Privacy Policy — Renomira

Who we are

Renomira is a software product operated by Theraputo (“we”, “us”, “our”). Theraputo is the controller of personal data processed for the purposes described in this Privacy Policy, except where we act as a processor on behalf of a business customer.

Our registered office is set out in the Contact section. Our data protection contact is [email protected].

1.1 Controller and processor

When you browse this website, create an account, or correspond with us, we decide how and why your personal data is processed, and we are the controller. When you use the Platform as a user of a business customer’s Account, that business is the controller of the register content and we are its processor; its privacy notice governs that processing and you should address requests about it to that business in the first instance.

Personal data we collect

Category	Examples	Source
Account and identity	Name, work email address, employer, role, hashed password or passkey credential, optional second factor.	You, or your employer’s administrator.
Billing and payment	Billing contact, company name, tax identifier, billing address, invoice history, payment status. Card and UPI details are collected and stored by our payment processor, not by us.	You, and our payment processor (Razorpay).
Platform content	The AI tools, use cases, owners, oversight records, incidents, evidence and free-text notes you enter. This may incidentally contain personal data.	You and your users.
Usage and telemetry	Pages viewed, features used, API calls, request identifiers, timestamps, approximate region derived from IP, error traces, performance measurements.	Generated automatically by the Platform.
Device and log data	IP address, user-agent, session identifiers, audit events (sign-ins, permission changes, exports).	Generated automatically.
Communications	Support tickets, survey responses, demo requests, marketing preferences and consents.	You.

We do not knowingly collect data from children and the Platform is not directed at anyone under eighteen (18). We ask that you do not submit special category data (for example health, biometric, political or trade-union data) or criminal-offence data through free-text fields.

Why we process personal data, and our legal bases

Purpose	Legal basis
Creating and administering your Account, authenticating you, and providing the Platform.	Performance of a contract (GDPR Art. 6(1)(b)); for DPDP purposes, performance of the service you requested.
Billing, invoicing, tax records, fraud and abuse prevention, and recovering debts.	Performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c)).
Securing the Platform, detecting intrusions, maintaining audit logs.	Legitimate interests (Art. 6(1)(f)) in protecting our service and our customers.
Improving the Platform, measuring feature adoption, debugging, capacity planning.	Legitimate interests (Art. 6(1)(f)); where required, consent.
Sending service messages: security alerts, invoice notices, material changes to terms.	Performance of a contract and legal obligation.
Sending marketing email about our products and events.	Consent where required (Art. 6(1)(a)); otherwise legitimate interests, with an unsubscribe link in every message.
Establishing, exercising or defending legal claims.	Legitimate interests and legal obligation.

We do not use automated decision-making that produces legal effects concerning you, and we do not carry out profiling for advertising. The risk tier assigned to an AI system in the Platform is an assessment of a system, not of a person.

AI training and automated processing

We do not use your Customer Data, your register content, your documents or your generated outputs to train, fine-tune or otherwise improve any foundation model. Where the Platform offers optional AI drafting assistance, the text you send is processed by the configured model provider to return a draft and is not used by us to train models.

We do use aggregated, de-identified statistics — for example, the distribution of risk tiers across the customer base — to improve the rule pack and to publish peer benchmarks that customers opt into. We apply a minimum aggregation threshold and take steps to ensure individuals and organisations cannot be re-identified.

Who we share personal data with

We share personal data only as described here, and never sell it.

Sub-processors. Vetted providers that help us run the Platform, including cloud hosting and content delivery, transactional email, error monitoring and payment processing. Each is bound by a written agreement.
Payment processors. Razorpay processes payments and receives the billing details needed to take a payment and to meet its own regulatory duties.
Professional advisers. Lawyers, auditors and insurers, under duties of confidence.
Authorities. Where we are legally compelled, or where disclosure is necessary to establish or defend legal claims, prevent fraud, or protect the rights and safety of any person.
Corporate transactions. A prospective or actual acquirer, or successor entity, under confidentiality obligations.
With your instruction. For example, when you enable an integration or publish a trust centre that we host at your direction.

A current list of sub-processors, with their locations and processing purposes, is available on request and is incorporated into the Data Processing Addendum.

International transfers

We are headquartered in India and use infrastructure in the European Union and other regions. Where we transfer personal data that is protected by the GDPR outside the European Economic Area, we rely on an appropriate transfer mechanism — in most cases the European Commission’s Standard Contractual Clauses — supported by a transfer risk assessment and additional technical and organisational measures such as encryption in transit and at rest and access controls.

For personal data subject to India’s Digital Personal Data Protection Act 2023, we process data in accordance with that Act and will comply with any transfer restrictions notified by the Central Government.

How long we keep personal data

Data	Retention period
Account and profile data	For the life of the Account, then up to 30 days after closure to allow export, then deleted or anonymised.
Customer content (register, evidence, documents)	While the Subscription is active; 30 days after termination for export; then deleted in line with the customer’s retention configuration and our backups cycle.
Invoices, tax and payment records	As required by applicable tax and company law, typically 8 years.
Security and audit logs	12 months, unless needed longer for an active investigation.
Support correspondence	24 months from the last message.
Marketing contact data	Until you unsubscribe or object, then suppressed to honour the objection.
Backups	Rolling 35-day cycle, after which backup copies are overwritten.

Where a legal hold applies, we keep the relevant data until the hold is lifted even if the periods above have expired.

How we protect personal data

We maintain technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or access. These include encryption of data in transit, hashing of API keys and credentials at rest, role-based access control with least-privilege defaults, audit logging of administrative actions, isolated customer workspaces, secure software development practices and prompt patching of known vulnerabilities.

No method of transmission or storage is completely secure. If a breach affecting your personal data occurs, we will notify you and the competent supervisory authority without undue delay and within the time limits required by law. Our current security programme is summarised at renomira.com/security.

Your rights

Depending on where you live, you may have some or all of the following rights. We honour GDPR rights for everyone who asks, wherever they are.

Access: Confirmation of whether we process your personal data, and a copy of it.
Rectification: Correction of inaccurate or incomplete personal data.
Erasure: Deletion of personal data where there is no overriding legal ground for keeping it.
Restriction: Limitation of processing while a dispute about accuracy or lawfulness is resolved.
Portability: A machine-readable copy of the personal data you provided, where processing is based on consent or contract and is automated.
Objection: Objection to processing based on legitimate interests, and an absolute right to object to direct marketing.
Withdraw consent: Withdrawal at any time, without affecting the lawfulness of processing before withdrawal.
Nominate (DPDP): Under India’s DPDP Act 2023, the right to nominate another individual to exercise your rights in the event of death or incapacity.
Complain: Lodge a complaint with your local supervisory authority or the Indian Data Protection Board.

Write to [email protected] to exercise any right. We will respond within thirty (30) days, and will tell you if we need longer and why. We may ask for information to verify your identity before acting, and we will not charge a fee unless a request is manifestly unfounded or excessive.

Cookies and similar technologies

This website sets no advertising cookies and no cross-site tracking cookies. We use:

Name / purpose	Type	Duration
Session cookie (Django sessionid)	Strictly necessary	Session, or up to 7 days with “remember me”.
CSRF protection token	Strictly necessary	Session.
Theme preference (stored in your browser’s localStorage, not a cookie)	Functional	Until you clear browser storage.
Exit-intent and dismiss flags (localStorage)	Functional	Until you clear browser storage.
Aggregate, cookieless page analytics	Analytics	Aggregated immediately; no persistent identifier.

Because the only cookies we set are strictly necessary or purely functional, we do not show a consent banner. If we ever introduce non-essential cookies we will ask for consent first.

Marketing and your choices

We send marketing email only where we have a lawful basis to do so. Every marketing message contains a one-click unsubscribe link, and unsubscribing takes effect promptly. We will still send transactional and service messages — invoices, security notifications and material changes to terms — because they are necessary to run your Account.

Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or in law. If a change is material we will notify account holders by email and in the Platform before it takes effect, and we will update the version number and effective date at the top of this document. Previous versions are available on request.