Privacy Policy
Last updated: June 25, 2026
Copperline Labs LLC (“we,” “our,” or “us”) operates the Rendex screenshot and rendering API. This Privacy Policy explains how we collect, use, and protect your information when you use rendex.dev and api.rendex.dev (the “Service”).
1. Information We Collect
Account Information
When you create an account, we collect your email address for account management and service notifications.
Payment Information
Payment processing is handled by Stripe. We do not store credit card numbers or bank account details on our servers. Stripe collects and processes your payment information under their privacy policy.
API Request Metadata
For each API call, we log the following metadata for billing accuracy, debugging, and abuse prevention:
- Target URL or hostname being captured (sensitive query parameters such as tokens, keys, and passwords are redacted before storage)
- Request timestamp, HTTP method, response status code, and latency
- Output requested (PNG, JPEG, WebP, PDF, or extracted Markdown/JSON/HTML)
- Approximate country derived from your IP address — we do not store the raw IP address itself
- Cloudflare edge location (“colo”) that served your request, for latency diagnostics
- Network provider (ASN organization name) for abuse investigation
- User-Agent header and Referer header, if sent by your client
For asynchronous jobs, we additionally store the capture parameters you submitted so the background worker can process them. User-supplied request headers, cookies, and webhook URLs are redacted at the edge before being persisted — we do not retain third-party credentials you pass to render authenticated pages.
Generated Content (Renders)
Standard synchronous renders are generated on our edge infrastructure, returned directly to you in the API response, and not stored — processing is transient. However, when you choose hosted output (hosted: true or /v1/render/link), asynchronous jobs, or batch, the rendered output is stored in our object storage (Cloudflare R2) and served through expiring, signed URLs for the cache lifetime you specify (default 24 hours, minimum 1 hour, maximum 30 days). When a link expires the output is no longer accessible, and the stored object is automatically deleted by our storage lifecycle policy within 30 days of creation. If you configure your own S3-compatible storage, output is written to your bucket and governed by your own retention and privacy policies.
Public Free Tools (No Account)
The free tools at rendex.dev/tools can be used without an account. For rate limiting and abuse prevention only, when you use them we may process a one-way hash of your IP address, your approximate country, and the input you submit (a URL or the HTML you paste). We do not store your raw IP address, and we do not use this data for advertising or sell it.
MCP Connector & OAuth Connections
When you connect Rendex to an AI client (such as ChatGPT or Claude) through our remote MCP server at mcp.rendex.dev, you authorize the connection using OAuth 2.1 (authorization code with PKCE). You sign in with your Rendex account email, and we issue a managed API key bound to your account that the connector uses to make render requests on your behalf. The OAuth authorization grant and that managed key are stored encrypted (AES-256-GCM) on our infrastructure (Cloudflare). Content you ask the AI client to render — a URL, HTML, or Markdown — is sent to our API and processed under the same terms, sub-processors, and retention described in “API Request Metadata” and “Generated Content (Renders)” above. Renders requested through the connector run under your account and draw down your plan’s credits. You can revoke a connection at any time from the rendex.dev dashboard, which immediately invalidates the managed key.
2. How We Use Your Information
- Service provision— Processing API requests and delivering screenshots
- Billing— Tracking API usage for accurate invoicing and plan-cap enforcement
- Abuse prevention— Detecting and preventing misuse of the Service
- Service improvement— Analyzing anonymized usage patterns to improve reliability and performance
- Customer support— Responding to your requests and debugging issues
- Legal compliance— Meeting legal obligations and responding to lawful requests
3. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | While account is active, deleted within 30 days of closure |
| API request metadata (detail fields) | 90 days — target URL, user-agent, referer, country, and ASN are automatically scrubbed after the retention window; call counts and status codes are retained for billing audit |
| Async job parameters | 90 days — redacted capture params are nulled out after the retention window |
| Generated output (synchronous) | Not retained — transient processing only |
| Hosted / async / batch output (stored in R2) | Accessible for the cache lifetime you set (default 24 hours, max 30 days); the stored object is deleted by our R2 lifecycle policy within 30 days of creation |
| Payment data | Per Stripe’s retention policy |
4. Data Sharing and Sub-Processors
We do not sell, rent, or trade your personal information. We share data only with the following service providers, and only as necessary to operate the Service:
| Provider | Purpose | Data Shared |
|---|---|---|
| Cloud Infrastructure Provider | Edge compute, content delivery, browser rendering | API requests, IP addresses |
| Payment Processor | Payment processing, subscription billing | Email, payment information |
| API Key Management Service | Key verification, rate limiting | API key hashes, usage counts |
| Database Service | Account storage, usage logging | Account data, usage records |
| URL Threat Intelligence (Google Safe Browsing) | Malware/phishing screening before rendering | Target URLs |
| Geo-Targeting Proxy | Country-specific rendering (Pro/Enterprise geo-targeting only) | Target URL, page traffic |
| Email Provider | Transactional and account email | Email address |
We may also share data when required by law, such as in response to a valid subpoena or court order.
If you are a business customer who requires a Data Processing Addendum (DPA) under the GDPR, UK GDPR, or similar laws, we will execute our standard DPA on request — contact legal@rendex.dev.
5. Data Security
We implement industry-standard security measures to protect your data:
- All data in transit is encrypted via TLS
- API keys are hashed and verified at the edge with sub-millisecond latency
- Database access is restricted with row-level security policies
- Infrastructure runs on a globally distributed edge network across 300+ locations
No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously work to protect your data.
6. Your Rights
We honor data subject rights granted under the laws that apply to you, including (but not limited to) the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and analogous US state laws in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah, and others.
Depending on where you live, those rights typically include:
- Access / Know— Request a copy of the personal data we hold about you and information about how it is processed
- Correction / Rectification— Request correction of inaccurate or incomplete data
- Deletion / Erasure— Request deletion of your personal data and account
- Portability— Request your data in a machine-readable portable format
- Object / Restrict— Object to or restrict certain processing activities
- Opt-out of “sale” or “sharing” — We do not sell or share personal information as defined by CCPA/CPRA, so there is nothing to opt out of, but this disclosure is provided for transparency
- Non-discrimination— We will not deny service, charge different prices, or provide a different level of service for exercising any of these rights
To exercise any of these rights, contact us at legal@rendex.dev from the email address associated with your account. We will respond within 30 days (or 45 days for CCPA requests). If you are in the EU/UK and believe we have handled your personal data improperly, you also have the right to lodge a complaint with your local data protection supervisory authority.
7. International Data Transfers
The Service runs on Cloudflare’s global edge network. Your API requests are processed at the nearest edge location, which may be in a different jurisdiction than your own. Our sub-processors (listed above) may also process data in various jurisdictions.
8. Children’s Privacy
The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly.
9. Cookies and Local Storage
The rendex.dev website uses minimal browser storage:
- Theme preference— Stored in localStorage (not a cookie) to remember your light/dark mode choice
- We do not use third-party tracking cookies or advertising pixels on rendex.dev
The API (api.rendex.dev) does not use cookies. Authentication is handled via API keys or, for MCP connector sessions, an OAuth-issued managed key (see “MCP Connector & OAuth Connections” above).
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
11. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at:
Copperline Labs LLC
Sheridan, Wyoming, United States
legal@rendex.dev