LEGAL INFORMATION · 23 SEPTEMBER 2026

Privacy

1. Controller

RSites GmbH, Am Herrnberg 5, 93158 Teublitz, Germany, represented by Simon Röhrl, is responsible for website, account and billing data. For privacy enquiries, contact [email protected] or use the contact form.

2. Hosting

Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, hosts the website and runs our account, API and billing functions, including storage of account records. Requests involve technical data such as IP addresses, request URLs, timestamps and browser information, which are processed to deliver, secure and troubleshoot the service. The legal basis is our legitimate interest in secure service operation under Article 6(1)(f) GDPR. Cloudflare may process data outside the EU and EEA; see its privacy policy and data processing terms.

3. Checkout and payments

Stripe operates checkout, invoicing and payment collection on our behalf. It processes payment, billing and transaction details, including business name and VAT identification number, which is checked against the European Commission’s VIES system. For customers outside the Americas, the responsible Stripe entity is Stripe Payments Europe, Limited, Ireland. We receive customer and subscription references, subscription status and billing details; card details stay with Stripe.

The legal bases are performance of the contract under Article 6(1)(b) GDPR, our accounting and tax obligations under Article 6(1)(c) GDPR and, for representatives of business customers, our legitimate interest in administering the service under Article 6(1)(f) GDPR. Stripe transfers data to Stripe, LLC in the USA under the EU-US Data Privacy Framework or, where it does not apply, standard contractual clauses. See Stripe’s privacy policy and data transfers addendum.

4. Account, sign-in and cookies

We store your account email address, customer and subscription references, subscription status and your access token to provide and secure your account, including your usage overview. For a free trial we store the email address, the frames it covers and its start date. Sign-in codes are sent by email. We are notified by email when a trial starts.

The website sets one strictly necessary cookie, bf_session, which keeps you signed in to your account. It is set after checkout or sign-in and expires after 30 days. We use no analytics, advertising or tracking cookies.

5. Rendering

Renders run on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its Falkenstein data centre. To render, the servers receive your render requests, compositions with their assets, and input properties. Compositions are processed as code. We render, cache and analyse them, including their structure and contents, to provide the service, to give you insights into your own renders, to secure the service, and to improve its rendering performance and compatibility. We use input properties to perform and cache your renders and to give you insights into your own renders. Rendered output is returned to your own AWS setup and is not stored by us.

We keep this data as follows:

• Compositions and their assets: kept without a fixed deletion period for as long as they are needed for these purposes, then deleted.
• Input properties: deleted 30 days after their last use.
• Render requests, render records and logs, and server access logs: deleted 30 days after the render.
• Usage data and insights into your renders: kept for the life of your account, and billing data for statutory periods where the law requires.

Render records and logs help us investigate and reproduce problems; usage data such as billed frames, timings and outcomes is also held with Cloudflare (section 2). Insights into your renders are part of the service under Article 6(1)(b) GDPR. For logs, records and render metadata, the legal basis is our legitimate interest in secure and efficient service operation under Article 6(1)(f) GDPR. We do not use your content for advertising or profiling.

You decide what content you submit. Pass personal data through input properties, not compositions. Where content contains personal data, we process it on your behalf and on your instructions. A data processing agreement is available on request.

6. Support and retention

When you contact us, including through the contact form, we use the details you provide to respond and administer the service. Our email runs on Google Workspace, provided by Google Cloud EMEA Limited, Ireland, which may transfer data to Google LLC in the USA under standard contractual clauses; see Google’s privacy policy and data processing terms. Account and operational data are kept while needed for the service, security and resolving enquiries or disputes, and then deleted or anonymized. Billing and business records are kept for the statutory retention periods. Rendering data follows section 5.

7. Your rights

Subject to the GDPR, you may request access, correction, erasure, restriction and portability. Where processing is based on consent, you may withdraw it for the future. You may object to processing based on legitimate interests on grounds relating to your particular situation.

Contact [email protected] to exercise your rights. You may complain to a supervisory authority, including the Bavarian State Office for Data Protection Supervision. We make no automated decisions with legal or similarly significant effects. Account and billing information is needed to enter and perform the contract; browsing the website requires no account.