Privacy policy

1. Who we are and what this policy covers

Renewals360 is operated by Renewals360 Pty Ltd, a private company incorporated in South Africa ("Renewals360", "we", "us"). This policy covers both of our properties: the marketing website at renewals360.com, and the Renewals360 platform at app.renewals360.com.

We are responsible for personal information processed through the website and for the account information the platform needs to serve you. Personal information our subscribing customers load into their platform workspaces is processed only on their behalf and on their instructions.

We honour the same core privacy rights for every visitor and user, wherever you are, alongside the data protection law of our home jurisdiction.

Where your company subscribes to the platform, the subscription agreement and our data processing terms apply in addition to this policy.

2. Our privacy contact

Our privacy contact is responsible for data protection compliance and for handling requests and complaints, and can be reached at hello@renewals360.com. We aim to acknowledge every request within one working day.

3. What personal information we collect

Website enquiries: when you book a demo or download the renewal inventory template, we collect your name, work email address, company name and any note you choose to include.

Platform accounts: when you sign in to the platform we hold your name, work email address, an optional mobile number if you opt in to SMS alerts, your notification preferences, and, if you sign in with Microsoft, the optional profile photo Microsoft provides with your consent.

Workspace data: your company's workspace stores the obligation records your team creates (titles, suppliers, values, dates and notes) and the documents your team uploads (contracts, invoices, quotes), which are held in private storage accessible only to your workspace. These records can include the names and work contact details of colleagues assigned as owners, approvers and escalation contacts.

Billing records: plan, billing contacts and payment history. Card payments are made through our payment page; we do not store full card numbers on our own systems.

Correspondence: emails and messages you exchange with us, so that we have a record of what was asked and what was agreed.

Technical data: standard server logs (IP address, browser type, pages visited, timestamps) used for security monitoring and to keep both properties working. We do not use advertising trackers on either property. See the cookie policy at renewals360.com/cookies for exactly what is stored in your browser.

4. Why we process it, and on what lawful basis

To respond to your enquiry and set up the demo you asked for: processing is necessary to take steps at your request before entering into a contract.

To deliver the platform service your company has subscribed to, including sending the notifications you have configured by email and SMS: processing is necessary to perform that contract.

To secure our systems, prevent abuse and keep records of decisions: processing is necessary for our legitimate interests, balanced against your rights.

To meet legal obligations, including tax and accounting record-keeping.

To send you relevant updates about Renewals360, only where the law permits it and always with a working unsubscribe (see the direct marketing section).

5. AI document reading

The platform can read documents your team uploads with an artificial intelligence model, to prefill obligation records: for example extracting the supplier, value and renewal date from a contract. A human user always reviews and confirms extracted values before anything is saved.

Documents submitted to this feature are processed by Anthropic, our AI subprocessor, under our agreement with them. Your documents are not used to train Anthropic's models. You can use the platform without the AI features: records can always be created and edited by hand.

6. What we do not do

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined in US state privacy laws, including the California Consumer Privacy Act as amended (CCPA/CPRA). We do not share your renewal data with suppliers or any third party for marketing. We do not process sensitive categories of personal information (such as health or biometric information) and the platform is not designed to hold them.

Our services are directed at businesses. The website and platform are not intended for children, and we do not knowingly collect personal information from anyone under 18.

We do not make automated decisions that have legal or similarly significant effects on you. The platform surfaces reminders and suggestions, and AI extractions are always confirmed by a person; people make the decisions.

7. Where your data lives

Platform data (workspace records, uploaded documents, account data) is hosted with Supabase in the European Union (London region infrastructure), with the website and application layer delivered by Vercel's global network. Individual providers and locations are listed on the subprocessors page at renewals360.com/subprocessors.

8. How long we keep it

Enquiry data: for as long as needed to handle your request, and for a reasonable period afterwards so that we have context if you come back to us.

Platform data: for the duration of your company's subscription. On cancellation your company can take a complete export, including uploaded documents, and we delete platform data on request, or in line with the retention schedule agreed in the subscription, subject to records we are legally required to keep.

Technical logs: kept for a limited period for security purposes and then deleted or anonymised.

When personal information is no longer needed for the purpose it was collected for, and no law requires us to keep it, we delete or de-identify it.

9. Service providers and sharing

We use a small number of service providers to run our service. They process personal information only on our instructions, under written agreements that require confidentiality and appropriate security safeguards.

The current list, what each provider does and where it processes data is published and kept up to date at renewals360.com/subprocessors: Supabase (database, authentication and document storage), Vercel (hosting), Resend (email), Twilio (SMS), Anthropic (AI document reading) and Microsoft (sign-in and business email). Exchange-rate providers receive no personal data.

Beyond those providers, we share personal information only when you ask us to, when your company's subscription directs it, or when the law requires it (for example a court order or a lawful request from a regulator).

10. Cross-border transfers

Our primary data residency is the European Union (London region), with some providers processing in the United States. Wherever personal information travels, it remains protected by the written safeguards agreed with our providers and by the security measures described below.

11. Security safeguards

We secure personal information with appropriate technical and organizational measures: encryption in transit and at rest, workspace isolation in a multi-tenant architecture, role-based access control, activity logging, private document storage, tested backups and monitored availability. Our own backups and failover tests are tracked as recurring obligations in Renewals360. We run our own medicine.

If we have reasonable grounds to believe personal information has been accessed by an unauthorized person, we will notify affected individuals and any regulator we are required to notify, as soon as reasonably possible.

12. Direct marketing and SMS

We only send marketing you would expect: to existing customers about similar services, or with your consent. Every marketing message identifies us and includes a working unsubscribe, which we honour promptly. We do not use purchased lists. Enquiring about a demo does not sign you up to a mailing list.

SMS is used only for the platform notifications a user has opted in to, never for marketing. You can withdraw a mobile number or switch off SMS alerts at any time in your notification preferences.

13. Your privacy rights

Wherever you live, we honour the same core rights: to know what personal information we hold about you, to receive a copy of it, to have it corrected or deleted, and to opt out of marketing at any time.

If you are a resident of a US state with a comprehensive privacy law (such as California, Colorado, Connecticut, Virginia or Utah), those laws give you rights of access, correction, deletion and portability, and the right to opt out of sale, sharing and targeted advertising. As set out above, we do not sell or share personal information, and we do not use it for targeted advertising, so there is nothing to opt out of; your other rights we honour on request.

To exercise any right, contact hello@renewals360.com. We may ask you to verify your identity, we respond within the time your law requires (and aim for much sooner), and we will never discriminate against you for exercising a privacy right. For personal information inside a customer workspace, we may refer the request to that customer, which controls its workspace.

14. Cookies and local storage

The marketing website sets no cookies at all; the platform uses strictly necessary cookies and browser storage to keep you signed in securely. Neither property uses advertising or third-party analytics cookies, so no cookie consent banner is required. The full detail lives in the cookie policy at renewals360.com/cookies.

15. Changes to this policy

We may update this policy from time to time. Material changes will be flagged on this page and, for subscribing customers, notified by email. The version and date of the current policy appear at the top of this page.

16. Contact

Renewals360 Pty Ltd · Privacy contact: hello@renewals360.com. Company registration number will be published here once the registration certificate is issued.