Privacy Policy
Last updated 02 October 2026
This policy explains what personal data RenewBud holds, why, where it is kept and who helps us process it. RenewBud is operated by MM Sistemas e Informática (CNPJ 42.188.885/0001-44), registered at Avenida Delfim Moreira, 840, Loja 02, Várzea, Teresópolis - RJ, CEP 25953-236, Brazil ("we", "us"), and is run day to day from the United Kingdom.
Who is responsible for which data
There are two kinds of personal data in RenewBud, and our role is different for each.
- Data a school or organisation puts into its workspace (for example the names and work email addresses of staff responsible for contracts). The organisation decides what goes in and why, so it is the data controller. We hold and process that data on its behalf, as its data processor, under our Data Processing Agreement.
- Data we need to run the service ourselves (your account, billing and messages you send us). For that data we are the data controller.
What we collect
- Account details: your name, work email address and password (stored as a one-way hash, never in readable form).
- Workspace data: the contracts and renewals you record, suppliers, costs, dates and notes, and the names and email addresses of the people responsible for each one.
- Decisions: who answered a renewal question, when, what they chose and any reason or note they gave.
- Security records: IP address, browser type and time of sign-ins and of changes made in a workspace, kept in the activity log.
- Billing details for paid plans: your organisation's name and address, billing contact and VAT number if you give one. Card details go straight to our payment provider; we never see or store card numbers.
- Messages you send us through the contact form, by email or through in-app support.
RenewBud is not designed to hold pupil data, and you should not enter any.
Why we use it, and our lawful basis
- To provide the service (sending renewal questions and reminders in your organisation's name, recording answers, producing reports): performance of our contract with you.
- To keep the service secure (sign-in records, activity log, protection against automated sign-ups): our legitimate interest in running a safe service.
- To bill paid plans and keep accounting records: performance of our contract and our legal obligations.
- To answer your questions: our legitimate interest in supporting the people who use RenewBud.
We don't sell personal data, we don't use it for advertising, and we don't use it to train AI models.
Where your data is kept
The RenewBud application and its database are hosted in a data centre in the United Kingdom.
Who helps us process it
We use a small number of service providers ("sub-processors"). They may only use the data to provide their service to us.
Your contracts and the details of your staff are stored in the United Kingdom. Stripe and Cloudflare never receive them: Stripe only handles billing details for paid plans, and Cloudflare only sees the IP address and browser of someone opening a sign-in or contact form.
| Provider | What it does for us | Where |
|---|---|---|
| Hostinger | Hosts the application and its database. | United Kingdom |
| Hostinger (email) | Delivers the emails RenewBud sends and holds our own mailbox. | Hostinger's mail servers, which may be outside the UK |
| Stripe | Takes card payments for paid plans. Not used for workspaces on the free plan. | Stripe's systems, including in the United States |
| Cloudflare (Turnstile) | Checks that sign-in, sign-up and contact forms are being used by a person and not a robot. It sees the visitor's IP address and browser details, not your workspace data. | Cloudflare's global network, including in the United States |
Where a provider processes personal data outside the UK, it does so under safeguards recognised by UK data protection law, such as the UK International Data Transfer Agreement or Addendum. Our fonts and scripts are served from our own server, so visiting RenewBud does not send your details to any other third party.
How long we keep it
- Workspace data: for as long as the workspace is active. When a workspace is closed, or you ask us to delete it, we delete its data within 30 days. Copies in backups are overwritten within a further 30 days.
- Billing records: for as long as tax and accounting law requires.
- Accounts that never confirm their email address and are never used are removed automatically after 7 days.
Security
Connections to RenewBud are encrypted. Passwords are stored as one-way hashes. Sensitive settings and two-step verification secrets are encrypted at rest. Two-step verification is available for every account, and changes made in a workspace are recorded in its activity log.
Your rights
Under UK data protection law you can ask to see the personal data held about you, have it corrected or deleted, restrict or object to its use, and receive a copy in a portable format. If your data was entered by your school or employer, please ask them first, as they decide how it is used; we will help them respond. For data we control, write to us at the address below and we will reply within one month.
If you are unhappy with how your data has been handled, you can complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put things right first.
Cookies
We use only the cookies needed to keep you signed in and to protect forms. We don't use tracking or advertising cookies. See our Cookie Policy.
Changes to this policy
If we change this policy in a way that matters, for example by adding a service provider, we will update this page and tell workspace owners by email before the change takes effect.
Contact
Questions about this policy, or requests about your data: privacy@renewbud.com.