Privacy Policy

Ropely, Inc. operates ropely.io. For Ropely account data we are the controller. For merchant-customer identifiers and commercial facts you send so we can compare purchases with grants, you are typically the controller and Ropely is the processor. The DPA describes that processor role.

Contact the controller at privacy@ropely.io.

This policy covers visitors to ropely.io, people who create or are invited to a Ropely account, and the merchant-customer data a workspace sends. It does not cover Stripe, RevenueCat, or your own application's policies.

We collect:

• Account data: name, email, organization membership, role, and authentication events
• Workspace configuration: connected sources, product mappings, and operator notes
• Merchant customer data you instruct us to process: customer identifiers, purchase and subscription facts, purchased units, granted units, and related timestamps
• Evidence payloads needed to reconstruct a finding, stored encrypted
• Technical data: IP address used to sign in, browser type, and coarse device class
• Cookie preferences and, only if you allow it, privacy-safe page analytics

We do not collect card numbers, CVC, or bank details. We are not a payment processor. We do not claim zero personal data. Account email and name are stored. Merchant-customer identifiers are stored when you send them.

We use personal data to:

• create and secure your account (contract and legitimate interests)
• run purchased-versus-granted comparisons and show findings (contract and your instructions as controller)
• prevent abuse, debug faults, and keep an evidence trail (legitimate interests and legal obligation)
• reply to privacy or legal requests (legal obligation)
• measure site usage only after you opt in to analytics (consent)

We do not sell personal data. We share it with subprocessors listed on /subprocessors, with professional advisers under confidentiality, and with authorities when the law requires it. If you enable Investigator in Test, prompts are sent to that model provider only in that environment.

Intended production hosts include Fly.io and Cloudflare, which may process data in the United States. When a confirmed subprocessor is outside the EEA, we will rely on that vendor's published transfer tool, such as Standard Contractual Clauses, before that production use. Candidate hosts are not a live transfer until they are confirmed on the subprocessors page.

Account data is kept while the workspace is active and then for a limited period needed for security and legal claims. Evidence retention follows the operational target on your plan. A deletion request starts a documented lifecycle. We do not claim instant or complete erasure of every backup or immutable ledger row on the day you ask.

Disconnecting a source does not by itself erase evidence already stored. End customers of a merchant should send erasure requests to that merchant.

If we are the controller of your Ropely account, you may request access, rectification, erasure, restriction, objection, or portability, and you may withdraw consent for optional analytics. Write to privacy@ropely.io. If you are in the EEA or UK you may also complain to your local supervisory authority.

If we process your data only as a processor for a Ropely merchant, contact that merchant. We will assist them under the DPA.

Ropely is a business service. It is not directed at children under 16. We do not knowingly collect their data.

See the Cookie Policy. Essential cookies do not require consent. Analytics stays off until you allow it. Marketing cookies are not used.

We will post material changes on this page and, when we have your email, notify the account address.

Cookies · DPA · Subprocessors · Security