Privacy policy
Draft: this document describes how the website currently handles data and must be reviewed by legal counsel before ROOKON launches commercially.
Draft of 13 November 2026
The short version
- We collect what we need to run your account, bill you and keep ROOKON secure. Nothing more.
- Analytics and ads on our website only run if you say yes.
- We never sell your data, and we don’t train AI models on it.
- If you visit a site that uses ROOKON, that site decides about your data. Ask them first.
Who we are
[Company name], CVR [CVR number], [Registered address, Denmark] (“ROOKON”, “we”) is the data controller for the personal data described here. Questions and requests: privacy@rookon.ai.
What this policy covers
This policy covers our website, your ROOKON account and workspace, billing, the partner program, support, notifications and the phone app. It does not cover the data our customers collect about their own visitors and users with ROOKON. For that data, the customer is the controller and ROOKON processes it on their behalf under the data processing agreement. If you visited a website or store that uses ROOKON, or sent feedback through its feedback button, please contact that company about your data. If you contact us instead, we pass your request on to them.
What we process, why and for how long
| What | Why | Legal basis (GDPR Art. 6) | Kept |
|---|---|---|---|
| Your account: name, email address, password (stored as a hash), two-factor settings, and the IP address and browser of your active sign-ins | To create and secure your account and show you where you are signed in | Contract | While your account exists; deleted within 30 days after you delete it |
| Sign-in with Google or Microsoft: your name, email address and account id from that provider | To let you sign in without a separate password | Contract | While your account exists |
| Your workspace: your role, invitations you send or receive (the invitee’s email address) and the audit log of security-relevant actions | To run the workspace, give the right people access and keep it secure | Contract and legitimate interest (security) | While the workspace exists; invitations expire after 7 days |
| Billing: company or private name, country, address, invoice email, CVR or EU VAT number (checked with the EU’s VIES service), plan, invoices and payments | To charge for the service, apply the right VAT and keep the books | Contract and legal obligation (Danish bookkeeping and VAT law) | Invoices and accounting records for 5 years from the end of the financial year, as Danish law requires |
| Service emails and notifications: your email address, and the push address of each browser or phone where you turn on notifications | To send verification, security, billing and alert emails, and the notifications you choose | Contract; consent for push notifications (given in your browser or phone, and you can turn them off at any time) | Push addresses until you turn notifications off, sign out on that device or it stops accepting them |
| Usage of ROOKON: which features are used, how often and how they perform | To run, secure and improve ROOKON, using aggregated, de-identified statistics | Legitimate interest (improving our service) | Raw usage events as long as needed for the statistics, at most 12 months |
| Support and feedback: what you write to us and our replies | To help you and to improve ROOKON | Contract or legitimate interest | As long as needed to help you and follow up, and no longer than 2 years after the conversation ends |
| Security logs: IP addresses and requests to our servers, including failed sign-ins | To protect ROOKON and our customers against abuse and attacks | Legitimate interest (security) | Normally no longer than 30 days |
| Partner program: your application (name, channels, audience size), payout details (stored encrypted), and the commission ledger | To run the program and pay commission | Contract and legal obligation (bookkeeping) | While you are a partner; ledger and payouts for 5 years from the end of the financial year |
| Partner links: a click on a partner link, with the partner code, page and campaign, and a hash that changes daily instead of your IP address | To credit the partner who referred you | Consent where a cookie is stored (see the cookie policy), otherwise legitimate interest | 90 days |
| Website analytics and ads: page views, demo interactions and campaign data, only if you allow analytics or marketing cookies | To understand how the website is used and which campaigns work | Consent | In Google Analytics for at most 14 months; you can withdraw consent at any time |
“Contract” means we need the data to provide the service you signed up for. “Legitimate interest” means we have weighed our interest (for example security) against your privacy; you can object to it (see your rights below).
What we don’t do
- We never sell personal data or share it for others’ advertising.
- We don’t train AI models on your data. AI features run on the AI provider and key that the workspace chooses.
- The demos on our website run in your browser on simulated data. Nothing you type into a demo is sent to us.
- Payment card and bank details go to Stripe and never to ROOKON.
- Partners see totals (clicks, sign-ups, paying customers), never who signed up.
The phone app
The ROOKON phone app keeps your sign-in in your phone’s secure storage (Keychain or Keystore) and stores the push token only if you allow notifications. It contains no advertising or third-party tracking.
Who receives data
- Our sub-processors, such as hosting, email delivery and push notification services, listed on the sub-processor list.
- Stripe, for payments and invoices.
- Google, for website analytics and ads, only with your consent.
- Google or Microsoft, if you choose to sign in with them.
- The European Commission’s VIES service, with the VAT number you enter.
- Partners, with totals only, when you sign up through their link.
- Advisers, authorities and courts when the law requires it, and a buyer if our business is sold (bound by this policy).
Transfers outside the EU
ROOKON is hosted in the EU. Some recipients, such as Stripe, Google and Microsoft, may process data in the United States. Such transfers rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
Your rights
You can ask for access to your data, a copy in a portable format, correction, deletion, or restriction of processing. You can object to processing based on legitimate interest, and withdraw consent at any time (for cookies through “Cookie settings” in the footer, for notifications in your account or device settings). Write to privacy@rookon.ai; we answer within one month. You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).
Automated decisions
We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Automated checks in the partner program may flag a referral for review, and a person decides.
Children
ROOKON is not intended for anyone under 18, and we don’t knowingly collect their data.
Cookies
How we use cookies and similar storage is described in the cookie policy.
Changes
We update this policy when our processing changes, and tell account holders by email about important changes before they apply. The date at the top shows the current version.