Data processing agreement
Draft: this document describes how the website currently handles data and must be reviewed by legal counsel before ROOKON launches commercially.
Draft of 13 November 2026
The short version
- You decide what ROOKON collects about your users. We process it only to run the features you turn on.
- Data is hosted in the EU, protected by default, and deleted on the schedule you set.
- We tell you before adding a sub-processor, and you can object.
- When you leave, you can export your data for 30 days, and then we delete it.
This data processing agreement (DPA) is between you, the customer (the controller), and [Company name], CVR [CVR number], [Registered address, Denmark] (ROOKON, the processor). It forms part of the terms of use and applies whenever ROOKON processes personal data on your behalf. It is designed to meet Article 28 of the General Data Protection Regulation (GDPR). If this DPA and the terms disagree on data protection, this DPA wins.
1. Roles
You are the controller of the personal data of your visitors, users, customers and team members that the service processes for you. ROOKON is your processor. ROOKON is a controller only for its own relationship with you, such as your account, billing and our website, as described in the privacy policy.
2. Your instructions
We process personal data only on your documented instructions. Your instructions are this DPA, the terms, the settings you choose in the product (for example retention, masking, which features and integrations are on) and other written requests. If we think an instruction breaks data protection law, we tell you. If the law requires us to process data otherwise, we inform you first unless the law forbids it.
3. What we process
Annex 1 below lists, per feature, whose data is processed, which data and for how long. The purpose is always to provide the features you use: monitoring, analytics, session replay, issue detection and recommendations, proposed fixes, impact measurement, feedback and tickets, content drafts and the integrations you connect. We do not intend to process special categories of personal data (such as health data). You configure masking and excluded pages so that it isn’t captured.
4. Confidentiality
Everyone at ROOKON who can access your data is bound by confidentiality and may access it only where needed to run, secure or support the service.
5. Security
We maintain the technical and organisational measures in Annex 2 and keep them appropriate to the risk. We may improve them over time but will not reduce the overall level of protection. More detail is on the security page.
6. Sub-processors
You give a general authorisation for the sub-processors on the sub-processor list. We give at least 30 days’ notice by email to workspace owners, and on that page, before adding or replacing one. You may object on reasonable data protection grounds within that period. If we can’t resolve the objection, you may end the affected part of the service and we refund any prepaid fees for the remaining period. Each sub-processor is bound by data protection terms at least as protective as this DPA, and we remain responsible for them.
7. Integrations you connect
Some features send data to services you choose and connect yourself: your AI provider (with your own API key), GitHub, Shopify, Google Search Console, Semrush, LinkedIn, WordPress, Ghost, Slack, Discord, webhooks and sign-in with Google or Microsoft. When you connect one, you instruct us to exchange the data the feature needs with that service on your behalf. These services are not ROOKON’s sub-processors: their processing is governed by your own agreement with them, and you are responsible for that agreement and for any transfer outside the EU it involves. We send only the data the feature needs, and you can disconnect at any time.
8. AI processing
AI analysis, fixes, replies and drafts run on the AI provider and models you choose, with your own key and within the AI budget you set. Before data is sent, personal data is removed from text as described in Annex 2, and the evidence is limited to what the analysis needs. ROOKON does not train AI models on your data or your users’ data. How your AI provider uses data is governed by your agreement with that provider.
9. Transfers outside the EU
Your data is hosted in the EU. A transfer to a country outside the EU and EEA happens only through a sub-processor listed on the sub-processor list and with a valid safeguard under Chapter V GDPR, such as an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses.
10. Requests from data subjects
The product lets you find, export and delete personal data, including all recordings of a single visitor and the data of a team member. If you need more help, we assist within reasonable time. If a data subject contacts us directly about data we process for you, we pass the request on to you and do not answer it ourselves unless you ask us to.
11. Personal data breaches
We notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data. We include what we know about the nature of the breach, the data and people affected, likely consequences and the measures taken, and update you as we learn more, so you can meet your own obligations.
12. Impact assessments
We give you the information you reasonably need for a data protection impact assessment or a prior consultation with a supervisory authority about your use of ROOKON.
13. Deletion when you leave
While you use ROOKON, data is deleted automatically after the retention you set, and you can delete projects at any time. When your subscription ends or you close your workspace, you can export your data for 30 days. After that we delete your workspace data within a further 30 days, unless the law requires us to keep it. Backups roll over within 14 days. We confirm the deletion in writing on request.
14. Audits
We make available the information needed to show that we meet this DPA, including summaries of security reviews when we have them. If that is not enough, you or an independent auditor bound by confidentiality may audit us once a year with 30 days’ notice, during business hours and without disrupting the service or other customers’ data. You bear the cost of your audit unless it finds a material breach of this DPA. Audits by a supervisory authority are always allowed.
15. Your responsibilities
You make sure you have a lawful basis for the processing, that your users are informed (for example in your privacy policy, naming ROOKON as a processor), that you collect consent where the law requires it (for example for session replay or experiments in some countries), and that you configure masking and excluded pages for sensitive content.
16. Liability, term and law
The limitations of liability in the terms apply to this DPA as far as the law allows. This DPA applies as long as ROOKON processes personal data for you. It is governed by Danish law, and disputes are settled by the courts named in the terms. Questions about data protection: privacy@rookon.ai.
Annex 1: Processing details
| Feature | Data subjects | Personal data | Kept |
|---|---|---|---|
| Web analytics | Visitors of your sites and apps | A pseudonymous visitor id that changes every day (a salted hash; the IP address is used only in memory to derive it and the country, and is not stored), pages, events and goals, referrer domain, campaign tags, device class, browser, operating system, country | Your workspace retention (default 90 days) |
| Session replay (only if you turn it on) | Visitors | Page structure and interactions, with text and form inputs masked in the browser by default; password, payment card and one-time-code fields are never recorded | Your retention, or less when the storage included in your plan is full (oldest recordings are deleted first) |
| Error and performance monitoring | Visitors | Error messages with numbers, ids and URLs removed, stack traces, the clicks and page changes before an error (never input values), request paths without query strings, Web Vitals, browser | Your workspace retention |
| Feedback widget (only if you turn it on) | People who send feedback | The message and its type, the email address if they choose to leave one (stored encrypted), page path, device class, a link to their session | Until you delete the ticket; spam after 30 days |
| Imported support tickets | Your customers who contacted support | A scrubbed subject and excerpt (names, emails and numbers removed), the date and a salted customer hash | 180 days |
| Site search (only if you turn it on) | Visitors | Search terms with personal data removed | Your workspace retention |
| Shopify store (only if you connect it) | Visitors of your store | Storefront events (page, product, cart and checkout steps) without customer records, orders or checkout tokens | Your workspace retention |
| AI analysis, fixes, drafts and replies | Any of the above, as evidence | A bounded evidence bundle built from the data above after scrubbing, plus relevant code from your repository and your product description | Until you delete the item or your workspace |
| Your team | Members of your workspace | Name, email address, role, sign-in and two-factor settings, audit log entries, notification settings and device push tokens | While the workspace exists; push tokens until the device signs out or stops accepting notifications |
Annex 2: Technical and organisational measures
- Hosting in EU data centres. All traffic is encrypted in transit (TLS).
- Workspaces are isolated in the data access layer, and a request for another workspace’s data answers “not found”. This is covered by automated tests.
- Roles (owner, admin, developer, viewer), optional two-factor authentication for every account, and first-party, HTTP-only session cookies.
- Envelope encryption (AES-256-GCM) of secrets and sensitive fields: AI keys, integration tokens, feedback email addresses. Keys can be rotated.
- Privacy by default in the browser: no cookies for analytics, masking of text and inputs in recordings, password and card fields never recorded, query strings dropped, Do Not Track and Global Privacy Control honoured.
- Personal data such as emails, phone numbers, payment card and CPR numbers is removed from text before it is stored for analysis or sent to an AI provider. Text from your sites is treated as data, never as instructions.
- Least privilege for integrations: GitHub access is read-only by default, writes are limited to ROOKON’s own branches and never touch protected or default branches, and files such as secrets and credentials are never read. Shopify access excludes customer and order data.
- Nothing merges into your code or changes your store without a person in your team approving it.
- Logs redact secrets and personal data. Security-relevant actions are recorded in an audit log.
- Automatic deletion by retention, per-visitor deletion of recordings, and deletion of whole projects.
- Daily database backups kept for 14 days in separate storage, with restores rehearsed regularly.
- Rate limits on public endpoints, protection against requests to internal networks, and signature checks on incoming webhooks.
- Access to customer data for ROOKON staff only where needed to run or support the service, under confidentiality obligations.
Annex 3: Sub-processors
See the sub-processor list.