Privacy notice

This notice says what Rensa records, why, and for how long. It is written to be read in one sitting. If a question is not answered here, write to us.

Who is responsible

DD Labs Limited, in the UK, is responsible for what is recorded about you as the person with the seat, and for this site. For the people in your leads, you are the controller and DD Labs Limited is the processor, under the data processing agreement that is part of the terms.

What we record about you

When you start a seat we record your email address, the plan, the currency of your card, and the country the card is billed in. The card itself is held by the payment provider, and we never see its number. If you connect a CRM, the token that lets Rensa send to it is held sealed and used for nothing but the sends you ask for. If you write to us, we keep the conversation so the next person who answers has it.

We do not record the images the app captures, the sites the pages came from, or anything about the people on them beyond the leads you keep. For each image we keep a fingerprint of it (a SHA-256 hash), its width and height, and which provider and model read it, never the image itself. With each page read, Rensa keeps the name of the app it came from (for example Chrome), never the window's title, and, for a page that gave you leads, one line describing it, written by the model that read it. It says what kind of page it was and who it listed, for example "a Sales Navigator search for heads of sales in fintech". That line can reflect what you searched for. It never names a person. It is kept with the page's record, and deleted with it.

The events, by name

Rensa counts what happens in the product so that we can see where it fails and what it costs. Each count is an event with a name and a short list of what it carries. This is the whole list. No event carries a site, a page, an image, an email address, a person's name or a company, and no IP address is kept with any of them.

From the site.

page_view, when a site page is shown, carries the page's path, the referrer, and any utm tags in the address.
app_downloaded, when the download link is followed, carries the operating system.

From the app on your desk.

app_opened, once per install on the first open, carries the operating system and the app's version.
permission_decided, when the Screen Recording permission walk ends, carries the outcome (granted, denied or later).
window_picked, when a window or the whole screen is chosen, carries which of the two it was.
lead_reviewed, when a lead that needed a look is resolved, carries the outcome (kept or dropped).
lead_merged, when two leads are confirmed as one person, carries nothing.
lead_removed, when a lead is deleted from a list outside the review, carries nothing.

From our server.

trial_started, when a checkout completes with a card, carries the plan, the country, the referrer's token when you arrived through one, and the source and campaign name of the ad you arrived from when there was one.
page_captured, when a press has become leads in a list, carries how many leads landed, how many need a look, and the seconds from the press to the leads.
capture_failed, when a press produced no leads, carries the reason (unreadable, permission, timeout or error).
lead_reported, when a clean-lead claim is made under the second guarantee, carries which field was misread (name or company).
list_sent, when a list reaches a CRM or leaves as a CSV, carries the destination and the count of leads.
crm_connected, when a CRM is connected in Account, carries which provider.
allowance_80, when 80% of the month's leads have landed (the 400th on a seat, the 1,200th on Pro), carries nothing.
month_closed, when a seat's billing month closes, carries the leads landed, the leads over, and the amount.
trial_converted, when the day-fifteen charge succeeds, carries the amount, the currency, the plan, the referrer's token when there was one, and the same ad's source and campaign name.
subscription_canceled, when a seat is cancelled from Account, carries the reason you chose and the words you wrote, if any.
restriction_reported, when you tell us an account was restricted, carries whether the notice named Rensa and the date of the notice.
rebuild_delivered, when a rebuilt list is delivered under the third guarantee, carries the count of lists.
email_sent, when one of the five account emails or one of the two partner emails goes, carries which one.
email_opened, when the pixel in one of those seven is fetched from our own server, carries which one.
email_clicked, when a link in one of those seven is followed through our own redirect, carries which one.

The events are sent to an analytics service we run ourselves. Each count also carries the browser, operating system, device type, screen size, language and country the service works out from your visit. Your IP address is used to work out the country and is not stored. Once you are signed in, the service identifies your visits by your seat's id, so that the counts add up per seat.

The site sets one cookie, consent, and only when you answer one of its two questions. It holds your answers, yes or no, so you are not asked again. It lasts a year, and when the app lives under the site's own address it is shared with the app so the app reads the same answers. The analytics service sets no cookie and keeps no IP address; the address is used in the moment to work out the country and is not stored.

The site asks two separate questions, each only when it applies, and one answer never stands for the other.

If you arrive through a referrer's link or type a referrer's code, it asks whether it may remember who sent you. If you say yes, it keeps that token in your browser's storage (rensa-ref, in local storage) for thirty days; otherwise the token rides only the page you are on.
If you arrive from one of our ads or tagged links, it asks whether it may remember which one. If you say yes, it keeps the source and campaign name in your browser's storage (rensa-campaign, in local storage) for thirty days; otherwise they ride only the page you landed on. Either way, we keep those two names with your trial and your first payment, to know which ads work, and nothing else about you.

The app sets these cookies, each for one job.

__session signs you in. It lasts seven days from your last sign-in activity.
csrf-token guards forms against forgery. It lasts until you close the browser.
rensa-checkout remembers the plan, the currency, any founding or partner code you chose before signing up, and the source and campaign name of the ad you arrived from, so the checkout shows the same price. It lasts seven days and is cleared at checkout.
rensa-ref, set only when you arrive through a referrer's link and said yes to the site remembering it, holds that token for thirty days so the referrer is credited if you start.
rensa-pair holds the desktop app's pairing token while a new member signs up. It lasts ten minutes and is deleted when pairing completes.
rensa-theme holds your choice of light or dark for one year, so the desktop app can match it. The server does not read it. The same choice is also kept in your browser's storage.
__google_tx holds the state of a sign-in with Google while it is under way. It lasts ten minutes. (A CRM connection under way is kept on our server for ten minutes, not in a cookie.)
__oidc_tx and __fb_tx do the same for single sign-on and for signing in with Facebook, and are set only if those sign-ins are turned on. Each lasts ten minutes.

If you let us quote you

If you answer one of the questions inside Rensa and tick the box that lets us quote you, we may show your words on our site with your first name and your company, and nothing else about you. Reply to any email from us to take that back, and we remove the quote.

The emails

Every email we send is about your account. There are three kinds, and nothing else.

The five account emails. They are the one that sends you the app when your seat starts, the reminder that your trial is ending, the notice at 80% of the month's leads (400 of 500 on a seat, 1,200 of 1,500 on Pro), the invoice, and the reply when you tell us an account was restricted.
The emails that sign you in or check an address, which are a sign-in link, address verification, a password reset, a change of address, and an invitation to a seat.
To partners, their link and a notice when a workspace they sent has paid.

Two mechanisms tell us whether the five account emails and the two partner emails arrived; the sign-in and address emails carry neither. An image one pixel wide is served from our own server, and fetching it records which email was opened and nothing more. A link in an email goes through our own server first, which records which email was clicked and sends you on. Turn images off in your mail client and the first records nothing. No third party is told either.

The people in your leads

A lead is a name, a title, a company and a location, as read from a page you had on your screen, with the moment it was read and a reference to the page. The image the app captured is read and discarded; it is never written to storage. Leads are held by DD Labs Limited for you, and sent only where you send them. For each image we keep a fingerprint of it (a SHA-256 hash), its width and height, which provider and model read it, the name of the app it came from and, when it gave you leads, one line describing the page, never the image.

Leads are kept while your seat runs, and for ninety days after it ends so you can still read and download them; then they are deleted. Ask and the leads are deleted within thirty days; closing the account deletes them within the same period. Every list downloads as a CSV with every field. From Account, an admin downloads the whole workspace as JSON, and anyone else their own lists, each with their account details.

If you have a founding seat and email us a screenshot of a search page for the list-back service, we read it with Rensa, send the list back, and delete the email and the screenshot once the list is sent.

Where, and who else

Leads are stored on servers in Germany. The page image is sent for reading to model providers, mostly in the US, and the sub-processors in the list process data outside the UK under the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise under the UK's International Data Transfer Addendum to the European Commission's standard contractual clauses. The companies that work for us on your data are the sub-processors named in the data processing agreement, and none of them may use it for themselves.

If you are a partner

If you send people to Rensa as a partner, we hold your name, your contact email, where you send people, and a note of how you are paid, with the commissions your link has earned.

Your rights

You can see what we hold about you, correct it, and download it, from Account or by writing to us. To have it deleted, "Delete everything" in Account deletes your leads at once; within thirty days your API keys and webhooks are removed; your account details are deleted within thirty days of a request, and billing records are kept for six years because UK tax law requires it. If you are in the UK or the EU, you can complain to your data protection authority; in the UK that is the Information Commissioner's Office. If you are in a US state or a Canadian province whose law gives you further rights, write to us and we will honour them as that law requires.

Changes

When this notice changes in substance, the date under its title changes and we tell every seat by email.