Last updated:
Who we are and what this policy covers
App Renovation is a website and app studio and builder based in Eindhoven, the Netherlands. This privacy policy explains what personal data we collect when you visit our websites (appronovations.com, apprenovation.com and its language sites .nl, .de and .fr), use the App Renovation apps for web, iOS, Android and desktop, create an account, build or publish a site in Studio, or contact us.
For the data described here, App Renovation is the controller under the General Data Protection Regulation (GDPR, known in the Netherlands as the AVG). When you build a site for your own customers, you are the controller of your visitors' data and we act as your processor; see the section on sites you publish.
We try to collect only what we need. We do not sell personal data, we do not run advertising, and we do not build advertising profiles.
The personal data we collect
What we hold depends on how you use the service:
- Account data: your name, your email address and a password, which we store only as a one-way hash. When you sign in, we issue a session token that your browser keeps so you stay signed in.
- Messages and tickets: if you use the contact form or raise a ticket, we store your name, email address, phone number, the message you write and, for tickets, the answers you give, any date you choose and the files you attach (images or PDFs up to 5 MB).
- Newsletter: your email address, once you subscribe in the footer.
- Studio content: the sites, pages, text, images and settings you create, the blocks you save, and the descriptions you type into the AI tools.
- Usage data: a record of the pages you view, described in the next section.
- Device and connection details sent with a message: the page you came from, your language, screen size, time zone, IP address and browser type.
We do not ask for payment card details in the app. We do not knowingly collect special categories of personal data, such as health or political opinions. Please do not put them in messages, tickets or AI descriptions.
What we collect automatically
When you open a page of our public website, your browser sends us a short page-view record: the page path, the page you came from, the page title, your browser language, your screen size and your time zone. Our server adds the time, your IP address and your browser's user-agent string, from which we work out the browser, operating system and device type.
We use this to see which pages are useful, which sources send visitors, whether the site works well on phones, and to spot abuse and automated traffic. For each IP address we keep a single record that is updated on every visit, together with a count of visits. We do not follow you across other websites.
We do not record page views from the admin area, from development builds or from the desktop app. We also honour the Do Not Track and Global Privacy Control signals: if your browser sends either one, we record nothing about your visit.
Why we use your data, and our legal bases
Under the GDPR we need a legal basis for every use of personal data. Ours are:
- To provide the service and answer you (performance of a contract, or steps you ask for before one): running your account, Studio, publishing and hosting, and replying to messages and tickets.
- To keep the service secure and working (our legitimate interest): preventing abuse and spam, finding errors and understanding overall usage so we can improve our pages. We have weighed these interests against your rights. Because we collect little, keep it for a short time and respect Do Not Track, we believe the balance is fair.
- To send our newsletter (your consent): you can withdraw it at any time by unsubscribing or by writing to us.
- To meet legal duties (legal obligation): for example keeping records we are required to keep, or answering a lawful request from an authority.
We do not make decisions about you that have legal or similarly significant effects by purely automated means.
AI features
Some Studio tools use an AI model: Write with AI, the block tools that rewrite, shorten, translate or suggest headlines, and the helper that describes an image. When you use them, the text you type, the content of the block you chose and, for the image helper, the address of the picture are sent to our AI provider, Anthropic, so it can produce the result.
We send only what is needed for the request. We have not agreed to let our provider use this content to train its models. Please do not enter personal data about other people, or anything confidential, into these tools. The results are suggestions for you to review before you publish them.
Who we share data with
We share personal data only with providers that help us run the service, under contracts that limit what they may do with it:
- Amazon Web Services, for hosting, storage, databases and delivery, in the European Union (Ireland) and through its content delivery network, which serves pages and files from locations near you.
- Anthropic, for the AI features described above.
- Google Fonts, which serves our typeface. Loading it sends your IP address and browser details to Google so that it can deliver the font.
- WhatsApp (Meta), only if you click the chat button: it opens a conversation in WhatsApp, and WhatsApp's own privacy policy applies from then on.
We may also disclose data when the law requires it, to protect our rights, or as part of a merger or sale of the business, in which case we will tell you if it affects your data. We never sell your data.
Transfers outside the EU
We host our data in the European Union. Some providers, such as Anthropic and Google, may process data in the United States or other countries. Where that happens we rely on an adequacy decision, for example the EU-US Data Privacy Framework for certified companies, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for details of the safeguards that apply.
How long we keep data
We keep personal data only as long as we need it for the purposes above:
- Page-view records: deleted automatically 30 days after they are recorded.
- Accounts and Studio content: until you delete them or ask us to. Deleting a site removes its pages and images.
- Messages and tickets: until you ask us to delete them or we remove them, which we do once the matter is resolved and a reasonable time has passed.
- Newsletter subscriptions: until you unsubscribe.
- Server logs used to find errors: 30 days.
- Database backups: our database keeps point-in-time recovery data for up to 35 days.
When data is deleted, it can remain in encrypted backups for a limited time before it expires.
Cookies, local storage and similar technologies
We do not use advertising or tracking cookies. To work, the app stores a few items in your browser: your colour theme choice (light or dark) and, once you sign in, your session token, your saved language and a sign-in flag. These are strictly necessary for features you ask for, or are your own display preferences, so we do not show a cookie banner for them.
The app also installs a service worker, which keeps copies of the app's files so it loads faster and can start without a connection. You can clear all of this in your browser's site settings; you will then be signed out and your preferences will reset.
The native mobile and desktop apps keep the same items in the app's own storage.
Security
We protect data with encryption in transit (HTTPS with modern TLS), access controls so that each person can reach only their own projects and only administrators can read messages, tickets and usage records, one-way hashed passwords, signed and time-limited upload links, private storage for published site files, and monitoring of errors. Uploads are limited to image, video and PDF types, and we refuse SVG files because they can carry scripts.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours and tell the people affected without undue delay.
Sites you publish with App Renovation
If you build a site and publish it, its content is public and appears at a web address we host for you. Anything you put on it, including names, photos and contact details, can be seen by everyone. You are responsible for having the right to publish it.
If your site collects data from your own visitors, for example through a link or a form you add, you are the controller of that data and should publish your own privacy information. We process what is needed to host and deliver the site on your behalf; contact us if you need a data processing agreement. Sites we publish run without scripts and do not set cookies.
Your rights
Under the GDPR you can ask us to:
- give you access to your personal data and a copy of it;
- correct data that is wrong or incomplete;
- delete your data (the right to erasure), unless we must keep it by law;
- restrict how we use it while a question is being resolved;
- give you your data in a portable format, or move it to another provider;
- stop using it where we rely on legitimate interest, including for reasons connected to your situation; and
- withdraw your consent at any time, for example for the newsletter, without affecting what we did before.
To use a right, write to us through the contact page; we may need to confirm who you are. We answer within one month and can extend that by up to two more months for complex requests, telling you why. Using your rights is free unless a request is clearly unfounded or excessive.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or to the authority in the EU country where you live or work.
Appointment requests and free consultations
When you ask for a free consultation by WhatsApp, phone or the contact form, we use your name, contact details and anything you tell us only to arrange and hold the appointment, to prepare a sample demo and blueprint for you, and to follow up. If you message us on WhatsApp or call, that conversation also passes through WhatsApp's or your phone provider's systems.
We do not share your request with anyone else, and we keep it as described under how long we keep data. A demo or blueprint we prepare for you is yours to keep and is not published without your agreement.
Who can see your data inside App Renovation
Access is limited to what people need for their work. A small number of administrators can read messages, tickets, newsletter addresses and usage records so they can reply, support customers and keep the service running. Every other signed-in user can see only their own account and projects, and the service refuses anything else, whatever the app shows.
Our team and the providers who help us are required to keep this data confidential.
Links to other websites
Our pages may link to other websites, for example social profiles or the tools we integrate with. We do not control those websites and are not responsible for their privacy practices. Please read their policies before you share personal data with them.
Children
Our service is for businesses and adults. It is not directed at children under 16, and we do not knowingly collect their personal data. If you think a child has given us data, contact us and we will delete it.
Changes to this policy
We may update this policy when our service or the law changes. The date at the top shows when it last changed. If a change is significant, we will tell signed-in users or post a notice on the site before it applies.
Contact us
Do you have a question about this policy, or do you want to use your rights? Send us a message through the contact page. You can also use the address and details in the footer of this site. Please tell us which site you used and the email address of your account, so we can find your data.