Privacy Policy

Effective date: October 20, 2026

1. Introduction

This Privacy Policy describes how Render Forge LLC, a Washington limited liability company (“Render Forge”, “we”, “us” or “our”), collects, uses, discloses and protects personal information in connection with the Ossavi website at ossavi.com and the Ossavi application (together, the “Service”).

This Privacy Policy should be read together with our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

2. Our role

2.1 Customer Content. Each customer of the Service uses its own Studio. Personal information that a customer or its Users and Reviewers submit to a Studio, including images, comments, project records and information about collaborators (“Customer Content”), is generally controlled by that customer. For processing carried out on the customer’s behalf to provide the Service, Render Forge acts as a service provider or processor under the customer’s instructions, as described in the Terms of Service and, where applicable, the Data Processing Addendum.

2.2 Information we control. Render Forge acts as a controller when it determines the purposes and means of processing for its own business, including website access requests, subscription administration, customer support, and certain account, fraud-prevention and security records. The same user identifier or account event may be processed in different capacities depending on its purpose. For payment processing, Paddle acts separately as merchant of record and an independent controller as described in Section 6.2.

2.3 Requests concerning Customer Content. Individuals who wish to access, correct or delete personal information contained in Customer Content should contact the relevant customer. Where we receive such a request directly, we will refer it to the customer and assist the customer in responding.

3. Information we collect

3.1 Access requests. When you request access through our website, we collect your name, work email address, company or team name, team size and any message you choose to include.

3.2 Account information. For each user account, we collect the user’s name, email address, username, assigned permissions and sign-in times. Passwords are stored only as salted one-way hashes (scrypt) and cannot be retrieved by anyone, including Render Forge. Two-factor authentication secrets are stored encrypted, and recovery codes are stored as hashes.

3.3 Customer Content. We store the Customer Content that customers and their users submit, including images and their versions, previews generated from them, comments, markup, attachments, client feedback, color measurements, reference images and each studio’s activity log.

3.4 Review and share links. When a person opens a review or share link, we collect the name that person enters, the comments and responses they submit, and the number of times the link has been opened. Link passwords are stored only as hashes.

3.5 Security and technical information.

• Security log. Each studio maintains a record of sign-ins and account changes, including the IP address associated with each event. The retention period is set by the customer, with a minimum of 90 days and a default of one year.
• Server logs. Our servers may record an IP address, browser type, requested address, time and response status for requests. We use these records to operate, troubleshoot and protect the Service. Logs are rotated and deleted according to configured operational retention schedules; for the current retention period applicable to a particular type of log, contact support@ossavi.com.
• Abuse prevention. To limit repeated sign-in attempts and automated form submissions, we hold request counts per IP address in memory for a short period.

3.6 Email. When a user sends an invitation, password reset or review link by email through the Service, the recipient’s email address and the message are transmitted through our email service provider. Each customer controls the level of detail included in such messages.

3.7 Billing information. For subscriptions purchased through Paddle, Paddle acts as merchant of record and independently handles checkout, payment details, applicable taxes, invoices, billing disputes and refunds. Paddle shares with us information needed to provide your Plan, such as subscription status, transaction identifiers and billing contact information. We do not receive or store complete payment card numbers. Paddle handles personal information as an independent controller under its own privacy notice. For customers billed by us directly, we process the information needed to issue invoices and manage the account.

4. Cookies and similar technologies

We do not intentionally use advertising, analytics or cross-site tracking cookies on the Ossavi website or in the application. The Ossavi application uses cookies and local browser storage needed to operate the Service, including sign-in sessions, access to password-protected review or share links, and saved interface preferences. When you use Paddle checkout or related billing pages, Paddle may use its own cookies or similar technologies for checkout, payment security and fraud prevention under Paddle’s privacy notice. Any future addition of nonessential tracking will require an update to this Policy and any consent mechanism required by law.

5. How we use information

We use personal information to:

• provide, maintain, support and secure the Service, including detecting and preventing fraud, abuse and security incidents;
• respond to access requests and communicate with customers about their accounts, the Service and changes to it;
• administer billing and maintain records required by law; and
• comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, use it for advertising, or share it for cross-context behavioral advertising. We do not use Customer Content to train artificial intelligence or machine learning models.

6. Disclosure of information

6.1 Infrastructure and communications providers. We use the following providers to support the Service. They may process limited personal information in connection with the work they perform for us:

• Vultr (Constant Company, LLC): application hosting, with the primary application servers in Chicago, Illinois, United States.
• Proton AG: transactional email delivery and related communications, based in Switzerland.
• Backblaze, Inc.: off-site backup storage in the United States; backups are encrypted before transmission from our servers.

We require appropriate privacy and security protections from providers that process personal information on our behalf. The subprocessors relevant to customer-controlled data are also described in our Data Processing Addendum.

6.2 Paddle. Paddle is the independent merchant of record and an independent controller for purchases conducted through its checkout. We share or receive limited customer and transaction details needed to provide subscriptions, process purchase requests and support accounts. Paddle’s handling of checkout and payment information is described in Paddle’s privacy notice.

6.3 Other disclosures. We may disclose personal information where required by law or legal process; to protect the rights, property or safety of Render Forge, our customers or others; or in connection with a merger, acquisition, financing or sale of all or part of our business, in which case the information remains subject to this Privacy Policy.

7. International transfers

Ossavi’s primary application hosting is in the United States, and off-site backups are stored in the United States. Email delivery through Proton AG may involve processing in Switzerland or other locations used by that provider. Paddle independently determines where it processes checkout and payment data, as described in Paddle’s privacy notice. If you access the Service from another country, your information may be transferred across borders. Where international transfers require additional safeguards under applicable data-protection law, we will use an authorized transfer mechanism, such as applicable standard contractual clauses or another valid mechanism, before making a restricted transfer. Our Data Processing Addendum explains the additional arrangements that may be required for customer-controlled information.

8. Data retention

• Access requests are retained until resolved and thereafter only for as long as reasonably necessary for follow-up. We will delete an access request on request.
• Account information and Customer Content are retained while the customer’s Studio is active, and for the suspension and deletion period stated in Section 8 of the Terms of Service. A deleted comment may remain recoverable within the application for up to one hour; after that it is removed from the active application, but older backup copies may remain until their scheduled expiration. Deletion of a Studio from primary storage does not immediately erase historical disaster-recovery backups.
• Backups. Copies of deleted information remain in our backups until those backups expire. Backups of a studio that has ended expire within twelve months of the date on which the studio was suspended or closed.
• Logs are retained as described in Section 3.5.
• Billing records are retained for as long as required by applicable tax and accounting laws.

9. Security

We maintain technical and organizational measures designed to protect personal information, including encryption of data in transit, separation of each studio’s data into its own database schema and file storage, mandatory two-factor authentication for administrators, encrypted backups, and restriction of server administration to a private network. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting personal information, we will notify affected customers without undue delay and as required by law.

10. Your rights

10.1 General. Depending on where you reside, you may have the right to request access to the personal information we hold about you; to correct, update or delete it; to receive a copy of it in a portable format; to object to or restrict certain processing; and to withdraw consent where processing is based on consent.

10.2 European Economic Area and United Kingdom. Where the General Data Protection Regulation or the UK GDPR applies, we process personal information on the following legal bases: performance of a contract with you; our legitimate interests in operating, securing and improving the Service; compliance with legal obligations; and, where applicable, your consent. You may lodge a complaint with your local data protection authority.

10.3 California. California residents have the right to know what personal information we collect, use and disclose; to request deletion and correction of their personal information; and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes that require a right to limit.

10.4 Exercising your rights. To submit a request, contact us at support@ossavi.com. We may need to verify your identity before responding. We will respond within the deadline required by applicable law, including the ordinary one-month deadline where the EU or UK GDPR applies; lawful extensions may be available in appropriate circumstances, and we will explain any extension when required. Requests concerning customer-controlled Content will be handled as described in Section 2.3.

11. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from individuals under the age of 16. If we learn that we have collected such information, we will delete it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will revise the effective date above when we do so, and we will notify studio owners of material changes by email or through the Service before they take effect.

13. Contact

Questions about this Privacy Policy or our privacy practices may be directed to:

Render Forge LLC
Washington, United States
support@ossavi.com