Rendair

The EULA states the vendor claims no ownership over user content (photos, floor plans), and the Privacy Policy affirms all user content belongs solely to the user. However, users grant a broad, sub-licensable, transferable license over that content, and by default 'Standard Image Rights' let Rendair use project imagery for marketing. Ownership is nominally retained but heavily encumbered.

The March 2024 AI Terms state users own all assets they generate, subject to conditions and third-party rights. But the Privacy Policy's 'Standard Image Rights' default reserves Rendair the right to use project imagery for marketing and advertising unless the user upgrades to 'Exclusive Image Rights.' Ownership is granted but immediately qualified, creating ambiguity.

The Privacy Policy explicitly lists data 'acquired during the training of Rendair machine learning algorithms' as within scope, indicating user data feeds model training, yet no clear opt-out or limitation is offered for prompts and uploads. The AI Terms of Service are silent on training use of user inputs. This combination of an affirmative training reference plus silence on user control is high risk for professionals uploading confidential client plans.

There is no defined retention schedule or deletion SLA. High-resolution images are kept only 'for a finite period as deemed reasonable exclusively by Rendair,' and deleted content may persist indefinitely in archives. Users can request deletion but the vendor reserves broad discretion to retain data, and account deletion is only possible when the account is 'inactive.' No security-related retention obligations are documented.

Rendair shares personal data with service providers, payment processors (2Checkout/2CO), and in business transfers, and its CCPA table marks Identifiers, financial info, commercial info and inferences as 'Disclosed: YES.' The company states it does not sell data as defined by the CCPA. Sharing with service providers is disclosed and largely tied to service delivery, but the breadth of categories disclosed and the presence of third-party advertising cookies raise moderate concern.

The Privacy Policy provides genuine opt-out mechanisms: EU/EEA users may object to processing, withdraw consent, and opt out of cookies, marketing and data analyses; CCPA users have a Do-Not-Sell right (though the vendor says it does not sell). However, there is no clear opt-out from AI training use of prompts/uploads, and opting into 'Exclusive Image Rights' to avoid marketing use appears to require a paid upgrade rather than a free opt-out.

Against the universal baseline (GDPR, CCPA/CPRA, VCDPA, CPA, SOC 2, ISO 27001, ISO 42001, NIST CSF, EU AI Act) plus consumer_general (COPPA) and enterprise_saas (SOC 2 Type II, ISO 27018), the documents reference only CCPA rights and some GDPR-style rights for EU users. No security or AI-governance certification (SOC 2, ISO 27001, ISO 42001) is claimed despite a linked but inaccessible Trust Center. No relevant attestations are evidenced, and the aged Privacy Policy predates the EU AI Act.

The documents provide no model transparency, explainability, or enterprise auditing commitments. The AI Terms explicitly warn that algorithms and generated styles may change without notice and disclaim any reliability. There is no mechanism for professional users to audit how outputs are generated.

Disclosed security controls are minimal: password hashing and off-site storage of credit card details by a third-party processor, with an explicit disclaimer that absolute security cannot be guaranteed. There is no mention of encryption at rest/in transit, access controls, penetration testing, bug bounty, or incident response, and no breach history. A Trust Center is linked but was inaccessible, so no certifications could be verified.

The consumer documents reference some tiering: a paid 'Exclusive Image Rights' upgrade to waive marketing use of outputs, an optional NDA for clients, and an unlimited-plan tier subject to rate limiting. These indicate materially better data-handling for paying/NDA customers, but the specifics of enterprise protections are not established within the consumer documents themselves.

The Privacy Policy indicates that project files and collaboration-page content are visible to Rendair, and that the site's programmer has access for maintenance. The vendor also reserves broad rights to review and remove user content. This means staff can access user prompts, uploads and outputs, though the NDA offering suggests some confidentiality controls for clients who request them.

The documents address law-enforcement and government data requests, committing to notify users of law-enforcement requests unless legally prohibited, and reserving the right to report suspected unlawful activity to authorities. Disputes are pushed to binding arbitration in Miami-Dade County, Florida under AAA/ICDR rules. No actual litigation or government-request history is disclosed.

The CCPA disclosure table marks collection of Identifiers including SSN, driver's license, and passport numbers, plus financial information, medical/health information, images (sensory data), and inferences. The Privacy Policy also lists bank details, credit card details, dates of birth and identification documents. This is a broad sweep of PII and sensitive categories (government IDs, financial and medical data) that far exceeds what an architectural rendering tool requires, collected with limited purpose limitation.

The product is AI-first (Rendair Chat, text-to-render, video/animate, upscaling) per the marketing surface, but the governing Privacy Policy is dated 'August 27, 2021' — nearly five years before the analysis date — and reads as a marketplace/artist-portfolio template referencing 'Artists,' 'Designers,' 'Installations' and 2Checkout, not an AI image generator. Even the newer 'AI Terms of Service' (Effective March 7, 2024) is over 12 months old and silent on third-party model providers and training use. The stale, mismatched policy fails to cover current AI capabilities.

Multiple documents were supplied (an older EULA, the March 2024 AI Terms, and the August 2021 Privacy Policy), and they contradict each other materially on output ownership and the scope of the license granted to Rendair. The EULA takes a broad marketing/promotion license over user content and a template for 'Designers/Installations,' while the AI Terms grant users ownership of generated assets, and the Privacy Policy defaults to Rendair's right to use project imagery for marketing unless the user pays to upgrade. These are material conflicts a user would rely on differently depending on which document they read.