Privacy,
made clear.

This Privacy Policy explains how KBB Render collects and uses personal information when you visit our website, create an account, use our AI tools, subscribe to a plan, or contact us.

In this policy, “KBB Render”, “we”, “us” and “our” refer to KBB Render. We are based in the United Kingdom. Our Services are intended for adults and business users.

This policy should be read with our Terms of Use and our Cookie Policy.

The information we handle depends on how you use KBB Render. It may include:

• Account and contact information: name, email address, phone number if provided, and account credentials.
• Subscription and transaction information: plan, billing history, transaction records and limited payment details. Payments are processed by Stripe; KBB Render does not store full card numbers.
• Technical and security information: IP address, device and browser information, operating system, and operational or security logs.
• Project content: images, renders, design files, prompts, reference images and outputs that you upload or create using the Services.
• Messages and support information: information you include when contacting us or requesting assistance.

The application currently uses browser local storage for JWT-based authentication so you can remain signed in and use your account. This is authentication storage, separate from optional analytics or advertising tracking.

We use personal information to:

• create and manage accounts and provide the platform features you request;
• process subscriptions, payments and billing support;
• process your uploads and prompts to generate or edit AI outputs;
• provide customer support, communicate service notices and respond to enquiries;
• secure, troubleshoot, maintain and improve the Services;
• review outputs for internal quality assurance, subject to confidentiality and security safeguards; and
• meet legal obligations and protect our rights, users and Services.

We do not publish, display or use your project outputs for marketing without your permission.

Promotional messages are sent only where legally permitted. You can opt out of promotional emails using the unsubscribe option or by contacting us.

Where UK or EU data-protection law applies, we use the legal basis that fits each purpose:

• Contract: to create your account, deliver the Services you request, and manage your subscription.
• Legitimate interests: to secure, maintain, troubleshoot and improve our Services, where those interests are not overridden by your rights.
• Legal obligation: to meet legal, tax, accounting and regulatory requirements.
• Consent: where we ask for permission for optional processing or for storage and access technologies that require consent.

Cookie or similar-technology consent is separate from the legal basis we rely on for other personal-data processing. You may withdraw consent at any time through the relevant controls; withdrawal does not affect processing that took place before it.

We may share information with service providers that help us operate KBB Render, such as providers of cloud hosting and infrastructure, payment processing (including Stripe), AI processing, customer support, and security or fraud prevention.

We may also disclose information when required by law, to protect people or our rights, or as part of a merger, acquisition or transfer of our business.

The application does not currently have Google Analytics, Google Tag Manager or PostHog installed, and it does not use a product-analytics SDK to record in-app actions. The free-render funnel does currently capture campaign parameters (UTM source, medium, campaign, term and content) and the referring page with a guest render, and sends them to our server. This capture is being updated to respect the relevant privacy choice. We do not currently collect Google or Meta ad-click IDs such as gclid or fbclid through that funnel.

PostHog has been discussed as a possible future product-analytics service but has not been integrated into the app. If introduced, we plan to keep it disabled until analytics consent is given and to leave autocapture, session replay, surveys and server-side analytics off unless separately assessed and enabled.

Some service providers may process information outside the United Kingdom or European Economic Area, including in the United States. Where a transfer is subject to data-protection rules, we use an applicable transfer mechanism or safeguard, such as an adequacy decision, the UK International Data Transfer Agreement, or the relevant Standard Contractual Clauses.

We keep personal information for as long as needed for the purpose for which it was collected. The period depends on the type of information and why we need it—for example, to keep your account working, provide support, maintain project history, meet accounting or legal requirements, or resolve a dispute.

When information is no longer needed, we delete it or remove identifying details where appropriate. Some records may need to be kept for longer where the law requires it or where they are needed to establish or defend legal claims.

We use technical and organisational measures designed to protect personal information from unauthorised access, loss, misuse or disclosure. Access to account information and project content is limited to authorised people and providers who need it to operate or support the Services.

No online service can guarantee perfect security. Please keep your account credentials private and contact us promptly if you believe your account has been compromised.

The application stores a short-lived access token and a basic account profile in browser local storage for sign-in. Developers report that a separate refresh token is held in an HttpOnly, Secure cookie named kbb_rt, scoped to the authentication API path, and is rotated when used. The access token is valid for 30 minutes; the refresh-token lifetime is 30 days. The refresh cookie's production rollout must be confirmed before this draft is published.

The application also uses browser storage for the guest-render flow, project selection, announcements, signup and verification state, and animation handoff. The Cookie Policy lists the reported storage items and their purposes and lifetimes. Some lifetimes are cleared by application actions rather than by a fixed browser expiry.

The app does not currently use Google Analytics, Google Tag Manager or PostHog. However, the free-render funnel currently sends UTM campaign parameters and the referrer with the guest render as described above. We are preparing consent controls for the website and app; they are not yet confirmed as deployed. Until the controls are live, do not publish wording that says users can already change choices through a settings link.

The Cookie Policy describes the reported cookies and browser-storage items. The WordPress website's scripts and storage are still being inventoried, so the policy must be completed against that audit before publication.

Depending on where you live and the laws that apply, you may have the right to ask us to:

• provide access to your personal information;
• correct inaccurate or incomplete information;
• delete information or restrict how it is used;
• object to certain processing;
• provide information in a portable format; or
• stop processing that relies on your consent after you withdraw it.

Some rights are subject to conditions and exceptions. To make a request, contact info@kbbrender.com. You may also complain to the ICO if you are in the UK, or to your local data-protection authority if you are in the EU.

Residents of California and other US states may have additional rights under local law. Contact us to exercise a right that applies to you.

KBB Render is intended for adults and is not designed for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us so we can review and take appropriate action.

We may update this policy when our Services, data practices or legal requirements change. We will update the effective date above and, where appropriate, notify users about material changes.