Privacy Policy
1. Data controller
Your personal data is processed by [COMPANY NAME] (address: [ADDRESS], e-mail: [E-MAIL ADDRESS]).
2. Data we collect
Account data (e-mail address, password hash, language preference), usage data (lookups made, followed stores, session logs, IP address, browser details; clicks, navigation and screen recordings on the site, with form fields masked) and the subscription status from the payment provider. Your card details are not stored by us.
3. Public store data
The service compiles data such as products, prices and contact details from publicly accessible store pages. Where such data can identify a natural person, the person may request deletion or object through the contact route below. [LEGAL: legal basis and retention for contact data to be determined.]
4. Purposes and legal bases
Creating the account and providing the service (performance of a contract), preventing abuse and keeping the service secure (legitimate interest), meeting legal obligations (legal obligation), improving the service (legitimate interest). Marketing messages are sent only with separate consent.
5. Sharing and transfers
Data is passed, only as far as necessary, to partners providing hosting, e-mail, payment and analytics services and to authorised public bodies. Product analytics and screen recordings are processed by PostHog in the EU (Frankfurt). Transfers abroad follow the conditions of the applicable law. [LEGAL: list of providers and countries to be added.]
6. Retention
Account data is kept while the account is open; records and invoices are kept for the statutory periods, then deleted or anonymised. [RETENTION PERIODS: to be filled in.]
7. Security
Passwords are stored as one-way hashes, connections are encrypted and access rights are limited. No system offers complete security.
8. Your rights and how to apply
You can exercise your rights of access, correction, deletion, objection and portability through [E-MAIL ADDRESS]. See the Privacy Notice for details.
9. Chrome extension
The extension sends the domain of the active tab to our server only when you open the popup. Never at any other time, never any other data. The extension uses your Roasan sign-in session; it does not read page text or track your browsing.