ReN Platform Privacy Policy (PRIE and DDF)
Effective date: 29 Oct 2026
1. Who we are and what this policy covers
This policy explains how Diversity Economics Ltd, trading as ReN ("ReN", "we", "us"), handles personal data in its Portfolio Risk Intelligence Engine ("PRIE") and Due Diligence & Forensics ("DDF") platforms, including the Ask ReN AI assistant, exports, workflow agents, the free-trial sign-up and related services (together, the "ReN Platform").
It applies to enterprise customers and their authorised users ("Enterprise", "you") and to people who sign up for a free trial. It does not cover our marketing website, myrenx.ai, which has its own privacy and cookies policy.
Diversity Economics Ltd is registered in England and Wales, company number 14529141, at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. ICO registration number: ZB644289.
2. Definitions
- Enterprise Data: information an Enterprise or its users put into the ReN Platform, such as portfolios and holdings, uploaded files, workflow settings and connection details, and the questions asked of Ask ReN.
- Generated Content: answers, reports, exports and other output the ReN Platform creates from Enterprise Data or user prompts.
- Account Information: details about each user account: name, email address, organisation, role, sign-in method and account settings.
- Usage Data: the product analytics described in section 4.4.
3. Our role
For Enterprise Data and Generated Content, we act as a processor: the Enterprise is the controller, and we process that data only on its instructions and under our service agreement.
For Account Information, Usage Data, platform cookies, security logs and free-trial sign-ups, we are the controller, and this policy is our notice to you about that processing.
4. Information we collect and why
4.1 Enterprise Data and Generated Content
We process Enterprise Data to provide the ReN Platform: to run the analyses, answers, exports and workflows you ask for. Generated Content belongs to the Enterprise and is treated as confidentially as Enterprise Data.
4.2 Account Information
We use Account Information to:
- create and manage accounts, sign you in and control access within your organisation;
- provide customer support;
- send service notices, such as organisation invitations and important changes.
Legal basis: performance of our contract with the Enterprise, and our legitimate interest in running and securing the platform.
4.3 Free-trial sign-ups
When you request a free trial we collect your name, work email and company. We use them to set up your trial and contact you about it, including booking your onboarding call through Calendly.
Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in following up on your request.
4.4 Product usage analytics
When you use the ReN Platform, we record how you use it so we can understand and improve the platform and support our customers. For each day you use the platform we record:
- when you were first and last active;
- how much time you spent actively using it (only while the platform is open on your screen and you are interacting with it);
- how many sessions you had;
- which areas of the platform you used (for example, the Portfolios page or company analysis);
- how many times you signed in, asked Ask ReN a question (typed or spoken), or exported a report.
This analytics does not record your IP address, device or browser details, the pages or documents you viewed, or the content of your work. It does not use cookies or store anything in your browser.
The data is pseudonymised: it is stored under a coded identifier rather than your name, email address or account number. Only our systems, using a separate secret key, can link it back to your account, and we do so only to view usage, respond to your requests, or delete your data. It is kept in our own systems in the European Union and is not shared with third parties.
Legal basis: our legitimate interests in operating, improving and supporting the platform. We keep it for 13 months, after which it is deleted automatically; it is also deleted when your account is deleted. You can object at any time by emailing operations@myrenx.ai, and we will stop recording your usage.
Separately, if you accept analytics cookies, Google Analytics also measures platform use (section 5).
4.5 Security logs
To keep the platform secure and accountable, we record:
- the IP address and browser identifier used when you connect an external AI tool to the ReN Platform (for example through our MCP connection);
- each time our staff view or change usage analytics, with the staff member's IP address.
Legal basis: our legitimate interest in protecting the platform and our users.
5. Cookies and browser storage
The ReN Platform sets Google Analytics cookies only if you click Accept on our cookie banner. Everything else it stores in your browser is needed for the platform to work, so it needs no consent.
| Name | Set by | Purpose | Kept for | Needs consent |
|---|---|---|---|---|
| Session cookie | ReN | Keeps you signed in across ReN apps | Until you sign out or the session expires | No |
| Sign-in and preference storage | ReN, Google Firebase | Remembers your sign-in, theme and screen settings | Until you sign out or clear your browser | No |
| ren_cookie_consent | ReN | Remembers your cookie choice | Until you clear your browser | No |
| _ga, _ga_[ID] | Google Analytics | Measures how the platform is used: pages and features used, time spent, errors | Up to 2 years | Yes |
Google Analytics receives a pseudonymous user identifier, never your name or email address. Its advertising features and Google signals are switched off.
You can change your choice at any time under Cookie Settings in your account menu or Settings. If you withdraw consent, we switch Google Analytics off and delete its cookies.
6. AI and your data
6.1 No training on your data
We do not use Enterprise Data, Generated Content or Ask ReN conversations to train AI models, ours or anyone else's. The AI models we use run on Google Cloud's Vertex AI, and under Google's terms Google does not use this data to train its models either.
6.2 Ask ReN conversations
Ask ReN conversations are saved to your account so you can return to them, and are encrypted in transit and at rest. Only you and people your Enterprise authorises can see them. Our staff do not access their content except to provide or support the service at your request, or where the law requires it.
6.3 Voice questions
If you ask Ask ReN a question by voice, the recording is sent to our AI provider to turn it into text. We do not keep the recording; the text of the question is saved like a typed question.
6.4 AI output
Generated Content is produced automatically and may contain errors. It is information, not investment, financial or legal advice.
7. Sharing and sub-processors
We do not sell personal data. We share it only:
- with authorised users in your organisation;
- with the sub-processors below, which act on our instructions under data processing terms;
- with recipients you choose, such as email addresses, Slack, Teams, Jira or webhooks you set up in a workflow;
- where the law or a public authority requires it, or to protect our rights, users or the public;
- in a merger, acquisition or sale of our business, under the same protections.
| Sub-processor | What it does for us | Data it handles | Location |
|---|---|---|---|
| Google Cloud (Cloud Run, databases, Vertex AI, Vertex AI Search) | Hosting, storage, AI models, voice transcription, document search | All platform data | EU (Belgium) for hosting and storage; AI requests may be processed outside the EU |
| Google Firebase Authentication | Sign-in | Name, email, sign-in details | Global, including the US |
| Google Analytics | Usage measurement, only with cookie consent | Pseudonymous ID, usage events | US |
| Langfuse | Monitoring the quality of AI analyses | AI prompts and outputs, which can include holdings you upload | EU |
| Postmark | Organisation invitation emails | Name, email | US |
| Google Workspace (Gmail) | Delivering workflow reports by email | Recipient emails, report attachments | Global, including the US |
| Calendly | Booking free-trial onboarding calls | Name, email, company, call time | US |
We will tell Enterprises before adding or replacing a sub-processor, and give them the chance to object.
8. International transfers
The ReN Platform is hosted in the EU, but some sub-processors in section 7 process data in the US or elsewhere. Where personal data from the UK, EU or Switzerland goes to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the UK-US Data Bridge and EU-US Data Privacy Framework where the recipient is certified. You can ask us for a copy of the relevant safeguards.
9. Security
We protect data with technical and organisational measures, including:
- encryption in transit (HTTPS) and at rest;
- extra encryption for the credentials of connections you add, such as Slack, Teams, Jira and webhook addresses;
- sign-in through Google Firebase, with access limited by organisation and role;
- pseudonymised usage analytics (section 4.4).
No system is completely secure. If a breach affects your personal data, we will notify the Enterprise and the relevant authorities as the law requires.
10. Retention
| Data | How long we keep it |
|---|---|
| Enterprise Data and Generated Content | For the term of the service agreement; then deleted or returned as the agreement sets out, unless the law requires us to keep it |
| Account Information | While the account is active, then deleted or anonymised within 30 days of the account being closed |
| Usage analytics | 13 months, or until the account is deleted if sooner |
| Free-trial sign-ups | 3 months after the trial ends, unless you become a customer |
| Security logs | 30 days; connection records until you remove the connection |
| Google Analytics | Up to 14 months in Google Analytics |
11. Your rights
Under UK and EU data protection law you can ask us to:
- give you a copy of your personal data;
- correct it;
- delete it;
- restrict how we use it;
- give it to you, or another provider, in a portable format;
- stop processing it where we rely on legitimate interests (you can object at any time).
Where we rely on your consent, such as for analytics cookies, you can withdraw it at any time without affecting earlier processing.
To use these rights, email operations@myrenx.ai. We reply within one month. For Enterprise Data we act as a processor, so we will pass your request to your organisation and help it respond.
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or to your local data protection authority in the EU. We would appreciate the chance to resolve it first.
12. Enterprise controls
In the ReN Platform, Enterprises can:
- invite and remove users and set who is an organisation admin;
- export portfolios, analyses and Ask ReN answers as PDF, Word, Excel or PowerPoint files;
- delete portfolios, workflows and connections they have created;
- choose whether to accept analytics cookies, per user.
For anything else, such as a full export of Enterprise Data, deleting an account, or excluding a user from usage analytics, email operations@myrenx.ai.
13. Compliance
We process personal data in line with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations and, for EU users, the EU GDPR. Our data processing terms for Enterprises are available on request.
14. Changes and contact
We may update this policy. We will tell Enterprises about material changes by email or in the ReN Platform before they take effect, and the effective date at the top will change.
For questions about this policy or our data practices, contact our privacy team:
- Email: operations@myrenx.ai
- Post: Diversity Economics Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
- EU representative: Minal Patel, COO.
15. Users outside the UK, EU and Switzerland
This policy applies to you in full, with these differences:
- The legal bases in section 4 and the EU representative in section 14 are requirements of UK and EU law and may not apply to you.
- Your data is processed in the EU, the US and the other locations in section 7, which may have different data protection laws from your country. We protect it as this policy describes wherever it is processed.
- We will still act on requests to access, correct or delete your personal data (section 11), and you have any further rights your local law gives you.
- You can complain to the data protection authority in your country.