Privacy Policy
Last updated: April 15, 2026
This Privacy Policy describes how RootCX ("RootCX", "we", "us") collects, uses, stores, and discloses personal data in connection with our websites, hosted platform, developer tools, and self-hosted software (collectively, the "Services").
We are committed to protecting personal data in accordance with the General Data Protection Regulation (GDPR) and applicable European and Belgian data protection laws.
1. Scope and applicability
This Privacy Policy applies to:
- visitors to our websites (including rootcx.com);
- customers and their authorized users of the Services;
- individuals who communicate with us for sales, support, or contractual purposes.
If your personal data is uploaded or processed by a customer through our Services, the customer is the data controller and we act as a data processor on its behalf. In that case, the customer's privacy policy governs how your data is handled. If you have questions about such processing, please contact the customer directly.
For personal data we collect in our own capacity (account registration, website analytics, billing), we are the data controller.
2. Data we collect
We collect only the personal data necessary to provide, secure, and improve the Services. The categories below describe what we collect and when.
| Category | Examples | When collected |
|---|---|---|
| Identity & contact | Name, email, company, job title | Account signup, contact forms |
| Credentials | Hashed passwords, SSO tokens, API keys | Authentication |
| Technical & usage | IP address, browser type, device info, session duration, pages visited, feature usage | Automatically during use |
| Billing & transactions | Company address, VAT/tax ID, subscription records, payment method (processed by Stripe) | Checkout, invoicing |
| Communications | Support tickets, emails, in-product messages | When you contact us |
| Audit logs | User actions within a project (login, data access, configuration changes) | Automatically during use |
We do not intentionally collect special categories of data (e.g., health, biometric, political opinions). If you believe such data has been submitted in error, contact us so we can delete it.
3. Why we process your data
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Services and manage your account | Performance of a contract |
| Process billing and collect payments | Performance of a contract |
| Send transactional communications (account confirmations, security alerts, billing receipts) | Performance of a contract |
| Respond to support requests and inquiries | Performance of a contract / Legitimate interest |
| Improve service reliability, performance, and features | Legitimate interest |
| Monitor and enforce security and acceptable use | Legitimate interest / Legal obligation |
| Produce aggregated, de-identified analytics | Legitimate interest |
| Comply with tax, accounting, and legal obligations | Legal obligation |
| Send product updates or marketing (only with consent) | Consent |
Where we rely on legitimate interest, we have assessed that our interest does not override your fundamental rights and freedoms. You can request details of these assessments by contacting us.
4. AI agents and model providers
RootCX lets customers configure AI agents that call third-party model providers (for example, Anthropic, OpenAI, Mistral) using credentials the customer supplies. When an agent runs:
- Customer Data sent to the model provider is governed by the model provider's terms and privacy policy, not this Policy. We recommend customers review their provider's data handling before enabling AI features.
- We do not use Customer Data to train models. We do not operate our own foundation models and do not feed Customer Data into any training pipeline.
- Audit logging. Every agent action is recorded in the project's audit log so the customer can review what data was accessed and what actions were taken.
6. International data transfers
RootCX is based in Belgium. Some of our subprocessors operate outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:
- European Commission adequacy decisions;
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- supplementary measures where required by the circumstances of the transfer.
Customers who self-host RootCX control where their data resides and are responsible for their own transfer mechanisms.
7. Data retention
We retain personal data only as long as necessary for the purposes described in this Policy or as required by law. General retention periods:
| Data type | Retention period |
|---|---|
| Account data | Duration of the contract + 90 days after termination |
| Customer Data (Cloud) | Duration of the subscription; exportable for 30 days after termination, then deleted |
| Billing data | As required by Belgian and EU financial regulations (typically 7 years) |
| Audit logs | Per plan (7 days Free, 30 days Pro, 1 year Team/Enterprise) |
| Support communications | Up to 365 days after resolution |
| Website analytics | 26 months (aggregated and de-identified where possible) |
When data is no longer needed, we delete or anonymize it. Backups are purged on their normal rotation schedule.
8. Data security
We implement commercially reasonable technical and organizational measures to protect personal data, including:
- encryption in transit (TLS 1.2+) and at rest;
- role-based access controls and principle of least privilege;
- encrypted secrets vault for API keys and credentials;
- immutable audit logging of administrative and data-access events;
- regular security reviews and dependency monitoring.
No system is completely secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant supervisory authority in accordance with GDPR Article 33 (within 72 hours where feasible).
9. Your rights
Under the GDPR and applicable data protection laws, you have the following rights regarding the personal data we control:
- Access — obtain confirmation of whether we process your data and request a copy.
- Rectification — correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — request deletion of your data where there is no compelling reason for continued processing.
- Restriction — request that we limit processing in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest, including profiling.
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email us at legal@rootcx.com. We will respond within 30 days. We may ask for proof of identity before processing your request. Some data may be retained where required by law or for legitimate business purposes (e.g., billing records).
If you believe we have not handled your request appropriately, you have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit) or the supervisory authority in your country of residence.
11. Children’s privacy
The Services are not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
12. Self-hosted deployments
When you self-host RootCX, your data stays on your infrastructure. We do not have access to it unless you explicitly grant access (for example, for support). This Privacy Policy does not govern data processed exclusively on self-hosted instances. You are responsible for your own privacy compliance in that context.
13. Changes to this Policy
We may update this Policy to reflect changes in our practices, the Services, or applicable law. If a change is material, we will notify you at least 30 days in advance by email or in-product notice. Non-material changes take effect when posted. The "Last updated" date at the top indicates the most recent revision.
14. Contact
For privacy-related questions, data subject requests, or to request our subprocessor list or Data Processing Addendum, contact us at legal@rootcx.com.
RootCX — Belgium. For general inquiries: contact@rootcx.com.
Questions about our Privacy Policy?
We're here to help with any privacy-related questions or data subject requests.
Contact Privacy TeamThis document does not constitute legal advice. RootCX recommends you consult your legal counsel for compliance questions specific to your use case.