v0.1 — review pending

Privacy Policy

Last updated: 2026-07-24

1. Who we are

rendfly is operated by DFMENDES TECNOLOGIA LTDA (CNPJ 66.624.968/0001-05), based in São Paulo, Brazil. You can reach us at [email protected].

2. What we collect

To provide production-time monitoring for your AI agents, we collect:

  • Account data - email, password (Argon2id-hashed), workspace identifiers.
  • Execution telemetry (spans) - one record per LLM call, tool call or retrieval step your agent makes: model, token counts, latency, dollar cost, status and errors. Traffic routed through our proxy is captured as metadata only - we do not store your prompts or your agent's replies.
  • Span attributes you export - if you instrument your app yourself (Python SDK or any OTLP exporter), your spans carry whatever attributes you choose to send us, which may include message content. Personally identifiable information (PII) detected in them is redacted before storage.
  • Provider credentials - the API key of the LLM provider you connect, used for one purpose: forwarding your own requests to that provider (encrypted at rest with AES-256-GCM).
  • Operational telemetry - usage metrics, error logs, and audit events.

3. Why we collect it

We use this data to deliver the monitoring service, debug issues you report, secure the platform against abuse, and (in aggregate, never per-customer) improve detection quality. We do not sell your data, and we do not use your telemetry to train models - ours or anyone else's.

4. Where it's stored

Primary storage: PostgreSQL with row-level security scoped to your workspace, spans partitioned by month. High-volume span storage: ClickHouse (planned). Sensitive fields - provider keys - are encrypted at rest with AES-256-GCM. All traffic is TLS 1.3.

5. Retention

  • Span telemetry (PII redacted): 30 days, then dropped with its monthly partition.
  • Aggregated metrics and audit log: 12 months.
  • Account data: kept while your account is active; deleted within 30 days of account closure unless legal obligations require retention.

6. Your rights

Under Brazilian LGPD (Law 13.709/2018) and EU GDPR, you have the right to access, correct, delete, or port your data, and to object to or withdraw consent for specific processing. To exercise any of these rights, email [email protected]. We respond within 15 days.

7. Changes to this policy

We will notify customers by email of any material change at least 30 days before it takes effect. Past versions are available on request.