Rootfinda — Privacy Policy
Last Updated: February 2026 Effective Date: 01.03.2026 Operated by: Rootfinda Oy (Ltd), ID 3600623-6, Vanha Turuntie 36 A, 02700 Kauniainen, Finland
- Introduction
Rootfinda Oy (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights as a user.
This policy applies to all users of the Rootfinda service (“Service”) and should be read together with our Terms of Service.
We process your personal data as the data controller under the EU General Data Protection Regulation (GDPR) and Finnish data protection law (Tietosuojalaki 1050/2018).
- Data We Collect
2.1 Account Data
- Email address
- Account creation date and login activity
2.2 Payment Data
- Billing information processed via Stripe
- We do not store your full card details — these are held securely by Stripe under PCI-DSS compliance
- Transaction history (plan type, amount, date)
2.3 Conversation & Psychological Analysis Content
- All messages you send to and receive from the Rootfinda AI
- Your psychological blueprint (exploration phase content)
- Check-in responses and goal-oriented dialogue content
⚠️ Important: Conversation and psychological blueprint content may constitute sensitive personal data under GDPR Article 9, as it may reveal information about your mental health and emotional state. We handle this data with the highest level of protection.
2.4 Device & Usage Data
- Device type, operating system, browser type
- IP address (anonymised after 30 days)
- Session duration, feature usage, and interaction patterns
- Crash reports and technical diagnostics
- Why We Collect Your Data & Legal Basis
|
Purpose |
Data Used |
Legal Basis (GDPR) |
|---|---|---|
|
Providing the Service |
All categories |
Contract (Art. 6(1)(b)) |
|
Processing payments |
Payment data |
Contract (Art. 6(1)(b)) |
|
Account security & fraud prevention |
Account, device data |
Legitimate interest (Art. 6(1)(f)) |
|
Service improvement & analytics |
Usage data (anonymised) |
Legitimate interest (Art. 6(1)(f)) |
|
AI model training & improvement |
Conversation & analysis content |
Explicit consent (Art. 6(1)(a) + Art. 9(2)(a)) |
|
Legal compliance |
All categories as required |
Legal obligation (Art. 6(1)(c)) |
|
Sending service notifications |
|
Contract (Art. 6(1)(b)) |
|
Sending marketing communications |
|
Consent (Art. 6(1)(a)) |
- How We Use Your Data — Two Distinct Purposes
We use your conversation and psychological blueprint data for two separate purposes, each with its own legal basis and consent mechanism.
4.1 Delivering and personalising the Service to you
We use your conversation content to generate AI responses, build and update your psychological blueprint, and personalise your experience. This is necessary to provide the Service you have contracted for. The legal basis is contractual necessity (GDPR Art. 6(1)(b)). You do not need to give separate consent for this — it is inherent to using Rootfinda.
4.2 Improving our AI models (optional)
With your separate, freely given consent, we use fully anonymised and de-identified conversation content to improve Rootfinda’s AI models over time. This benefits all users but is not required to deliver the Service to you individually.
You will be asked to give this consent separately at registration via a clearly labelled checkbox. You can withdraw this consent at any time via Settings > Privacy without any impact on your access to the Service. Withdrawing consent means we will stop using your anonymised data for training from that point forward.
All data used for AI training is anonymised and aggregated before use. No personally identifiable information is used for model training
- Data Storage & Security
5.1 Location
All personal data is stored on servers located within the European Economic Area (EEA). We do not transfer your personal data outside the EEA.
5.2 Third-Party Processors
We use the following third-party processors, all operating under GDPR-compliant Data Processing Agreements (DPAs):
|
Processor |
Purpose |
Location |
|---|---|---|
|
Stripe |
Payment processing |
EEA (EU entity) |
|
[Cloud/hosting provider] |
Data hosting & infrastructure |
EEA |
|
[AI model provider] |
AI response generation |
EEA |
5.3 Security Measures
- End-to-end encryption for data in transit (TLS 1.2+)
- Encryption at rest for all stored personal data
- Strict access controls — only authorised personnel can access infrastructure
- Regular security audits and vulnerability assessments
- Pseudonymisation applied where possible
- Data Retention
|
Data Category |
Retention Period |
|---|---|
|
Account data |
Duration of account + 2 years after deletion |
|
Conversation & analysis content |
Duration of account + 90 days after deletion |
|
Payment records |
7 years (Finnish Accounting Act requirement) |
|
Anonymised usage data |
Up to 5 years |
|
IP addresses |
30 days (then anonymised) |
When your account is deleted, your personal data is permanently erased within 90 days, except where retention is required by law.
- Your Rights
Under GDPR you have the following rights:
Right of access — You can request a copy of all personal data we hold about you.
Right to rectification — You can ask us to correct inaccurate or incomplete data.
Right to erasure — You can request deletion of your personal data (“right to be forgotten”).
Right to restriction — You can ask us to limit how we process your data in certain circumstances.
Right to data portability — You can request your data in a structured, machine-readable format.
Right to object — You can object to processing based on legitimate interest.
Right to withdraw consent — Processing is based on consent (including AI training), you can withdraw at any time. This will stop your usage of the service.
To exercise any of these rights, go to settings in your account. Or contact us at support@rootfinda.com. We will respond within 30 days.
- Cookies & Tracking
Rootfinda uses only essential cookies required for the Service to function. We do not use advertising or third-party tracking cookies.
|
Cookie Type |
Purpose |
Duration |
|---|---|---|
|
Session cookie |
Keeps you logged in |
Session |
|
Security cookie |
CSRF protection |
Session |
|
Preference cookie |
Stores language/settings |
1 year |
You can manage cookies via your browser settings. Disabling essential cookies may affect Service functionality.
- Children’s Privacy
Rootfinda is strictly for users aged 18 and over. We do not permit persons under 18 to use the Service under any circumstances, including with parental consent. We do not knowingly collect data from anyone under 18. If you believe a user under 18 has provided us with personal data, please contact support@rootfinda.com and we will delete it promptly.
- Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you by email and in-app notification at least 30 days before material changes take effect. Continued use of the Service after that date constitutes acceptance of the updated policy.
- Supervisory Authority
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto):
- Website: tietosuoja.fi
- Email: tietosuoja@om.fi
- Address: PL 800, 00531 Helsinki, Finland
EU users may also contact their local data protection authority.
- Contact
For all privacy-related questions or to exercise your rights:
Privacy: support@rootfinda.com Address: Rootfinda Oy, Vanha Turuntie 36 A, 02700 Kauniainen, Finland
Rootfinda Oy (Ltd) | Business ID: 3600623-6 This policy should be read together with our Terms of Service and Subscription Plans.