Privacy Policy

1. Who we are

Roasit is operated by Bivex AI Inc., 8 The Green, Ste B, Dover, DE 19901, United States. For the data about the people who use Roasit's site and dashboard, we are the controller. For the data our customers' apps send us about their end users, the customer is the controller and we are its processor: we handle that data only on the customer's instructions, to provide the service.

2. Data about you, the dashboard's users

• Account: your name, email address and password (stored only as a one-way hash), your workspace, your role and the apps you can see. If you sign in with Google, your Google account's name, email address and id.
• Billing: your plan, your invoices and your billing address. Card details go straight to Stripe and never reach us.
• Use and security: when you sign in, the IP address and browser a sign-in came from, the API keys and connected apps you create and when they were last used, and security logs.
• Messages: what you write to us.

We use it to run your account and workspace, sign you in and keep it secure, bill you, send the service's emails (sign-in, invitations, your plan's usage at 80% and 100%, billing), answer you, and meet our legal obligations. Our legal bases are our contract with you, our legitimate interest in keeping the service secure and working, and the law. We send no marketing email without your consent.

3. Data we process for our customers about their apps' end users

When a customer's app uses Roasit's SDK or API, or the customer connects an ad network, an app store or a revenue source, we process for that customer:

• device and advertising ids: the install id the SDK creates, the IDFV, and the IDFA or the Google advertising id where the app has the end user's permission to read it; any user id the app sets;
• the device's IP address and the country it is in, the device model, the operating system and the app's version;
• install and in-app events: installs, sessions, the events the app sends, and the ad clicks and views that led to an install (tracking-link clicks, click ids, campaign names);
• purchases: product, amount, currency, store order id, refunds and subscription status, from the app, the stores, Stripe, Adapty or AppLovin MAX.

We process it to attribute installs to the campaigns that brought them, to measure retention, revenue and return on ad spend, to filter fraud, and to send the conversions the customer chooses back to the ad networks it connects (postbacks). We do not use it for our own purposes, we do not sell it, and we do not combine it across customers.

An end user's questions about this data go to the app's publisher, who decides about it; we help our customers answer them, and pass on any request that reaches us.

4. How long we keep it

• Raw events: 35 days by default, then deleted from our database. Where a customer has set up an archive for an app, its raw events are kept there for that customer.
• Install records and the aggregated figures the reports are made from: while the app exists in the customer's account.
• Account and billing data: while your account is open, and after that as long as the law requires (invoices, for example).

When a customer deletes an app or closes its account, we delete that data from our systems; backups are overwritten on their own cycle.

5. Who helps us (sub-processors)

Roasit runs on our own servers. These companies help us run it, each under a written agreement and only for us:

• Amazon Web Services: email delivery (Amazon SES) and the raw-event archive (Amazon S3);
• Cloudflare: the network in front of roasit.com, which delivers it and protects it from attacks and bots;
• Stripe: billing and payments;
• Google: Sign in with Google, for those who choose it.

Data goes to the ad networks, stores and revenue sources a customer connects only because the customer connected them; they handle it under their own terms. Some of these companies are outside your country, in the United States among others; where the law asks for it, those transfers rest on safeguards such as the European Commission's standard contractual clauses.

6. Security

Passwords are stored as one-way hashes, the partner credentials you save are encrypted at rest, and every connection to Roasit is encrypted (HTTPS). Only the people who run the service can reach its servers.

7. Your rights

Depending on where you live, you can ask to see, correct, export or delete your data, to object to or restrict its use, and to withdraw a consent you gave. Write to [email protected]; we answer within a month. You can also complain to your data protection authority.

If you use an app that uses Roasit, write to the app's publisher; we pass on any request that reaches us.

8. Cookies

Roasit's site and dashboard set only the cookies that keep you signed in: the session cookie (ro_session) and one that tells your browser apart for sign-in protection (ro_known). Cloudflare, which protects the site, may set a strictly necessary security cookie. Your browser also keeps a few preferences on your device, such as the theme you chose. We use no advertising or analytics cookies and no third-party trackers.

9. Children

The dashboard is for businesses, not for children. A customer whose app is directed at children must follow the laws that protect them (COPPA, for example) and must not send advertising ids where those laws forbid it.

10. Changes to this policy

We post changes here with a new date, and tell account holders by email about the changes that matter.

11. Contact

Bivex AI Inc., 8 The Green, Ste B, Dover, DE 19901, United States. Email: [email protected].