Privacy Policy

1. Data Controller

RODZ (SASU) is the data controller for personal data collected via the website www.rodz.io and the platform app.rodz.io.

Registered office: 13 rue La Pérouse, 44000 Nantes, France
RCS Nantes: 107 393 043
Contact: hello@rodz.io

2. Data Collected

We collect the following categories of data:

Account Data

When you register on app.rodz.io: name, surname, email address, company name, password (encrypted), API keys for third-party services you choose to connect.

Contact Data

Via site forms or HubSpot: name, surname, email, company, phone number.

Prospect and Intent Signal Data

As part of our Services, we collect and enrich publicly accessible professional data: company name, industry, size, professional contact details of decision-makers, intent signals (hiring, fundraising, technologies used, etc.).

Payment Data

Transactions are managed by Stripe. We do not store your credit card information. We only retain transaction identifiers and billing history.

Browsing Data

IP address, browser type, pages visited, visit duration, collected via Google Analytics.

Platform Usage Data

Credit consumption, intent signal configuration, data delivery history, error logs.

Connecting Rodz to an AI assistant (MCP)

When you connect Rodz to Claude or another assistant through our MCP server (https://api.rodz.io/mcp), Rodz receives only the tool calls the assistant decides to make: the tool's name and its parameters (for example a company domain to enrich, or a signal's settings). We never receive your conversation, your prompts, the assistant's other answers or your files. Each tool call runs as a request to our API on your account, with the same access rights and credit prices, and its result is sent back to the assistant.

What we store: our technical request logs record the route called, the time, the response status and the IP address (retention: see section 5). A call that spends credits is recorded in your account's credit history (date, route, credits). What a tool creates or changes, such as a signal or a watchlist, is saved in your account like anything you do in the app. For each connection we keep the assistant's name, the member who connected it, the connection date and the date it was last used.

Sign-in uses OAuth: you log in on app.rodz.io and approve the access, so the assistant never sees your Rodz password. The access tokens it receives expire after 1 hour and only work on the MCP server; the refresh token changes at every use and expires after 30 days without use. We store these tokens only as one-way hashes. You can cut an assistant's access at any time in Settings, Connected apps, Revoke: it takes effect immediately. Access also ends when the member who connected it leaves your account. What you write to the assistant, and what it does with the results we return, is governed by the assistant publisher's own privacy policy (for Claude, Anthropic's).

Use of the Rodz API through AI assistants (MCP)

When you or your AI assistant use Rodz through our MCP servers (the Rodz connector in Claude, or the @rodzio/mcp-server package), we record each call: your account, the tool called, its arguments, the outcome (success, error, no result) and its duration. Before storage, email addresses are reduced to their domain and names and phone numbers are removed; LinkedIn profile and company URLs are kept. The purpose: understanding which features are used and where Rodz falls short, so we can improve the platform (our legitimate interest). The same applies to the capability requests your assistant sends us. This data is neither sold nor shared with other customers. Retention: 90 days. You can ask us to delete it at hello@rodz.io.

3. Processing Purposes

Your data is processed for the following purposes:

• Providing and managing our Services (intent signal detection, enrichment, and data delivery)
• Managing your user account and subscription
• Payment processing and billing
• Responding to your contact requests and customer support
• Audience measurement and improvement of the site and platform
• Sending marketing communications (with your consent)
• Fraud and abuse detection and prevention
• Improving the platform from API and AI assistant usage (legitimate interest)
• Compliance with legal obligations

4. Legal Basis for Processing

Under GDPR, each processing activity is based on a legal basis:

• Contractual performance: account management, service provision, billing
• Consent: non-essential cookies, marketing communications
• Legitimate interest: improving our Services, platform security, business relationship
• Legal obligation: billing data retention, responding to legal requests

5. Data Retention

• Browsing data: 13 months maximum
• Contact data (prospects): for as long as the customer account that received them is active; deleted when that account is deleted, or earlier upon a valid request from the data subject (section 8). Delivered prospects are the prospecting history the customer paid for, which is why there is no fixed expiry date.
• Account data: duration of contractual relationship + 5 years
• Billing data: 10 years (legal obligation)
• Technical and error logs: 12 months
• API and AI assistant call records (masked): 90 days

6. Sub-processors and Data Transfers

We use the following sub-processors to operate our Services:

Hosting and Infrastructure

• Hostinger (European Union): site and platform hosting

Payment

• Stripe (United States): credit card and SEPA payment processing

Analytics and Monitoring

• Google Analytics (United States): site audience measurement

CRM and Communication

• HubSpot (United States): customer relationship management and marketing
• Resend (United States): transactional email delivery

Artificial Intelligence

• Google Gemini (United States): data processing for intent signal enrichment

For sub-processors located in the United States, data transfers are governed by the EU-U.S. Data Privacy Framework or by Standard Contractual Clauses approved by the European Commission.

7. Cookies

This site uses:

• Essential cookies: required for site functionality (authentication, preferences)
• Google Analytics (GA4): audience measurement with IP address anonymization

You can configure your browser to refuse non-essential cookies. Disabling certain cookies may limit access to some site features.

8. Your Rights

Under GDPR, you have the following rights over your personal data:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your data
• Right to data portability: receive your data in a structured, readable format
• Right to object: object to the processing of your data
• Right to restriction: request processing restriction in certain circumstances
• Right to withdraw consent: withdraw your consent at any time for consent-based processing

To exercise these rights, contact us at: hello@rodz.io

We commit to responding within one month. We may ask you to verify your identity before proceeding.

You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés): www.cnil.fr.

9. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure. These measures include password encryption, secure connections (HTTPS), and data access restrictions.

10. Third-party Links

Our site may contain links to third-party websites. We are not responsible for the privacy practices of these sites and encourage you to review their respective policies.

11. Changes to This Policy

We may update this privacy policy from time to time. In case of substantial changes, we will notify you by email or by a visible notice on our site. The last update date is indicated at the top of this page.

12. Contact

For any questions about this policy or the processing of your personal data, contact us at: hello@rodz.io