Sub-processors
Draft: this document describes how the website currently handles data and must be reviewed by legal counsel before ROOKON launches commercially.
Draft of 13 November 2026
ROOKON uses the following sub-processors to provide the service to you. We email workspace owners and update this page at least 30 days before adding or replacing one, as described in the data processing agreement.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the ROOKON API, background workers and database, object storage (session recordings, source maps) and backups | All customer data processed by the product | EU (data centre location confirmed before launch) |
| Vercel Inc. | Hosting of the ROOKON website and web app (pages, sign-in and dashboard requests passed on to the ROOKON API) | Account and workspace data shown in the app, and request data such as IP address while it is handled | Server functions in Frankfurt (EU); static files from Vercel’s global network; United States under the EU-US Data Privacy Framework and standard contractual clauses |
| Scaleway SAS | Sending sign-in, verification, invitation, alert, ticket reply and billing emails (Transactional Email) | Email addresses and email content | France (EU) |
| Browser push services (Google, Apple, Mozilla, Microsoft) | Delivering notifications to team members who turn them on in their browser | The browser’s push address and a short notification title and link; no customer data beyond that | Depends on the browser; may be outside the EU, under the provider’s safeguards |
| 650 Industries, Inc. (Expo) | Delivering notifications to the ROOKON phone app, when it is released and a team member turns them on | The device’s push token and a short notification title and link | United States, under standard contractual clauses (to be confirmed before the app launches) |
Services you choose and control
These integrations exchange data only when you connect them, on your instruction and under your own agreement with the provider. They are not ROOKON sub-processors.
- Your AI provider (OpenAI, Anthropic, Google or a compatible endpoint): Scrubbed evidence and code for analyses, fixes, replies and drafts, sent with your own key.
- GitHub: Reading relevant code and opening, merging or reverting pull requests you approve.
- Shopify: Store events from the pixel, and product, collection, redirect and theme changes you approve.
- Google Search Console and Semrush: Search data for your own sites, read with read-only access or your own key.
- LinkedIn, WordPress, Ghost and webhooks: Posts and articles you approve for publishing.
- Slack, Discord, webhooks and email addresses you add: Alerts about issues, outages and new feedback.
- Google and Microsoft sign-in: Your identity when you choose to sign in with them.
Services for our own business
Stripe Payments Europe, Ltd. handles subscription payments, invoices and payment methods. For your billing details ROOKON is the controller, as described in the privacy policy. Payment card details are held by Stripe, never by ROOKON.
To check EU VAT numbers we query the European Commission’s VIES service with the number you enter. No other personal data is sent.