Privacy Policy

1. Introduction & Scope

Rensora AI (“Rensora,” “we,” “us,” or “our”) is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you interact with our websites (rensora.ai and rensoraai.com), our technology platforms, and our professional services.

This policy applies to all products, services, and interactions offered by Rensora, including but not limited to:

• Evolis AI — our AI Agent Lifecycle Management Platform;
• ModernZAI — our Enterprise Technology Modernisation Platform;
• Our consulting and advisory services across AI strategy, machine learning engineering, platform engineering, data governance, and related enterprise solutions;
• Our corporate websites, marketing communications, and support channels.

Depending on the context of our relationship with you, Rensora may act as a data controller (when we determine the purposes and means of processing your personal data, such as for our website operations and marketing) or as a data processor (when we process personal data on behalf of our enterprise clients in the course of delivering our platform and consulting services).

By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please discontinue use of our services.

2. Information We Collect

We may collect and process the following categories of personal information:

2.1 Contact and Identity Information

Name, email address, phone number, postal address, job title, company name, and other professional identifiers you provide to us through forms, account registration, or correspondence.

2.2 Professional and Business Information

Company size, industry, role, department, business requirements, project scope, and other professional data relevant to our consulting engagements and service delivery.

2.3 Account and Platform Data

If you use Evolis AI or ModernZAI, we collect account credentials, user preferences, access permissions, workspace configurations, and platform usage activity necessary for operating and securing your account.

2.4 Usage and Analytics Data

Information about how you interact with our websites and platforms, including pages visited, features used, click patterns, session duration, referral sources, search queries, and conversion events.

2.5 Device and Technical Data

IP address, browser type and version, operating system, device identifiers, screen resolution, language preferences, time zone, and network information collected automatically when you access our services.

2.6 AI Platform Configuration Data

When you use our AI platforms, we may collect agent configurations, workflow definitions, deployment metadata, model selection preferences, integration settings, and governance policy configurations. We do not collect, store, or access our customers’ proprietary training data or the underlying datasets used to fine-tune customer models.

2.7 Cookies and Tracking Data

Information collected through cookies, web beacons, pixels, and similar tracking technologies as described in Section 6 of this policy.

2.8 Support and Communications Data

Records of your communications with us, including support tickets, emails, chat transcripts, feedback submissions, survey responses, and call recordings (where applicable and with appropriate notice).

2.9 Employment Application Data

If you apply for a position at Rensora, we collect your resume or CV, cover letter, employment history, educational background, professional references, and any other information you submit as part of the recruitment process.

3. How We Collect Information

3.1 Directly From You

We collect information that you voluntarily provide to us when you:

• Complete forms on our websites (contact forms, demo requests, newsletter sign-ups);
• Create or manage an account on Evolis AI or ModernZAI;
• Engage with our sales, consulting, or support teams;
• Attend our events, webinars, or conferences;
• Apply for employment opportunities;
• Respond to surveys or provide feedback.

3.2 Automatically

We collect certain information automatically when you access our websites and platforms, using:

• Cookies and similar technologies (see Section 6);
• Web server logs and analytics platforms (including Google Analytics GA4);
• Platform telemetry and performance monitoring tools;
• Security and fraud detection systems.

3.3 From Third Parties

We may receive information about you from third-party sources, including:

• Business partners and referral sources who introduce you to our services;
• Technology partners and integrations that you connect to our platforms;
• Publicly available sources such as company websites, professional networking platforms, and public registries;
• Data enrichment providers that supplement business contact information for legitimate marketing purposes.

4. How We Use Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain, and improve our consulting services, platforms, and customer support;
• Platform Operations: To operate, secure, and optimise Evolis AI and ModernZAI, including user authentication, access management, and feature delivery;
• AI Agent Lifecycle Management: To facilitate the design, development, deployment, monitoring, and governance of AI agents within our platforms on behalf of our customers;
• Security and Fraud Prevention: To detect, investigate, and prevent unauthorised access, security incidents, fraud, and other harmful activities;
• Customer Support: To respond to your enquiries, resolve issues, and provide technical assistance;
• Marketing and Communications: To send you relevant information about our services, products, events, and industry insights, subject to your communication preferences;
• Analytics and Insights: To understand usage patterns, measure performance, and generate aggregated insights that inform our business and product decisions;
• Legal and Regulatory Compliance: To comply with applicable laws, regulations, legal processes, and enforceable governmental requests;
• Product Improvement: To research, develop, and enhance our platforms, services, and user experiences;
• Recruitment: To evaluate employment applications, manage the hiring process, and comply with employment laws.

We do not use customer data to train our AI models. Customer data processed through our platforms is used solely for the purpose of delivering our services to the respective customer and is handled in accordance with our contractual obligations.

5. AI-Specific Data Practices

Given the nature of our AI-focused platforms and services, we are committed to transparency regarding how data is handled within our AI systems.

5.1 Evolis AI — AI Agent Lifecycle Management

Evolis AI enables enterprises to manage the full lifecycle of AI agents. In the course of providing this platform, we process:

• Agent Configurations: Definitions, parameters, prompt templates, and workflow orchestration settings that customers create and manage;
• Deployment Metadata: Information about agent deployments, including environment configurations, versioning data, and deployment histories;
• Governance and Compliance Logs: Audit trails, policy enforcement records, approval workflows, and compliance reporting data;
• Observability and Performance Data: Agent performance metrics, latency measurements, error rates, usage statistics, and operational telemetry.

5.2 ModernZAI — Enterprise Technology Modernisation

ModernZAI assists enterprises with technology modernisation initiatives. Data processed includes:

• Legacy system assessment data and modernisation roadmaps;
• Code analysis metadata and transformation outputs;
• Migration planning data and progress tracking information;
• Integration configuration and testing data.

5.3 Customer Data Sovereignty

Customer data processed through our platforms on behalf of our clients remains under the customer’s control. We process such data solely as a data processor acting on the customer’s instructions, as governed by our Data Processing Agreements (DPAs) and applicable service agreements. Customers retain ownership of, and all rights to, their data at all times.

5.4 Third-Party AI Provider Integrations

Our platforms may integrate with third-party AI and large language model (LLM) providers, including but not limited to OpenAI, Anthropic, Amazon Web Services (AWS Bedrock), Google Cloud AI, and Microsoft Azure AI. Customers maintain control over which third-party providers are used within their environments. Data shared with third-party AI providers is governed by the respective provider’s terms of service and privacy policies, and Rensora ensures appropriate contractual safeguards are in place to protect customer data in these integrations.

6. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, analyse usage, and deliver relevant content. The types of cookies we use include:

6.1 Strictly Necessary Cookies

These cookies are essential for the operation of our websites and platforms. They enable core functionality such as security, session management, and accessibility. These cookies cannot be disabled without impairing the function of our services.

6.2 Functional Cookies

These cookies remember your preferences and settings (such as language, region, and display preferences) to provide a more personalised experience. They may also be used to provide enhanced features.

6.3 Performance and Analytics Cookies

We use analytics cookies, including Google Analytics (GA4), to collect aggregated information about how visitors interact with our websites. This data helps us understand traffic patterns, identify popular content, and improve site performance. Google Analytics may use cookies to collect information such as your IP address (which is anonymised), browser type, and pages visited. You can learn more about Google’s data practices at policies.google.com/privacy.

6.4 Targeting and Advertising Cookies

These cookies may be set through our site by advertising partners to build a profile of your interests and show you relevant advertisements on other sites. They work by uniquely identifying your browser and device.

6.5 Web Beacons and Pixels

We may use web beacons (also known as tracking pixels or clear GIFs) in our emails and on our websites to track engagement, measure the effectiveness of our communications, and understand user behaviour.

6.6 Managing Your Cookie Preferences

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies, though doing so may affect the functionality of our services. Where required by applicable law, we will obtain your consent before placing non-essential cookies on your device.

7. How We Share Information

We may share your personal information with the following categories of recipients:

7.1 Service Providers and Sub-Processors

We engage trusted third-party service providers who perform functions on our behalf, including cloud hosting and infrastructure, analytics, customer support tools, email delivery, payment processing, and security services. These providers are contractually bound to process personal data only on our instructions and in accordance with applicable data protection laws.

7.2 Business and Technology Partners

We may share information with business partners in connection with joint offerings, co-marketing activities, or integrated services, where you have consented to such sharing or where it is necessary for the performance of our services.

7.3 Legal and Regulatory Compliance

We may disclose your information where required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a law enforcement request.

7.4 Corporate Transactions

In the event of a merger, acquisition, reorganisation, bankruptcy, or other corporate transaction, your personal information may be transferred as part of the transaction. We will notify you of any such change in ownership or control of your personal information.

7.5 With Your Consent

We may share your information for other purposes with your explicit consent.

We do not sell your personal information. Rensora has never sold personal data and has no intention of doing so.

8. International Data Transfers

Rensora operates globally, and your personal information may be transferred to, stored in, and processed in countries other than the country in which you reside. These countries may have data protection laws that differ from those of your jurisdiction.

When we transfer personal data from the European Economic Area (EEA), the United Kingdom, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses to ensure that personal data transferred outside the EEA receives equivalent protection;
• Adequacy Decisions: Where applicable, we rely on adequacy decisions issued by the European Commission, the UK Secretary of State, or the Swiss Federal Data Protection and Information Commissioner;
• Additional Safeguards: Where required under GDPR Article 46, we implement supplementary technical and organisational measures to ensure the continued protection of your data, including encryption, pseudonymisation, and access controls.

For transfers from the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, as appropriate under the UK GDPR. For transfers from Switzerland, we implement safeguards in accordance with the Swiss Federal Act on Data Protection (Swiss DPA).

9. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

The specific retention periods depend on the nature and context of the data:

• Account and Service Data: Retained for the duration of your account or business relationship with us, and for a reasonable period thereafter to satisfy legal obligations and resolve disputes;
• Marketing and Communications Data: Retained until you withdraw consent or opt out of marketing communications, plus a suppression record to honour your preferences;
• Platform Logs and Analytics Data: Retained in accordance with our data management policies, typically for up to 24 months, unless a longer period is required for security, compliance, or legal purposes;
• Employment Application Data: Retained for the duration of the recruitment process and for a reasonable period thereafter (typically 12 months) unless you consent to longer retention for future opportunities;
• Legal and Compliance Records: Retained as required by applicable laws and regulatory frameworks.

When personal data is no longer required, we securely delete or anonymise it in accordance with our data disposal procedures.

10. Data Security

We take the security of your personal information seriously and implement industry-standard administrative, technical, and physical safeguards designed to protect your data against unauthorised access, alteration, disclosure, or destruction.

Our security measures include, but are not limited to:

• Encryption: All personal data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 encryption or equivalent;
• Access Controls: Role-based access controls (RBAC), multi-factor authentication (MFA), and the principle of least privilege are enforced across our systems;
• Infrastructure Security: Our platforms are hosted on enterprise-grade cloud infrastructure with comprehensive network security, intrusion detection, and DDoS protection;
• Monitoring and Logging: Continuous security monitoring, audit logging, and anomaly detection across our environments;
• Incident Response: A documented incident response plan that includes detection, containment, investigation, notification, and remediation procedures in accordance with applicable data breach notification laws;
• Personnel Security: Background checks, security awareness training, and confidentiality obligations for all employees and contractors with access to personal data;
• Vendor Security: Security assessments and contractual safeguards for all third-party service providers who process personal data on our behalf.

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

11. Your Privacy Rights

Regardless of your location, we respect your right to control your personal information. You may exercise the following rights by contacting us at [email protected]:

11.1 Universal Rights

• Right of Access: Request a copy of the personal data we hold about you;
• Right to Rectification: Request correction of inaccurate or incomplete personal data;
• Right to Erasure: Request deletion of your personal data, subject to legal retention obligations;
• Right to Data Portability: Request a machine-readable copy of your personal data for transfer to another service provider;
• Right to Opt Out: Unsubscribe from marketing communications at any time by using the unsubscribe link in our emails or contacting us directly.

We will respond to all legitimate requests within 30 days (or as required by applicable law) and will not discriminate against you for exercising your rights.

11.2 Rights Under the GDPR (EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR), the UK GDPR, or the Swiss Federal Act on Data Protection:

• Right to Restrict Processing: Request that we limit the processing of your personal data in certain circumstances;
• Right to Object: Object to the processing of your personal data where we rely on legitimate interests as a legal basis, including for direct marketing purposes;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal;
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority if you believe that our processing of your personal data violates applicable data protection laws.

Legal Bases for Processing: Where we act as a data controller, our legal bases for processing your personal data include:

• Performance of a Contract: Processing necessary for the performance of a contract with you or to take pre-contractual steps at your request;
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our services, marketing, fraud prevention, and security, where these interests are not overridden by your rights;
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent;
• Legal Obligation: Processing necessary for compliance with a legal obligation to which we are subject.

For GDPR-related enquiries, you may contact us at [email protected]. You also have the right to contact your local supervisory authority.

11.3 Rights Under the CCPA/CPRA (California)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of collection, the purposes for collection, and the categories of third parties with whom we share your information;
• Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions;
• Right to Correct: You may request that we correct inaccurate personal information;
• Right to Opt Out of Sale or Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising;
• Right to Limit Use of Sensitive Personal Information: Where applicable, you may request that we limit the use of your sensitive personal information to purposes authorised by the CCPA/CPRA;
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California privacy rights, please contact us at [email protected]. We may need to verify your identity before processing your request.

12. Children’s Privacy

Our services are designed for businesses and professionals and are not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16 years of age. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete such information promptly. If you believe we may have collected information from a child, please contact us at [email protected].

13. Third-Party Links

Our websites and platforms may contain links to third-party websites, services, or applications that are not owned or controlled by Rensora. This Privacy Policy does not apply to any third-party services, and we are not responsible for the privacy practices, content, or security of any third-party websites or services. We encourage you to review the privacy policies of any third-party services before providing them with your personal information.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this policy, we will notify you by:

• Posting the updated policy on our website with a revised “Last Updated” date;
• Sending a notification to the email address associated with your account (for platform users);
• Displaying a prominent notice on our website.

We encourage you to review this policy periodically to stay informed about how we protect your information. Your continued use of our services after the effective date of any changes constitutes your acceptance of the revised policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For GDPR-related enquiries or to exercise your data protection rights, please include “Privacy Request” in the subject line of your email. We aim to respond to all legitimate requests within 30 days.