's email address and, for any pictures or videos you add, only their names, descriptions, your notes and their shape (width and height) to Anthropic, so it can write your website and decide where each file goes. The pictures and videos themselves are not sent to the AI: they are kept in your own media library on our content delivery network, where you manage them and where an administrator can help you or remove them. Please do not put personal or confidential information in file names or descriptions. If you choose to build from My Information instead, the text you saved there (never anything you did not write yourself) is sent to Anthropic in the same way, only to write your website. The area drafts you start from are written once by the AI from the area's name alone and contain none of your data; saved information is kept with your account and deleted with it.
The help chat on our website sends the questions you type, the earlier messages of that conversation, the page you are on and your language to Anthropic so it can write an answer. We do not store the conversation: it stays in your browser's session storage until you press New chat or close the tab. To keep the cost and misuse under control we count questions per visitor with a short-lived counter based on a one-way hash of your network address, which is deleted automatically within a few days. Please do not type personal or confidential information into the chat. If you press a thumb under an answer, that question and answer (with the page and language, nothing else) are sent to us and kept for 90 days so we can improve the answers. If you choose to send the chat to our team, the conversation and the name and email you enter reach us as a support request, like a message from the contact form. The smart box on the home page works the same way: the words you type, the earlier messages, your language and, when you are signed in, your plan, how many pieces of information you have saved and the names of your websites go to Anthropic so it can write an answer and suggest buttons. We do not store the conversation, and nothing happens until you press a button.
Who we share data with
We share personal data only with providers that help us run the service, under contracts that limit what they may do with it:
- Amazon Web Services, for hosting, storage, databases and delivery, in the European Union (Ireland) and through its content delivery network, which serves pages and files from locations near you.
- Stripe Payments Europe, Ltd. (Stripe), which processes payments. When you pay online you are taken to Stripe's payment page, which collects your card or bank details and can use them to prevent fraud and meet its legal duties; Stripe's own privacy policy applies to what it collects. We send Stripe the amount, the currency, your email address and an order reference.
- Anthropic, for the AI features described above.
- WhatsApp (Meta), only if you click the chat button: it opens a conversation in WhatsApp, and WhatsApp's own privacy policy applies from then on.
We may also disclose data when the law requires it, to protect our rights, or as part of a merger or sale of the business, in which case we will tell you if it affects your data. We never sell your data.
Transfers outside the EU
We host our data in the European Union. Some providers, such as Anthropic, may process data in the United States or other countries. Where that happens we rely on an adequacy decision, for example the EU-US Data Privacy Framework for certified companies, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for details of the safeguards that apply. Stripe may also process payment data outside the EU, under the same kinds of safeguards.
How long we keep data
We keep personal data only as long as we need it for the purposes above:
- Page-view records: deleted automatically 30 days after they are recorded.
- Accounts and Studio content: until you delete them or ask us to. Deleting a site removes its pages and images.
- Messages and tickets: until you ask us to delete them or we remove them, which we do once the matter is resolved and a reasonable time has passed.
- Newsletter subscriptions: until you unsubscribe.
- Server logs used to find errors: 30 days.
- Database backups: our database keeps point-in-time recovery data for up to 35 days.
- When an account is deleted, everything tied to it is deleted with it: its websites (also those in the trash), published files, images, media files, saved information, My Website settings, profile picture, orders, messages sent from its email address and its newsletter subscription.
- Orders and invoices: for as long as tax and accounting rules require us to keep them.
When data is deleted, it can remain in encrypted backups for a limited time before it expires.
Cookies, local storage and similar technologies
We do not use advertising or tracking cookies. To work, the app stores a few items in your browser: your colour theme choice (light or dark) and, once you sign in, your session token, your saved language and a sign-in flag. These are strictly necessary for features you ask for, or are your own display preferences, so we do not show a cookie banner for them.
When you pay, Stripe's payment page may set its own cookies and use its own technology to detect fraud. We do not control these; Stripe's cookie notice explains them.
The app also installs a service worker, which keeps copies of the app's files so it loads faster and can start without a connection. You can clear all of this in your browser's site settings; you will then be signed out and your preferences will reset.
The native mobile and desktop apps keep the same items in the app's own storage.
Security
We protect data with encryption in transit (HTTPS with modern TLS), access controls so that each person can reach only their own projects and only administrators can read messages, tickets and usage records, one-way hashed passwords, signed and time-limited upload links, private storage for published site files, and monitoring of errors. Uploads are limited to image, video and PDF types, and we refuse SVG files because they can carry scripts.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours and tell the people affected without undue delay.
Sites you publish with App Renovation
If you build a site and publish it, its content is public and appears at a web address we host for you. Anything you put on it, including names, photos and contact details, can be seen by everyone. You are responsible for having the right to publish it.
If your site collects data from your own visitors, for example through a link or a form you add, you are the controller of that data and should publish your own privacy information. We process what is needed to host and deliver the site on your behalf; contact us if you need a data processing agreement. Sites we publish run without scripts and do not set cookies.
To give you statistics, each page of a published site loads a tiny image from our servers. We count it by day and page (only a number) and keep no IP address, cookie or visitor identifier with the count; visitors who send Do Not Track or Global Privacy Control, and robots, are not counted. Like any request to our servers, it appears in our server logs, which include the IP address, for 30 days. You only ever see the totals.
Your rights
Under the GDPR you can ask us to:
- give you access to your personal data and a copy of it;
- correct data that is wrong or incomplete;
- delete your data (the right to erasure), unless we must keep it by law;
- restrict how we use it while a question is being resolved;
- give you your data in a portable format, or move it to another provider;
- stop using it where we rely on legitimate interest, including for reasons connected to your situation; and
- withdraw your consent at any time, for example for the newsletter, without affecting what we did before.
You do not have to write to us for the two most common requests: when you are signed in, My account has a button to download a copy of your data and a button to delete your account and everything in it.
To use a right, write to us through the contact page; we may need to confirm who you are. We answer within one month and can extend that by up to two more months for complex requests, telling you why. Using your rights is free unless a request is clearly unfounded or excessive.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or to the authority in the EU country where you live or work.
Appointment requests and free consultations
When you ask for a free consultation by WhatsApp, phone or the contact form, we use your name, contact details and anything you tell us only to arrange and hold the appointment, to prepare a sample demo and blueprint for you, and to follow up. If you message us on WhatsApp or call, that conversation also passes through WhatsApp's or your phone provider's systems.
We do not share your request with anyone else, and we keep it as described under how long we keep data. A demo or blueprint we prepare for you is yours to keep and is not published without your agreement.
Who can see your data inside App Renovation
Access is limited to what people need for their work. A small number of administrators can read messages, tickets, newsletter addresses and usage records so they can reply, support customers and keep the service running. Every other signed-in user can see only their own account and projects, and the service refuses anything else, whatever the app shows.
An administrator can, to help you, open and change your My Website (its information, pictures and videos) on your behalf. Each such change is logged. Administrators cannot see your password.
Our team and the providers who help us are required to keep this data confidential.
Links to other websites
Our pages may link to other websites, for example social profiles or the tools we integrate with. We do not control those websites and are not responsible for their privacy practices. Please read their policies before you share personal data with them.
Children
Our service is for businesses and adults. It is not directed at children under 16, and we do not knowingly collect their personal data. If you think a child has given us data, contact us and we will delete it.
Changes to this policy
We may update this policy when our service or the law changes. The date at the top shows when it last changed. If a change is significant, we will tell signed-in users or post a notice on the site before it applies.
Contact us
Do you have a question about this policy, or do you want to use your rights? Send us a message through the contact page. You can also use the address and details in the footer of this site. Please tell us which site you used and the email address of your account, so we can find your data.