Privacy Policy

1. What we collect

Account data

• Identity. Your name and email address. Sign-in is Google only: we receive your name, email address and profile picture from Google, we never receive your Google password, and we store no password of our own.
• Billing. Billing name, email, address, country, state and tax identifier, plus an invoice per cycle and the payment processor's references. Card and bank details are entered with the processor and never reach our servers.
• Team. Who belongs to which project, in which role, and pending invitations with the email address they were sent to.
• Operational records. Sign-in sessions, connector run receipts, and server logs used to keep the service working and secure.

Connector credentials

The keys, tokens and service accounts you supply for PostHog, Google Search Console, Bing Webmaster Tools and Cloudflare. They are encrypted at rest with AES-256-GCM under a master key held only on the server, and are decrypted server-side solely to perform a read.

Project data read from your sources

• Traffic and content. Page URLs and their metrics, search queries with impressions, clicks and position, index status, and edge and AI-crawler requests by path and bot.
• People. Where your own analytics identifies a person, we mirror that identity: name, email address, phone number, country and city, device, first source, and the events and payments attributed to them. This is the data behind the Users and Journeys screens.
• Money. Payment, signup and activation events, as named by you in your project's configuration, and the revenue attributed to the payer's first touch.

We do not serve a tracking script to your website's visitors and we place no cookies on their browsers. Everything above arrives from the accounts you connect, on the schedule the product runs.

2. How we use it

• To run the service: reading your connected sources, computing the rollups, and rendering the screens for the people you have given access to.
• To manage your account: authentication, invitations, plan limits, invoicing and tax.
• To communicate: transactional email about invitations, billing, service changes and this policy. We do not send marketing email to your visitors or customers.
• To support and secure: diagnosing a problem you report, which can require an authorised member of our team to look at data in your project, and detecting abuse.

We do not sell or rent any of it, we do not use your project data to train machine-learning models, and we do not use it to build a profile of anyone for our own purposes.

3. Legal basis and your responsibilities

We process account data to perform our contract with you, to meet legal obligations such as tax record-keeping, and for the legitimate interest of keeping the service secure. We process project data on your documented instructions as your processor.

Because your sources can carry data identifying your visitors and customers, you are responsible, as their controller, for having a lawful basis for collecting it, for telling them about it — including that a processor holds it on your behalf — and for obtaining consent where the law requires it. We assist you in answering their requests; see your rights and theirs below.

4. Who else sees it

We share data only with the providers needed to run the service, each under its own agreement and only to the extent its function requires:

• Database and application hosting, which stores everything the service holds.
• Payment processors, which take your payment details directly and return the references we store.
• Transactional email delivery, which receives the address and text of an invitation or billing notice.
• Google, Bing, Cloudflare and PostHog, which are the sources you authorise us to read from, not recipients of your data.

We otherwise disclose data only where the law compels us, and we will tell you unless we are prohibited from doing so. If the business is ever sold or merged, data may transfer with it; you will be notified before that happens.

5. Cookies

Our own site sets only the cookies needed to sign you in and keep you signed in. There are no advertising cookies, and we run no third-party analytics or trackers on it. Blocking these cookies prevents signing in.

6. Security

• Connector credentials are encrypted at rest with AES-256-GCM and decrypted only on the server, at the moment of a read.
• We store no passwords at all. Sign-in is delegated to Google, so there is no password here to guess, leak or reset.
• Every request is checked against the caller's role in the project it names, and each project's data is isolated from every other.
• An owner may hide revenue figures from viewers, so a member who should see behaviour but not money sees the shape of the data without the amounts.

No system is perfectly secure. If a breach affects your data we will notify you and, where required, the relevant authority, without undue delay.

7. How long we keep it

• Project data is kept while the project exists and is read back only as far as your plan's history window. Deleting a project deletes its configuration, its stored credentials and its collected data.
• Account data is kept while your account is open. Close it and we delete it, apart from what we must keep.
• Invoices and tax records are retained for the period Indian law requires, regardless of account closure.
• Backups are rotated on a fixed schedule, so a deletion is reflected in them as they age out.

8. Your rights

You may ask us to give you a copy of your account data, correct it, delete it, or restrict or object to how we use it, and you may withdraw consent where consent is what we relied on. Write to support@rookdash.com and we will respond within 30 days. If you are in the EU or UK you may also complain to your supervisory authority; in India you may refer a grievance to the Data Protection Board after raising it with us.

If you are a visitor or customer of a business that uses this service and you want your data accessed or deleted, ask that business: they decide what happens to it, and we act on their instruction. If you write to us directly we will pass your request to them.

9. International transfers

The service and its providers may process data outside your country, including outside India and the EEA. Where that happens we rely on appropriate safeguards, such as standard contractual clauses, with each provider.

10. Children

The service is for businesses. It is not directed at children, and we do not knowingly hold an account for anyone under 18. Tell us if you believe we have, and we will delete it.

11. Changes to this policy

We may update this policy. Material changes are notified by email to account owners, and the date at the top of this page always states the version in force.

12. Contact

Privacy questions, data requests and grievances: support@rookdash.com, addressed to SS Wealthserv Technologies Pvt Ltd. We acknowledge every request on receipt.