Privacy Policy for Agencies

Under the General Data Protection Regulation (GDPR) and similar global privacy frameworks, the relationship between ROWANe and the Customer is defined as follows:

• Data Controller: The Customer (the agency administering the tenant) is the Data Controller for all client communications, uploaded files, tasks, team details, and settings stored within their workspace.
• Data Processor: ROWANe is the Data Processor. We act solely on your instructions to store and organize your tenant data. We do not sell, rent, or leverage your workspace content or client information for marketing or advertising.

We collect only the minimum data required to deliver secure, reliable agency workspace features:

• Account Credentials: Email address, cryptographically hashed passwords, and profile metadata (name, avatar image).
• Session and Access Logs: IP address, browser user-agent strings, and active tenant ID mapping (used to prevent token theft and enforce IP allowlisting).
• Workspace Contents: Client details, sprint and task data, documents, comments, and project budgets.
• OAuth Tokens: Temporary access tokens for integrated services (e.g., LinkedIn API for publishing, Jira API for task importing).

ROWANe is architected with strict defense-in-depth engineering principles:

• Database Isolation: Data from different organizations is isolated logically within Postgres via organization-scoped filters. No tenant user can access another tenant’s record database table space.
• Pre-Upload Client Hashing: Files uploaded to the Platform are analyzed in your browser, where a SHA-256 hash is computed before transmission. ROWANe uses this hash to deduplicate storage assets.
• Expiring Presigned Links: File delivery is secured via temporary presigned URLs. Access tokens are appended to the URL and automatically expire in 15 minutes, neutralizing leaks if a URL is shared.
• Strict IP allowlists: Admin-configured IP allowlists gate API entry. Request IPs are checked before database queries execute, blocking unauthorized network connections immediately.
• Security Audit Stream: The Platform records every document download, team member invitation, and permission change in an append-only, immutable audit trail.

We share metadata only with verified, secure sub-processors necessary to run the Platform:

• Hosting and Infrastructure: Our PostgreSQL databases and Next.js applications are hosted on industry-standard cloud providers (such as AWS or GCP) with strict server firewalls and encryption-at-rest.
• Subscription Payments: Subscription processing is handled securely by Paddle. We do not store or transmit credit card details on our servers.
• Third-Party APIs:
  • LinkedIn integration: Access tokens are stored encrypted and used solely to publish scheduled updates on your instruction. We do not read personal feeds.
  • Jira integration: API access tokens are stored securely to query and sync your project tasks. We never overwrite or delete data in Jira.

When a Customer requests technical support, an authorized platform superadmin may impersonate the user’s session to diagnose issues:

• Read-Only Preference: Impersonated support sessions default to read-only queries. Support staff cannot modify database entries unless explicitly authorized to resolve a critical failure.
• Audit Record: All superadmin session entries, query logs, and impersonation starts write a permanent, immutable record that cannot be deleted by ROWANe support staff.
• Log Retention: Security audit logs and impersonation logs are retained for compliance review according to your tenant retention policy.

ROWANe fully supports European Union GDPR, UK GDPR, and CCPA privacy standards:

• Right to Export: Tenant administrators can export a full structured archive of all client, document metadata, tasks, and audit logs stored within their workspace.
• Right to Erasure (“Right to be Forgotten”): Organization owners may delete their tenant at any time. Deleting a tenant executes a cascade delete across all PostgreSQL workspace tables, removing all associated files, records, and sessions permanently within 30 days.
• Cookie Controls: Users can adjust cookie preferences at any time. Essential authentication cookies are always active, but analytics and functional cookies remain disabled until consent is granted.

If you have any questions about this Privacy Policy, your organization’s data isolation constraints, or wish to report a security vulnerability, contact us at hello@rowane.app.