Reneva

Italiano

Privacy policy

Last updated: 18 October 2026

This policy explains which personal data Reneva (the application served at my.reneva.app and the website reneva.app) processes, for which purposes, on which legal bases and for how long, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

The service is a management tool for renewals, client projects, documents and time tracking, aimed at freelancers and agencies. Part of the data concerns who uses the service; another, much larger part concerns the user's own clients, which the user enters and remains the controller of. That distinction is in section 2 and it matters, because it changes who answers for what.

1. Data controller

The controller is Green Marketing Agency, registered office at Via Louis Pasteur 2, 67100 L’Aquila (AQ), Italy — VAT no. IT02106940667.

For any request concerning personal data, including the exercise of the rights in section 5, the contact is info@greenmarketing.agency. No Data Protection Officer has been appointed: none of the mandatory cases under Article 37 GDPR applies.

2. Data processed, purposes and legal bases

a) Account data

Name, email address, password and personal settings (language, notification preferences, dashboard layout). If you enable two-step verification or a passkey, we also process the technical data that mechanism requires.

Passwords are never stored in clear text: the system only keeps an Argon2id hash, from which the original password cannot be recovered. The two-step verification secret and the recovery codes are encrypted at rest.

Purpose: creating and managing your access, providing the service, supporting you. Legal basis: performance of the contract (Art. 6.1.b GDPR); for technical security logs, legitimate interest (Art. 6.1.f) in protecting the service against abuse.

b) Data you enter into the tool — you are the controller of this

Records of your clients, documents, recurring fees, client projects, hours, expenses, notes and attachments. This is data you upload and of which you are the controller: whoever operates the service acts as a processor under Article 28 GDPR, that is, processes it only to run the tool for you, on your instructions.

Concretely: this data is not used for the service's own purposes — no profiling, no selling, no training of artificial intelligence models, no aggregation with other users' data. Access by whoever runs the infrastructure only happens for maintenance, security, or support you have asked for.

Every installation is isolated: one user's data is never visible to other users of the service.

"Reneva" Chrome extension

The "Reneva" extension for Google Chrome lets you start and stop the hours timer from the browser toolbar. It only communicates with my.reneva.app and uses the session you already signed in with: it does not read or store passwords, cookies or tokens.

When you start or stop the timer, the extension sends Reneva the company, project, task, note and billable choice you selected: these are the same data as the sessions recorded by the Timer and follow the rules of section 2 b). It receives from Reneva your name, the companies and projects you can access and the timer state, to show them in the popup.

On your device the extension only keeps the last company and project you picked, to suggest them again, and a copy of the last timer state and of the projects received, to open the popup without waiting. This data stays in the browser, is refreshed at every opening and is deleted when your Reneva sign-in is no longer valid or when you uninstall the extension.

The extension does not read pages of other websites, uses no third-party services and contains no analytics or advertising tools.

c) Usage statistics

In the My, Accountant, Analytics and client portals we use Google Analytics 4 for aggregate reports on pages visited and main actions. The events page_view and ui_click contain only the portal, page, section and action from a fixed catalogue, with a fixed title and virtual address.

We do not send user or client identities, names, data from the application, page or form text, searches, actual URLs, queries, tokens or referrers. We do not record sessions or use Google Signals, advertising audiences or profiling. Statistics on the public website follow its own privacy policy and consent arrangements.

Registration and sign-in do not constitute consent to analytics tools.

d) Feedback and support

The service includes a feedback chat: the messages you send, with their date and the user who wrote them, are kept for 60 days and then deleted automatically (not a manual promise: deletion is a scheduled routine).

Purpose: replying to you and improving the product. Legal basis: performance of the contract and legitimate interest in improving the service.

e) Service email

Transactional email (address verification, password reset, due-date reminders, sending documents) is delivered through Brevo, acting as a sub-processor.

For service email about your account (for example the end of the trial) we use, again through Brevo, your name and address, the subscription status and some usage data such as your last login. If you tick the optional box at registration you also receive the Reneva newsletter: legal basis your consent, which you can withdraw at any time from the link in every email.

If you configure your own SMTP server to send documents to your clients, those messages leave your infrastructure and do not pass through our providers.

f) Artificial-intelligence assistant features

The service offers optional assistant features (suggestions, summaries, answers about what you have on file). To answer or generate suggestions, the content used by the feature is sent to the model provider — OpenAI — through infrastructure operated by the service provider, acting as a technical relay.

What is worth knowing, put plainly:

• as well as replies you request from Ally, automatic suggestions may be generated when extended reading is enabled, subject to users' permissions and preferences;
• no anonymisation: names travel in clear. For the dashboard suggestions what leaves is aggregate figures (subscriptions, deadlines, money in, expenses, hours) and, when the analysis needs them, your company's name, the names of at most three clients and three price list items, and the most frequent archiving reasons. These structured summaries exclude email addresses, phone numbers, VAT numbers, IBANs, addresses and document text. The company context you write for Ally may also be sent: it is free text and may contain this data;
• Ally may send your messages and the attachments used in the request; reading attachments requires extended reading to be enabled. Do not include clients' sensitive data that the request does not need;
• the content sent is not used to train the provider's models;
• alternatively you can configure your own key with a provider of your choice: in that case the relationship with that provider is directly yours;
• the capabilities that would widen this list — extended reading of your financial data, writes from connected assistants and assisted bank reconciliation — are off and stay off until you turn them on yourself, one by one, in Settings › AI;

Legal basis: performance of the contract, limited to the feature you chose to use.

g) Backups

Database and attachment backups are stored on Cloudflare R2 with client-side encryption (restic): data is encrypted before it leaves the server, so the storage provider is not able to read it.

Legal basis: legitimate interest in service continuity and protection against data loss (Art. 32 GDPR, security measures).

h) The reneva.app website: newsletter, form protection and analytics

If you subscribe to the newsletter on the website, we process your email address and the date and outcome of the sign-up. The address is passed to Brevo, which sends you an email to confirm (double opt-in): without your click the subscription does not start. Legal basis: your consent (Art. 6.1.a GDPR), which you can withdraw at any time from the link at the bottom of every email.

The form is protected by Google reCAPTCHA, which assesses whether a submission comes from a person or an automated program using technical data from the browser and device (for example IP address and interactions with the page). Legal basis: legitimate interest (Art. 6.1.f) in protecting the service from fake sign-ups and abuse. Google's privacy policy and terms also apply.

On the website we use Google Analytics 4 to count visits and sign-ups (the newsletter event) and to measure the effect of our advertising campaigns. It runs in consent Basic mode: without consent it does not load GA4 or send pings to Google. Analytics (GA4) and marketing (Google Ads, if enabled) require separate consent: their tags and cookies start only after your choice is accepted and recorded. Legal basis: your consent (Art. 6.1.a).

We record acceptances, refusals and withdrawals to document your choices: a random consent identifier, accepted and rejected categories, choice type, policy revision, browser-declared date and server receipt date. The register contains no name, email, user, company, IP address or user-agent. We retain it for 2 years from receipt to demonstrate consent and manage choices. You can change or withdraw consent through “Cookie preferences” on the website. Refusing does not prevent browsing.

3. Where data is processed

The application and its database run on dedicated servers located in Contabo GmbH, data centres in Germany (European Union).

Some providers are based or run infrastructure outside the European Union: OpenAI (AI assistant), Google (Analytics and reCAPTCHA), Brevo for any infrastructure outside the EU, Cloudflare (backup storage). Transfers rely on the safeguards of Chapter V GDPR — standard contractual clauses (SCC) and, where applicable, the provider's certification under the EU-U.S. Data Privacy Framework. For backups there is an additional technical safeguard: as stated in section 2.g, data reaches the provider already encrypted.

4. How long data is kept

• Account and tool data: for as long as the account is active. On closure it is deleted, except what must be retained by law.
• Documents with tax relevance: 10 years, as required by Italian civil and tax law (Art. 2220 of the Civil Code and VAT legislation). This period prevails over a deletion request.
• Feedback and support messages: 60 days.
• Newsletter subscription: until you unsubscribe.
• Backups: kept on rotation, with automatic removal of the oldest copies; a requested deletion propagates to backups within the rotation cycle.
• Technical and security logs: as long as needed to detect and reconstruct abuse, and in any case no longer than 12 months.

5. Your rights

You may exercise the rights under Articles 15-22 GDPR at any time:

• access to your data and to information about the processing (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure, within the limits of retention obligations (Art. 17);
• restriction of processing (Art. 18);
• portability (Art. 20): the service provides CSV export of the main lists, which you can use on your own at any time;
• objection to processing based on legitimate interest (Art. 21).

Requests go to the address in section 1 and are answered within one month. If you believe the processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or bring the matter before a court.

6. Cookies and similar technologies

The service uses the minimum number of cookies needed to work, plus the analytics ones described in section 2.c. In the application, no advertising cookies and no sharing with ad networks. On the reneva.app website, analytics and campaign measurement follow section 2.h.

Technical cookies do not require consent (Art. 122 of the Italian Privacy Code): the service cannot work without them. Analytics cookies are described in section 2.c; the public website has its own consent arrangements. The full list and choices are in the website cookie policy.

7. Changes to this policy

If the processing changes — a new provider, a new purpose — this page is updated and the date at the top changes.