Privacy Policy

Last updated: 2 October 2026

This Privacy Policy explains how Renvelock collects, uses, stores and protects personal information when you use our website and services, and what your rights are. We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Renvelock is operated by Pen Paper Technology Ltd ("Renvelock", "we", "us", "our"), a company registered in England and Wales under company number 13806469, with its registered office at 95 Ashby Road, Loughborough, Leicestershire, LE11 3AB, England. We are registered with the Information Commissioner's Office (ICO) under registration number ZC267554.

For anything about your personal data, email privacy@renvelock.com.

2. Our two roles

• For the businesses that use Renvelock (owners, administrators and staff of a company account), we are the controller of their account, sign-in and billing data.
• For the people who send files to a business through a Lock (the business's clients), the business is the controller and we are its processor: we store and deliver what they send only on the business's instructions. If you sent files to a business, please contact that business about your data; we will pass on any request we receive to it.

3. Information we collect

Account information

Your name, email address and password (stored only as a one-way scrypt hash), the companies you belong to and your role in each, your notification preferences and the in-app messages sent to you.

Sign-in security

If you use two-step sign-in: the one-time codes we email you (valid for 10 minutes), the secret for your authenticator app (stored encrypted), hashed recovery codes, and the browsers you chose to trust.

Your work in Renvelock

Comments, flags, pins, attention requests and workflow steps on uploads, Lock notes and messages, the forms and workflows your company designs, and who downloaded or deleted what.

Activity log

Each company has an activity log that its owners and administrators can see. It records sign-ins (including failed ones), password and two-step sign-in changes, team, role, settings and plan changes, and file events such as uploads, downloads and deletions: who did it, when, and the IP address and browser used. The log is tamper-evident: each entry is chained to the one before, and a daily fingerprint (a hash, containing no personal data) is stored where it cannot be changed.

Billing

Paid plans are handled by Stripe. Card numbers, billing addresses and payment credentials are collected and stored by Stripe, not by us. We keep your plan, subscription status, Stripe customer and subscription references, and your storage and download usage.

What clients send through a Lock

Files, file names, upload details (such as sender name, reference and message) and answers to a business's forms are encrypted in the sender's browser before they reach our servers. Only the business's Lock password can decrypt them, so we cannot read them. We also record, in the business's activity log, the sender's IP address and browser, and we keep the upload's time, size and number of files.

Technical data

To prevent abuse we briefly count requests per IP address and per email address. Our servers keep technical logs for fault-finding.

4. How we use information, and our legal bases

• To provide the service you signed up for (accounts, sign-in, team management, uploads, notifications and service emails, billing): contract.
• To keep accounts and the service secure (two-step sign-in, rate limits, the activity log, detecting and investigating misuse): legitimate interests. Businesses need to know who did what with their clients' files, and we need to protect the service and everyone's data. We keep this to what is needed for that purpose.
• To keep accounting and tax records: legal obligation.
• To respond to support requests: contract or legitimate interests.

We do not sell personal information, use it for advertising, build marketing profiles or make automated decisions with legal or similarly significant effects.

5. Email

We email you for account and service reasons only: verifying your address, sign-in codes, password resets, notifications you or your team turned on (such as new uploads), billing notices and important changes to the service. Rate limits stop our email functions being used to send mail to others.

6. Who we share information with

We do not sell, rent or trade personal information, and we do not share it with data brokers or advertising networks. We use these service providers, under contracts that require them to protect the data:

• Amazon Web Services (hosting, database, encrypted file storage, email) — London, United Kingdom.
• Amazon CloudFront — delivers downloads through links that work for one hour. Files pass through already encrypted.
• Stripe — subscriptions and payments. Stripe is also a controller of some payment data under its own privacy policy. Stripe's script is loaded only on our payment page.

We may also disclose information when the law requires it (for example a court order), or to investigate fraud, enforce our Terms, or protect the rights and safety of Renvelock, our users or others.

Our website loads no third-party analytics, advertising or tracking scripts, and our fonts are served from our own site.

7. International transfers

Your data is stored in the United Kingdom. Downloads may pass through CloudFront locations in Europe and North America, but only as encrypted content. Stripe may process payment data outside the UK; where it does, it relies on the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum.

8. How long we keep information

• Files, file names, upload details and form answers: deleted automatically when the plan's retention period ends (3 days on Starter, 30 days on Standard, up to 3 years on Premium), or earlier when the business deletes them. Comments, flags and workflow steps on an upload are deleted with it.
• Record of a deleted upload (who deleted it, the last comments and actions, and the still-encrypted details): 1 year.
• Activity log entries, including IP address and browser: 3 years.
• Account information: while your account exists. You can delete your account at any time (section 10).
• Sign-in session: 1 day. Emailed sign-in codes: 10 minutes. Trusted-browser cookie: 30 days.
• Rate-limit counters: usually under 2 hours, always removed within about 2 days.
• Server logs: 30 days.
• Backups: our database can be restored to any point in the last 35 days, and deleted files can be recovered for 7 days. After that, deleted data is gone for good.
• Billing and accounting records: 6 years after the end of the financial year they relate to (most are held by Stripe).
• Support emails: until the matter is resolved, then up to 2 years.

9. Security

• Files and their details are encrypted in the browser. Each Lock has its own key pair, and its private key is protected by the Lock password through Argon2id key derivation. The Lock password is never sent to us.
• Everything travels over HTTPS, and stored data is encrypted at rest.
• Account passwords are hashed with scrypt, and two-step sign-in is available (by email code or authenticator app).
• Access within a company is limited by role (owner, administrator, staff).
• Rate limits protect sign-in and email functions.
• The activity log is tamper-evident.

No method of transmission or storage is completely secure. You are responsible for keeping your account password and Lock passwords safe. If you lose a Lock password, the files it protects cannot be recovered by anyone, including us.

10. Your rights

Under UK data protection law you have the right to:

• access the personal information we hold about you
• have inaccurate information corrected
• have your information erased
• restrict or object to certain processing (including processing based on legitimate interests)
• receive your information in a portable format
• withdraw consent, where we rely on consent

Deleting your account. Signed in, go to Account → Security → Delete account. You will see what happens to each of your companies before you confirm:

• A company where you are the only member is deleted with your account, including all its Locks, uploads and files, forms, workflows and activity log. A paid subscription is cancelled straight away.
• If you are the only owner of a company that has other members, you must first make one of them an owner.
• From any other company you are simply removed.

Your comments, and the activity log entries about what you did, stay in the records of companies that still exist, because they belong to that company and may be needed to show who did what. Those entries are deleted when their 3-year retention ends.

You can also exercise any right by emailing privacy@renvelock.com. We answer within one month. If you sent files to a business through a Lock, we will forward your request to that business.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

11. Cookies and browser storage

We do not use analytics, advertising or tracking cookies. Everything below is either strictly necessary for something you asked for, or a setting you chose. The law (the Privacy and Electronic Communications Regulations) does not require consent for these, so we do not show a cookie banner. If we ever add anything that needs consent, we will ask first, and you will be able to say no and still use Renvelock.

• Sign-in cookie: keeps you signed in for up to 1 day.
• Trusted-browser cookie: if you choose to trust a browser, lets it skip the two-step code for 30 days.
• Browser storage:
  • your light or dark theme;
  • whether new Locks should be pinned;
  • on the upload page, what is needed to resume an interrupted upload for up to 23 hours (no file names or contents).
• Stripe: only on our payment page, Stripe sets its own cookies to process the payment and prevent fraud (see Stripe's privacy policy).

12. Children

Renvelock is for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, the "Last updated" date changes. We will announce material changes on this page and, where appropriate, by email.

14. Contact us

Pen Paper Technology Ltd (trading as Renvelock) 95 Ashby Road, Loughborough, Leicestershire, LE11 3AB, England Company number 13806469 ICO registration number ZC267554

Privacy enquiries: privacy@renvelock.com General support: contact@renvelock.com