Privacy Policy — Render

Version v1.27-render — effective from 6 November 2026

1. The promise, before the detail

We only pass your details to another business for its own use if you agree first. Each time, we tell you which business, which details, and whether we are paid, and you can withdraw your agreement at any time.

We may show optional offers from partner businesses, and sponsored messages. No advertiser or sponsor receives your details or tracks you on our website unless you agree to it. Apart from a business you have agreed to, the only companies that touch your data are the suppliers in section 6, who run parts of the service on our instructions and may not use it for anything else, plus HMRC and Companies House, who are the whole point of filing.

We may publish or share statistics that combine many filings, such as typical figures for a kind of company. They never identify you or your company.

We decide which offers to show from your company's public Companies House profile. We use figures from your return to choose offers only with your separate permission, which accepting our terms does not give and which you can withdraw at any time.

2. Who we are

Render at render.my is operated by Render Technologies Ltd ("we", "us"), company number 17088258, which is the data controller for the personal data described below. Contact: privacy@render.my. Render Technologies Ltd is registered with the Information Commissioner's Office (registration number ZC285630).

If we move your account or access to your filing records to another Render Technologies Ltd service or domain, Render Technologies Ltd remains responsible for the personal data described in this policy.

3. What we collect

• Account data — your email address, display name, and authentication identifier (via Clerk).
• Company data — the Companies House number or numbers you add to your account.
• Director declaration — the name you picked or typed when you added a company, and when.
• Filing data — the CT600 form fields you complete, the assembled iXBRL accounts and iXBRL computation, the GovTalk envelope we send to HMRC, and HMRC's response (the IRmark when accepted, the error detail when rejected).
• Companies House send data — if you send your accounts to Companies House from your account page, we keep a record of that send: the submission number and transaction reference, the timestamp Companies House gave it, a fingerprint of the accounts document sent, and anything Companies House said in reply. The record deliberately holds no user identifier and no authentication code.
• Payment evidence — the Stripe provider reference, amount, currency, and the authorisation, capture, cancellation, and failure statuses, plus the webhook event ids behind them.
• Provenance metadata — which version of our pinned source material was in effect at the moment your filing was submitted, so the filing can be reconstructed years later byte-for-byte.
• Filing reminders — if you ask us to email you when there is something to file, your email address, the company number, and a record of when you agreed and to which words. We use them only to send those emails, and stop when you open the unsubscribe link in any of them or delete your account.
• Lookup and attempt records — the Companies House company numbers you look up, and a short note of any attempt to prepare a filing that we had to refuse, with the reason. We use them to limit misuse and to fix faults.
• Operational records — server request logs, and our own record of how the form was used while you were signed in (see section 7): which questions you answered, where something went wrong, any save that failed and anything that stopped you filing. Our own server writes this record; nothing is stored on your device for it.

4. What we do not collect

• We do not store card numbers, CVCs, or sensitive payment-method details. Stripe handles card entry and payment-method processing.
• We do not hold per-user HMRC Gateway credentials in our database. Transmission to HMRC uses Render Technologies Ltd's own vendor credentials.
• We do not store your company's own six-character Companies House authentication code. You type it for a single send to Companies House; it is passed straight through, and is never written to our database, our logs, your data export, or any analytics event.
• We do not put exact tax-form values, UTRs, raw CT600 XML, iXBRL files, GovTalk envelopes, HMRC payload bodies, or payment details into analytics or session replay. Exact filing values remain in Render's own systems and in the submitted filing record.

5. Why we hold it — lawful bases

Under UK GDPR Article 6 we rely on:

• Article 6(1)(b) — performance of a contract — to hold your account, your drafts, your submitted filings, and the payment evidence needed to provide the paid filing service, so you can come back and see what you filed, and so a filing and its charge can be proved afterwards.
• Article 6(1)(a) — consent — for marketing emails, if we later ask you to opt in separately, for using figures from your return to choose offers, if you give that permission, for passing your details to another business you agree to, and for analytics if you agree to it (section 8). Accepting the terms does not consent you to any of them.
• Article 6(1)(f) — legitimate interests — for keeping the service secure and stopping misuse (for example, limiting repeated company lookups and how many companies one account can add in a day), for finding and fixing faults (error reports, section 6); for our own record of how the form is used (section 7); for counting, as daily totals, where our visitors come from (section 8); for checking filings before and after they are sent, helping you if you get stuck, and making Render better; and, for those purposes, for our team to review your filing's record, our logs and your emails to us with the help of an AI assistant (Claude, from Anthropic — section 6). These interests are ours and yours: a filing that is right, a fault that gets fixed, and a service that is safe. We keep this to what the purpose needs, and you can object at any time by writing to privacy@render.my (section 11). We have written down our reasoning.

We do not rely on Article 6(1)(c), legal obligation. We are a software supplier. Your company is required to keep its own accounting records (Companies Act 2006, section 386) and the records it needs for its tax returns (Finance Act 1998, Schedule 18, paragraph 21).

After you delete your account our contract with you has ended, so we keep the evidence of what was sent under Article 6(1)(f), legitimate interests: so that a filing can still be proved if HMRC, Companies House, you or we ever need it, including if there is a legal claim.

6. Who we share it with

• HMRC — your CT600, iXBRL accounts, and iXBRL computation are transmitted to HMRC, to whom the company delivers its Company Tax Return.
• Companies House — two separate connections, and only the first happens automatically.
• Looking things up. We query Companies House's public Data API to fill in your company's name, registered office, and last-filed accounts, and to list its directors. This gives Companies House only the company number and the officer-list request.
• Sending. If you choose to send your accounts to Companies House from your account page, we transmit the micro-entity accounts document, your company's name and number, the date the accounts were approved, and the company's own authentication code to the Companies House filing gateway. Those sends currently reach Companies House's test service only, so nothing sent through the service today reaches the public register, and you must still file your accounts with Companies House yourself. We will publish a new version of this policy before that changes.
• Stripe — payment authorisation, capture, cancellation, and payment-status webhooks.
• Clerk — authentication. Your sign-in credentials are managed by Clerk; we hold only Clerk's opaque user id.
• Neon — Postgres database hosting. Your filing records are stored in London, with provider-managed encryption at rest.
• Resend — transactional email: account-lifecycle emails and accepted-filing receipts.
• Sentry — error monitoring. Production errors may be sent to Sentry with the request context needed to diagnose the fault. We strip tax form contents, iXBRL bodies, HMRC response bodies, full filing documents, cookies, and authorisation headers before an event is sent. Our reports are held in Sentry's EU region.
• PostHog (PostHog Inc., a US company; data held in PostHog's EU region) — product analytics and session recording, each only if you agree to it (section 8).
• Google Ads (Google Ireland Limited) — only if you agree to advertising (section 8). When your fee is taken, Google's tag sends Google the amount, a payment reference, the page address (without anything after a question mark), your IP address and browser details, and the id of any Google advert you clicked, so that Google can work out whether you came from one of our adverts. We never send it your name, email address, company or tax details.
• Anthropic (Claude) — we use Claude, an AI assistant made by Anthropic, a US company, to help us check filings, fix faults, help customers who are stuck, and improve Render. To do that, Claude may read a filing's full record: the company's name and number, the figures you entered, the documents we prepared and sent, the history of your form, any errors or blockers, any feedback you wrote to us while signed in, and earlier accounts of the company that are public at Companies House. If you agreed to analytics or session recording (section 8), Claude may also read what PostHog recorded of your visits from 3 November 2026 onwards, such as the pages you used, where you stopped and recordings of how you moved through our pages, to help us find where people get stuck. It may also read our own record of how the form is used and our monitoring records (section 7), our website's request logs, our error reports, our records of the emails we sent you, and any email you send us, with anything you attach, such as a screenshot. It does not see your card details, which only Stripe holds. Claude looks automatically when a filing reaches a key step (such as being approved or sent) or hits trouble (such as a refused or failed send), and tells our team when it finds a problem. Our team also asks Claude to look when you contact us or when something has gone wrong. Claude does not decide anything about you or your company on its own: a person on our team reviews what it finds, and a person approves any email we send you. We use Claude through a personal Anthropic plan, so Anthropic does not act as our data processor under a contract; model training is switched off and Anthropic keeps the data for 30 days and then deletes it. We never use this for advertising. You can object by writing to privacy@render.my (section 11); we then stop Claude reviewing your company's records.
• GitHub — holds our fault reports, which are written without your filing values.
• Cloudflare and Apple (iCloud Mail) — email. Emails you send to our support, privacy, security and complaints addresses reach our team mailbox, which Apple hosts. Cloudflare also runs our domain name records.
• Vercel — hosting. The application runs on Vercel's platform, which necessarily handles the requests you make to it.

Those are the companies that handle your data on our behalf. Each acts on our instructions and may not use your data for its own purposes. If we add one, we will publish a new version of this policy.

A business you agree to is different: it receives only the details we list before you confirm, and only once you have confirmed. From then on it holds them under its own privacy notice, which we link to when we ask you.

7. The interaction journal

While you are signed in, our own server keeps a journal of how the form was used, so we can see where the filing journey breaks, spot a save that failed or a step that stopped you, and help you. It uses no cookies and puts nothing on your device. Our lawful basis is legitimate interests, and you can object (section 11). It records structured facts — which field changed, whether it was empty, roughly how long the value was, the validation state, checkbox and gate answers, save status, and what blocked a review or a submission. It does not record the raw value of a sensitive field; it records exact values only for checkboxes, gate options, and support preferences, which are safe to keep as typed.

The journal is kept only for signed-in accounts and is linked to your account, so it is deleted when you delete your account (section 9). We keep it for 24 months and then delete it (section 9). If you want it deleted sooner, write to privacy@render.my and we will delete it.

We also keep monitoring records: when you work through a filing while signed in, an automatic check looks at whether that session went through properly, and we keep a short record of it — which filing and company it was for, whether the check passed, and what it found — so that we can find and fix faults. Our lawful basis is legitimate interests, and you can object (section 11). Monitoring records are linked to your account, deleted when you delete your account, and otherwise kept for 24 months.

8. Cookies and analytics

We use cookies that are strictly necessary to sign you in and keep you signed in, and the strictly necessary Stripe cookies or redirects that a card payment needs.

Where visitors come from, without cookies. For every visit, without cookies and without storing anything on your device, we count which website sent you to us (its name only, such as google.com), the first page you opened, the campaign name in the link you followed if it had one, and the type of device (phone, tablet or computer). We keep these only as daily totals. We do not keep the address of the page you came from, your IP address, or anything else that identifies you. Our lawful basis is legitimate interests: knowing how people find us. We keep these totals for 24 months.

Analytics, only if you agree. The first time you visit we ask whether you agree to analytics. If you say no, or do not answer, nothing is sent to PostHog and PostHog sets nothing in your browser. Accepting the terms does not count as agreeing.

If you agree, PostHog records which pages and parts of the form you use and where you stop: which answer changed and whether it was filled in, never what you typed. We send PostHog the registration number of the company you look up, which is public on the Companies House register, so that we can group what happens on a visit by company; we do not send it the company's name. Once you sign in we link this to your account by an internal account number, not your name or email, so we can help if you get stuck. We use this only to find where the form is hard to use and to help you. Claude, our AI assistant (section 6), may read these records for the same purposes. Our lawful basis is your consent. We keep analytics for 12 months. PostHog is PostHog Inc., a US company; your data is held in PostHog's EU region.

Before you choose, we put nothing on your device except what the form and sign-in strictly need, all listed on our Cookies page. Our own random visit number, which our interaction journal uses to group one visit, is held in the page's memory only until you agree to analytics, and is stored on your device only after you agree.

We keep one cookie of our own, render_analytics_consent, for up to 180 days to remember your choice. You can change it at any time on our Cookies page; turning analytics off stops PostHog and removes its cookies and browser storage from this site.

Session recording, only if you agree. We may also ask whether you agree to us recording your visit. This is a separate choice from analytics, and you can say yes to analytics and no to recording. A recording is a replay of how you moved through our pages: where you clicked, scrolled and paused. It is how we find the parts of the form that confuse people. Claude, our AI assistant (section 6), may watch these recordings for the same purpose. In a recording our own words, such as headings and questions, can be seen. We hide what you type and the company and tax details we show you, such as figures, names, dates and tax references, and any other text on the page is hidden by default unless we have marked it as our own wording. Your Companies House authentication code, Government Gateway login, sign-in details and card details are blocked out completely. We do not record what your browser sends to us or receives from us, and we take reference numbers out of the page addresses a recording holds. If you agree to analytics we also note, without any of your text: clicks, including repeated clicks and clicks that do nothing; where on a page people click (a heatmap); how fast pages load; and errors in our pages, by type and place in our code, never their message. If you say no, or do not answer, nothing is recorded, and you get exactly the same service. Our lawful basis is your consent. PostHog keeps recordings for 30 days and then deletes them. You can stop recording at any time on our Cookies page.

If you ask us for help using the "Optional: record this page from now on, so we can see the problem if it happens again" box, that turns on the same recording, so we can watch where you got stuck. It is the same choice and you can turn it off the same way.

Advertising, only if you agree. If you agree, Google Ads sets cookies whose names begin with _gcl_ to tell us whether a payment came from one of our adverts. They are off unless you agree, and you can turn them off at any time on our Cookies page. We use no other advertising or marketing cookies.

9. How long we keep it

| What we keep | How long | | --- | --- | | Your account, your drafts and your filing records | While you have an account with us; deleted when you delete your account, apart from the filed evidence below | | The evidence of what was sent to HMRC and Companies House | Kept after you delete your account, no longer connected to it, for at least seven years from the day it was sent, so a filing can still be proved. We then review it and delete what we no longer need | | Our record of how the form was used (section 7) | 24 months, then deleted; sooner if you delete your account | | Our monitoring records (section 7) | 24 months, then deleted; sooner if you delete your account | | Daily totals of where visitors came from (section 8) | 24 months, then deleted | | Analytics events at PostHog, if you agreed to them | 12 months; deleted sooner if you delete your account | | Session recordings at PostHog, if you agreed to them | 30 days | | Error reports at Sentry | 30 days | | Our website's request logs at Vercel | About 1 hour | | Anything Claude reads for a review, at Anthropic | 30 days | | Claude's working notes from those reviews, on our team's own computer | 24 months, then deleted | | The cookie that remembers your analytics choice | 180 days |

We chose 24 months for our own records so that we can compare how the form worked for a company across two filing years, and help you with a correction or with next year's return.

You can hide any filing or draft from your account list at any time. Hiding never removes anything and you can bring it back. For at least those seven years, a filing that has been submitted cannot be deleted, by you or by us, because it is the record of what was sent to HMRC.

To remove the figures you entered, delete your account from your /account page. When you do, we:

1. Email you a link to confirm the deletion. Nothing is deleted unless you open that link and confirm. The same email has a link to cancel the request. If you do not confirm within seven days, the request lapses and we keep your account.
2. Include in that email a signed link to download an export of your data: your account profile, and per company a folder holding the CT600 XML, the iXBRL accounts, the iXBRL computation, the GovTalk envelope, and HMRC's response. The export covers the HMRC side of a filing; the record of a Companies House send is not in it yet, and you can ask us for it at privacy@render.my.
3. On confirmation, delete your login, your account, your company memberships, your feedback messages, your interaction journal, your monitoring records, your analytics history at PostHog, and your record of Companies House lookups, and unlink the filings you submitted so they are no longer connected to you. Your drafts are deleted with them, unless someone else still has that company on their account with us — in which case that company's drafts stay with them.
4. Keep the evidence of what was sent and what was charged: the generated CT600 XML, the iXBRL accounts and computation, the GovTalk envelope, the IRmark, timestamps, HMRC's response, any Companies House send evidence, payment evidence, and the provenance metadata. It is no longer connected to your account, and we keep it so a filing and its charge can still be proved if HMRC, Companies House, your card provider, or you ever need it. We cannot edit those documents: a filed return names its company and the person who made its declaration, and altering the bytes would destroy the only proof of what was sent, so those names stay in the retained evidence.
5. Email you again to confirm the deletion is done.

A few small records are not tied to your account in a way we can follow, so deleting your account does not remove them. We would rather say so than hide it:

• the short notes of attempts to prepare a filing that we had to refuse, with the reason. They are kept with the filing and no longer name your account;
• a temporary copy of our reply when you send a filing, kept for 24 hours so that pressing the button twice does not file twice. It expires after 24 hours, but nothing removes it automatically yet, so it can stay longer; and
• copies held by our suppliers for the periods in the table above, such as error reports at Sentry (which identify you, if at all, only by our internal account number, never your email), recordings at PostHog if you agreed to them, and emails sent through Resend under Resend's own rules.

If you want any of these deleted sooner, write to privacy@render.my and we will do what we can.

10. Where your data goes outside the UK

Some of our suppliers are US companies, or can reach your data from outside the UK. UK law lets that happen only if your data stays protected. Here is where it goes:

• Stored in the UK or EU. Our website runs on Vercel's servers in London, and your filing records are stored in London (Neon). Error reports are held in Sentry's EU region, and analytics and recordings, if you agree to them, in PostHog's EU region. Vercel, Neon, Sentry and PostHog are US companies, so their staff in the US may be able to reach that data to run their services.
• Handled in the United States. Sign-in (Clerk), email sending (Resend), card payments (Stripe) and Anthropic, whose Claude looks at a filing's record, our logs, your emails to us, and analytics you agreed to, as section 6 explains, are US companies and may handle your data in the United States. Cloudflare and Apple run global networks, so email to us can pass through several countries.

For each of these except Anthropic we rely on one of the UK's approved safeguards: the supplier is certified under the UK–US data bridge, or its data processing terms include the UK International Data Transfer Addendum or the UK's International Data Transfer Agreement. We use Claude through a personal Anthropic plan, so we have no data processing terms with Anthropic and rely on Anthropic's own published terms; model training is switched off and Anthropic keeps the data for 30 days. You can ask us about this at privacy@render.my. Sending data to the EU needs no extra step, because UK rules already treat the EU as adequate. HMRC and Companies House are in the UK. You can ask us which safeguard we rely on for any supplier by writing to privacy@render.my.

11. Your rights

Under UK GDPR you have the right to ask us to:

• give you access to your data — through your /account page, or by writing to privacy@render.my
• correct inaccurate data — change it in the form, or contact us
• erase your data — use "Delete my account" on /account, or write to us. We keep the evidence of what was sent for the time set out in section 9, because the law lets us keep what we need to bring or defend a legal claim (UK GDPR Article 17(3)(e))
• restrict processing, or give you the data you gave us in a machine-readable form — contact us

You also have the right to object to processing — contact us. We answer rights requests within one month.

You have the right to complain to us, by writing to privacy@render.my, if you consider that how we handle your personal data infringes the UK GDPR.

If you consider that how we handle your personal data infringes the UK GDPR, you can complain to the Information Commissioner (ico.org.uk).

12. Changes to this policy

We publish a new version here when we make a material change, and the version number above moves each time.

13. Contact

Render Technologies Ltd
Company number: 17088258
Registered office: 39 Islingword Road, Brighton, BN2 9SF
privacy@render.my

Complaints about privacy can be sent to privacy@render.my. You also have the right to complain to the Information Commissioner if you consider that our handling of your personal data infringes the UK GDPR.