BlitzRender Privacy Notice
Version 2026-10-28. Supersedes 2026-10-27. What changed:
- a referral code is now kept only by the app, never by the public pages: following a creator's link stores nothing until you reach the app (§3);
- when the law requires it — content suggesting a crime that threatens somebody's life or safety, or a court order — we give what we hold to the police, the courts or the authority that asks (§6).
This says what BlitzRender holds about you, why, how long, and what you can ask us to do about it. It is written from an inventory of what the system actually stores rather than from a template, and it is deliberately specific about the places we cannot erase things, because a notice that is silent about those is worse than none.
Who holds it. Noelia Caba Martín, sole trader, trading as BlitzRender, of Plaza del Sol 4, 18620 Alhendín, Granada, Spain, tax identification number (NIF) 77767859Y, is the controller of everything described here. Contact us at support@blitzrender.com. If you think we have handled your data wrongly, you may complain to the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, aepd.es — no representative is appointed, because we are established in Spain.
1. If you are a customer
| what | why we hold it | how long |
|---|---|---|
| Your email address — the one you gave us, or the verified address your GitHub or Google account reports when you first sign in with it | it identifies your account, it is how we reach you about work you have paid for, and it is where a cryptocurrency payment provider sends your receipt | for the life of the account; see §4 |
| A sign-in identity — which provider you signed in with (GitHub or Google) and the permanent account number that provider gives you | so that signing in with that account reaches your BlitzRender account and nobody else's | for the life of the account; it is never moved to another account — see §4 |
| Your country, and if you are in Ukraine whether you are in one of the regions our terms name | to refuse service where sanctions require it, and to charge the tax of the place you are in | for the life of the account |
| Sign-in sessions and API credentials — only a one-way hash of each, never the token itself, with when it was issued, last used, and ended | so that what you sign in with works, and so that you and we can end it | a sign-in session ends after 24 hours, or 14 days if you ask to stay signed in, or when you sign out; its record is removed 30 days after it ends. An API token lasts until it is revoked |
| Payment records — amount, rail, our order reference, the timestamp, and for a cryptocurrency payment what the payment provider reports actually arrived | to take payment, to reconcile against the payment provider's own statement, to credit what arrived when it differs from what was asked, to answer disputes, and to send a refund back to the instrument it came from and nowhere else | six years from the end of the year it is recorded in, as Spanish commercial and tax law require — see §5 |
| A payer reference — the payment provider's identifier for your PayPal account, or the public address of the wallet you paid from when you pay in cryptocurrency | to tell whether two accounts pay from the same instrument: that is how we stop people paying themselves referral commission, and how we limit the free scene previews accounts paying from one instrument can use between them | with the payment record |
| A crypto refund record, if you ask for a cryptocurrency refund — the wallet address it is sent to, the coins and the network, the transaction that sent it, how you proved you control that wallet, and who decided it and who sent it | so that a refund goes only to a wallet your money came from, is sent once and only once, and so that we can show what we sent where | with the payment record |
| That you accepted a specific version of our terms, the acceptable use policy and this notice — which version, a fingerprint of its text, and when | it is the only evidence of what either of us agreed to | indefinitely; the record cannot be edited or deleted |
| Whether you buy as a consumer or for a business | it decides whether we charge VAT at the rate of the place you are in, or do not, because a business in another EU country accounts for it itself (the reverse charge) | for the life of the account |
| Your billing details — the name and address an invoice is made out to, and, for a business, its VAT number, or outside the EU its tax number | to make out your invoices, and as evidence of where you are for VAT | six years from the end of the year it is recorded in, as Spanish commercial and tax law require — see §5; a change is kept beside the old details, because an invoice already issued names the details it was made out to |
| VAT number checks — when we check a business's VAT number with the European Commission's VIES service, or a UK VAT number with HMRC's: the number, whether it was said to be valid, the name and address held for it, the consultation number given for the check, and whether the check was made when you saved the number or when you topped up | a valid number is what allows us not to charge VAT, and the consultation number is the evidence that it was valid on the day | with your billing details |
| The VAT on each payment (and on each commission payout paid in render credit) — where we found you to be for VAT, the rate and the amount, and what that rested on: the country you declared, whether you buy as a consumer or for a business, your billing address's country and whether its postcode is in a territory outside the EU VAT area or taxed as another country, your VAT number or tax number and the last answer VIES or HMRC gave about it; and, when you pay with PayPal, the country PayPal reports for the payer | to charge the VAT of the place you are in, to keep the evidence of where you are that a seller of services online must keep, and to make out your invoices | six years from the end of the year it is recorded in, as Spanish commercial and tax law require — see §5 |
| A payment held for review — the country you had declared and the country PayPal reports for the payer, the VAT each would have meant, the credit held, and who released or refunded it | because the country PayPal gives would have changed the VAT on that payment, and a person decided which is right | six years from the end of the year it is recorded in, as Spanish commercial and tax law require — see §5 |
| The country your connection comes from, as our network provider reports it, when you top up — a country, never your IP address | as a second piece of evidence of where you are for VAT, beside your billing address: a cryptocurrency payment tells us nothing else about where the payer is, so a top-up whose two disagree is refused and you are asked to pay by PayPal | six years from the end of the year it is recorded in, as Spanish commercial and tax law require — see §5 |
| The on-chain transactions of each cryptocurrency payment — the network, the coin and the amount, the transaction identifier, our receiving wallet, when it was detected and confirmed, and the rate the payment provider applied | it is the record of what you paid, which tax law requires us to keep; a transaction identifier is public on the blockchain and can lead to the wallet that sent it | six years from the end of the year it is recorded in, as Spanish commercial and tax law require — see §5 |
| That you dismissed a notice we showed you — which notice, and when | so that a notice stays in front of you until you have seen it, and not after | for the life of the account; the record cannot be edited or deleted |
| The emails we send you, and a copy of each — the confirmation of each set of documents you accept (with the documents attached), of each payment we credit, and copies of notices; to which address, when, and whether our email provider accepted it | so that you hold a durable copy of what you agreed to and paid, and so that we can show what we told you and when | for the life of the account; the record cannot be edited or deleted |
| Scene files you upload, and the frames we render from them | to do the work you asked for | scene files expire automatically 30 days after upload, and rendered frames are deleted automatically 30 days after they are rendered |
| Job records — settings, timings, cost, and which referral code brought you | to bill you correctly, to quote future work, and to pay the creator who referred you | indefinitely; see §5 |
| If you buy as a consumer, that you asked us to start rendering within the 14-day withdrawal period of a top-up — which top-up or job you asked at, the words you confirmed, and when | it decides what you pay if you withdraw: rendering you asked us to start is deducted from the refund, rendering you did not ask for is not | with the payment record |
| That you confirmed that you are at least 18 and able to enter a binding contract, and when | the service is offered only to people who can contract | for the life of the account |
| Decisions about your account — if we suspend or close it: when, the reason we gave you, our internal note on it, and who decided | so that we can tell you why, hear you if you ask us to reconsider, and explain the decision afterwards | indefinitely |
About the payer reference. We store the identifier the payment provider gives us — not your name, not your postal address, not your card. It answers one question — do these accounts pay from the same instrument — and is never shown in any page, message, log or alert. When you pay in cryptocurrency, the identifier is the public address of the wallet the payment was sent from, as the payment provider reports it: one address per payment, stored only to answer that same question. A refund does not use it: if you ask for a cryptocurrency refund, we read the sending address again from the payment provider's record of that payment and keep it in the refund record below. We look up nothing else about you on-chain.
About a cryptocurrency refund. It is sent by a person, from our own wallet, to a wallet your payment came from — never to another one. Before we send it we ask you to sign a short message with that wallet, naming the refund; signing proves you still control the wallet (a payment sent from an exchange cannot be signed for, and a refund to one can be lost). We check the signature, record how we checked it, send the coins, check our own transaction on a public block explorer, and record it. The refund record keeps the address, the transaction and that proof with your payment record.
About your scene files. We do not inspect them beyond what rendering requires, and an automated scan checks each one for embedded scripts before it runs on our machines. If a file you upload contains personal data, that is data you have given us, and the 30-day expiry above applies to it.
About signing in with GitHub or Google. When you sign in with one of them, it tells us the permanent account number it gives you and an email address, and whether that address is verified. From GitHub we read your account number and your primary email address, and only if GitHub says it is verified; from Google we read your account number and your email address, and only if Google says it is verified. We keep the account number, and the email if it is the one your BlitzRender account was opened with. We do not keep your name, your username, your picture, or the access the provider grants us: we ask GitHub to withdraw its grant as soon as we have read your email address, and Google's is never used for anything else. Signing in with a provider never joins it to an existing account because the email addresses match; a second provider is added only from an account you are already signed in to.
BlitzRender's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
About your network address. When you sign in or present a credential, your network (IP) address may be used, in memory only, to limit how quickly one network can sign in or try credentials. It is never stored in our database or written to our logs, and it is gone when the process that saw it restarts.
2. If you are an affiliate applicant
| what | why we hold it | how long |
|---|---|---|
| Links to your public profiles and any note you write | so a person can look at the audience you are proposing to reach, and check you control the accounts | until you ask us to erase them — see §4 |
| A proof code we generated | to record what was checked; it is our own random string and says nothing about you | with the application record |
| The decision — who made it, who checked the profiles, when, and against which version of our checks | because it granted you something that is still in force, and we have to be able to explain how the money moved | indefinitely |
| That you accepted a specific version of the affiliate terms | it is the only evidence of what either of us agreed to | indefinitely |
Where the links go. They are posted into a private internal channel so the person reviewing them can see them. They are not published, sold, or shared with anyone outside the people who decide. If you ask us to erase them, that copy is deleted first, before we mark the record erased — so a failure to delete it cannot leave us claiming an erasure that did not happen.
What we do not collect. We do not ask for identity documents, we do not store your follower counts, and we do not have access to any of your accounts. Publishing our code on your profile grants us nothing — you can remove it as soon as we have decided.
3. What the site keeps in your browser
There is no analytics, no advertising and no tracking cookie, and no contact form; the contact route is an email address, and mail you send us is held in an ordinary mailbox. Three things are stored in your own browser, by the site itself, and none is sent anywhere until you act:
- A referral code, by the app only. If you arrive through a creator's link, the public pages store nothing: the code stays in the link, and is carried on the links you follow from there into the app. Only when you reach the app is it kept in that address's local storage, so that it can be attributed to your first job, and it is removed when that job is created. Nothing is stored if you arrive without one, and if you leave the public pages without following one of their links into the app, the code is simply not kept. The code identifies a creator, not you, and is sent nowhere until you create a job. (Until 2026-10-28 the public pages kept a copy of their own, which stays until you clear site data; they store none now.)
- Your sign-in token, once you sign in. It is kept for the browser session, or — if you tick keep me signed in — in local storage, for up to 14 days or until you sign out. It is what lets the app act as you, and it is never sent to anybody but us. Signing out ends it on our side as well as removing it from your browser.
- A sign-in in progress. While you are away at GitHub or Google signing in, the tab keeps a few random values that prove the reply came back to the browser that asked for it. They are deleted as soon as you return, whether or not the sign-in succeeds.
All of these are needed to provide what you asked for and are used for nothing else. A version of this notice before 2026-09-18 said the public site collected nothing; the referral code was already being stored, and the 2026-09-18 version said so.
Why there are two addresses. Your sign-in token can spend your balance, and a browser keeps storage separately for each address a site is served from. Keeping the app on its own address means a flaw in a public page cannot read the token the app holds. It is a security boundary, and the referral code crossing it is the one thing that had to be arranged around it.
4. What you can ask for
Access — a copy of what we hold about you. Correction — of anything wrong. Erasure — described below, honestly.
What we can erase, and what we cannot. The affiliate application links and note are erasable on request and there is a mechanism that does it. Your account email is not erasable today: it is the primary identifier for a ledger we are required to keep intact, and we would rather say so than imply otherwise. Your sign-in identity is not erasable either: it is what keeps a suspended account suspended, because a provider account that once reached a BlitzRender account always reaches that one. If you want an account closed, tell us and we will stop it being usable; the financial record stays.
Signing out. Signing out ends your session on our side, not only in your browser, and you can end every session on your account at once from its settings. A session we have ended cannot be used again, even by somebody who copied it.
Backups are the honest limitation. We take an encrypted database backup every hour and store it for 30 days. Those backups expire on a fixed schedule and we cannot selectively edit them. An erasure clears the live record and the internal message immediately; a backup taken before your request ages out on its own. Nothing reads those backups except a restore.
Why we may hold it. Each kind of data in §1 is held on one of three grounds of the General Data Protection Regulation:
| ground | what it covers |
|---|---|
| to perform our contract with you (art. 6(1)(b)) | your account, sign-in identity and credentials, the jobs you run and their files, your balance and payments, refunds, the emails confirming what you agreed and paid, and the record of your asking us to start rendering |
| to meet a legal obligation (art. 6(1)(c)) | invoices, the VAT on each payment and the evidence of where you are, your billing details and VAT number checks, payment and accounting records, the record of the documents you accepted, refusing service where sanctions law requires, and what we must report to the authorities |
| our legitimate interest (art. 6(1)(f)) | preventing fraud and abuse — the payer reference, the limits on accounts and previews, and the decisions about suspended accounts — and keeping the service secure and running. You may object to this processing, and we will stop unless our reason outweighs yours |
The affiliate application data in §2 is held to perform the affiliate agreement, and the referral code in your browser (§3) to provide what you asked for. We use no data for advertising or profiling, and no decision with legal effect is made about you by automated means alone except the scan that refuses a scene, which a person reviews when you ask.
5. What we keep for ever, and why
Being specific here is the point of this section.
- The credit and commission ledgers are append-only by design. An entry cannot be edited or deleted, by us or by anybody, because a ledger that can be rewritten is not a record of anything.
- The record of what you accepted is append-only for the same reason: it is the only evidence of the agreement, and evidence that can be edited is not evidence.
- Payment, VAT, invoice and job records are kept for six years from the end of the year they are recorded in — the period Spanish commercial and tax law require. Nothing we hold is that old yet; the deletion that will end the period is not built, and before the first record reaches it, in 2032, it will be.
- Rendered frames are deleted automatically 30 days after they are rendered, and uploaded scene files 30 days after upload. A job's record — its settings, timings and cost — is a financial record and stays.
- Decisions we made about you — an approval, a rejection, a payout held or released — survive an erasure request. What is removed is the personal data behind them; what stays is that we decided, when, and who decided it.
6. Who else touches it
| who | what reaches them | where, and how a transfer is protected |
|---|---|---|
| Our cloud host and database provider, Railway | everything, as infrastructure | United States; standard contractual clauses in its data processing addendum |
| Our web host, Vercel, and our network edge and object storage, Cloudflare | your network address and the requests your browser makes, as infrastructure — every visit to the site and every call to our API passes through them; and, in storage, scene files, rendered frames, invoices and backups | Vercel: United States; the EU-US Data Privacy Framework. Cloudflare: United States and its global network; the EU-US Data Privacy Framework, with standard contractual clauses in its data processing addendum |
| GPU marketplaces we rent from, Vast.ai, and the independent hosts whose machines they list | your scene file and nothing else — no account, no email, no payment data | United States; the independent hosts it lists may be in any country; standard contractual clauses in its data processing agreement |
| Our email delivery provider, Mailgun | your email address and each email we send you — the confirmations of what you accepted and paid, your invoices, and copies of notices. We turn its open and click tracking off, so it records nothing about whether or when you read them. It keeps its own delivery log of each email for a limited period | United States; standard contractual clauses in its data processing agreement |
| Our internal messaging tool, Slack | affiliate application links only | United States; the EU-US Data Privacy Framework, through Salesforce |
| Our metrics provider, Grafana Cloud | aggregate counts only, never anything about an individual | United States; the EU-US Data Privacy Framework |
Payment providers are not our processors. PayPal, for a card or PayPal top-up, and Paymento, for a cryptocurrency top-up, each act under their own terms and privacy policy. They receive what you give them directly, and — for a cryptocurrency top-up — your email address, as the address for your receipt; they give us a reference and an amount. A card or PayPal refund goes back through them to the instrument you paid from; a cryptocurrency refund is sent by us, from our own wallet, and does not pass through them.
Our uptime monitors — Healthchecks.io, in Latvia, and UptimeRobot, in the European Union — see only whether our service answers, never anything about you.
Authorities, when the law requires it. If content stored or rendered through BlitzRender suggests a criminal offence that threatens somebody's life or safety, the law requires us to tell the police or the judicial authorities at once and give them what we know (EU Digital Services Act, art. 18). We also give what we hold to a court, or to an authority with the power to require it, when it orders us to. In either case we give only what the report or the order needs, and we tell you unless the law prevents it.
Rented GPUs are worth a paragraph. Your render runs on a machine we hire by the hour through a marketplace. The machine belongs to an independent host, not to us and not to the marketplace, and it is chosen for each job by price and availability — so it may be in any country, including countries outside the European Economic Area that the European Commission has not recognised as protecting personal data to the same standard. It receives the scene and a credential scoped to that one job which expires with it, and it never receives your email, your payment details or any other job. When the job finishes, our rented session on the machine is destroyed; the machine itself and its disk stay with the host, and we cannot inspect or wipe them. If a scene contains personal data — a scanned face, a client's likeness — bear that in mind before you upload it.
GitHub and Google are not our processors. When you sign in with one, it tells us who you are under its own terms and privacy policy, and we receive only what section 1 lists.
Nor is the VAT number check. VIES is the European Commission's service, answering from the tax administration of the EU country that issued the number. When you give us a business's VAT number we send it — and our own VAT number, which is what makes VIES give the check a consultation number — and nothing else about you; VIES answers whether the number is valid and the name and address registered to it. A UK VAT number goes the same way to HMRC's Check a UK VAT number service, the UK's tax authority answering for its own register.
7. Changes
If this notice changes we will publish a new version with a new date. Superseded versions stay available, so a record of what you were told is always producible.
When our documents do not apply yet
While any of our documents still carries an unfilled placeholder, that document is a draft, and two things follow, each enforced by the software rather than remembered:
- it is shown to you with a banner saying it is a draft, and if you accept it, the record says which draft you were shown;
- the service will not take real card payments at all: it refuses to start with live card payments configured while this notice or the terms are drafts.
If you paid us real money and were shown a draft, that is a bug; please tell us.
BlitzRender · privacy notice · version 2026-10-28
Version 2026-10-28 · SHA-256 c0a3c82a9173d096… · All legal documents