Privacy policy
Who is responsible for your personal data, what we do with it, how long we keep it, and how to make us delete it.
Effective date: 2026-09-13 · Version: 1.0.0
Who is responsible
Rollfuse is the controller of the personal data described on this page. That means we decide why it is collected and what is done with it, and we are the party you hold to this policy.
For anything to do with your personal data — a question, a complaint, or a request to exercise one of your rights — the contact is privacy@rollfuse.com. It reaches a person, not a queue, and it is the address to use in preference to general support.
What we collect and why
Creating an account: your email address and name, taken from your Google account when you sign up or sign in with it, and the organization you are a member of. We never receive or store your Google password. This is necessary to open and operate the account you asked for.
Paying for a subscription: your card details and billing address are collected and stored directly by Stripe, our payment processor. They never reach our own servers. We keep only what identifies your subscription on our side: which plan, its status, and Stripe's own reference for it. This is necessary to bill you for the plan you chose.
Contact and lead-capture forms on this site: the email address you give us, the company name if you choose to give it, and how you arrived at the page (the referring page and campaign, if any), so we know which channels bring us genuine interest and can follow up. This rests on our legitimate interest in responding to you and understanding what drives sign-ups, weighed against the modest, non-sensitive nature of what a form like this collects.
A support request: whatever you tell us in the ticket, and any file you choose to attach. This is necessary to give you the help you asked for.
What is collected in your browser as you use the site, including what our advertising partners receive when you allow the marketing category, is described in full in the visitor-tracking table below and in the cookie policy.
Visitor tracking and its lawful basis
Everything this site collects about a visitor falls into one of the categories below, and each one states what it is for, the lawful basis we rely on, and how long it is kept. A category that is not in this table is not collected.
Where the basis is your consent, nothing starts until you give it. Not started and then filtered: never started. No script is set up, no identifier is created and no request leaves your browser before you have said yes. Withdrawing consent stops it again from the next page you load, deletes the identifiers it used, and is recorded exactly the way the consent was.
There is one exception, and we would rather name it than let you find it: Google's tag container loads on every page, including before you decide and after you refuse, in a mode that is told to store nothing on your device. It stores nothing, and it still sends Google a request. The cookie policy sets out exactly what that request carries.
Two of the categories below are held in our monitoring system rather than in our own database, and that system's retention is set by the plan we subscribe to rather than by us. We have not yet checked that period against our own subscription with the same confidence as the rest of this table, and we would rather say so than publish a number we have not verified; we will correct this line, with a new version and effective date, once we have.
| What we collect | What it is for | Lawful basis | How long we keep it |
|---|---|---|---|
| Site operation | Keeps you signed in, remembers the language you chose and the pricing you were shown, and groups your page views into a single visit so we can count visits. The visit id is written and read by your own browser and is never sent to us. | Strictly necessary to provide the site you asked for, which is why these are not behind the consent banner and cannot be switched off. | Up to 12 months, and the session cookies only until you close your browser. The cookie policy lists every one of them with its own lifetime. |
| Aggregate measurement | Counts of page views, visits, funnel steps and consent decisions, labelled only by route, language and step. No identifier is attached to them, and no individual can be picked out of them. | Our legitimate interest in knowing whether the site works, and in knowing how much of that picture consent leaves out. Because these counts identify nobody, they are kept for every visitor, including one who refused everything. | Held in our monitoring system as counts with no person in them, so there is no individual record to expire. The note above this table covers that system's own retention. |
| Your consent decision | Records what you allowed and when, so that we honor it, stop asking you again, and can show later exactly what you agreed to. | A legal obligation: we have to be able to demonstrate that consent was given. A withdrawal is recorded in the same way, for the same reason. | The choice itself stays in your browser for 12 months. The record of it is kept for 5 years, deliberately longer than the data it authorized. Enforced today. |
| Visit history | Which pages you visited and in what order, which campaign brought you here, and whether the visit led to a sign-up, so we can tell what is working. We store this ourselves; we do not sell or share it. | Your consent to the analytics category. No identifier is created and nothing is recorded before you give it, and withdrawing it deletes those identifiers from your browser. | 14 months, then deleted automatically. Enforced today. |
| Advertising and campaign measurement | Lets Google and Meta recognise this browser, so we can measure what our campaigns produced and show you relevant ads. | Your consent to the marketing category. Meta's tag does not load at all without it. Google's tag loads in a mode that stores nothing on your device until you grant it, and the cookie policy describes exactly what that mode still sends and why. | Up to 24 months, set and kept by Google and Meta under their own policies rather than ours. |
| Ad click identifier and conversions | If you arrived from one of our Google ads, the click identifier Google added to the link. If you then create an account or pay for a plan, we report that outcome to Google Ads against the identifier, with the amount paid for a payment, so we know which ads produce customers. Nothing else about you, no email, name or account, is sent with it. | Your consent to the marketing category. Without it the identifier is never sent to us and nothing is reported. Erasing your data deletes it and any report not yet sent. | 14 months on our servers, then deleted automatically. Enforced today. A report already sent is kept by Google under its own policy. |
| Browser telemetry | Errors your browser hit on our pages, how long a page took to load and become usable, and the requests the page made, so that we find a broken or slow page before you have to report it. The address recorded with an error is stripped of the values that could carry a secret, and no visitor identifier is attached to any of it. | Your consent to the analytics category, on the same terms as visit history: nothing is set up and no request is sent before you give it. | Held in our monitoring system. The note above this table covers that system's own retention. |
How long we keep it
Each store of personal data has a stated period. Where a period is not yet enforced by an automated process, it is stated here as a commitment we are building towards rather than one already running, and this page says which is which.
What follows the period is not always deletion. Where a record has to survive for a reason of its own — an audit trail is the clearest case — the period ends the part of it that identifies you, and the rest is kept. The table says which happens.
| What | How long we keep it | Enforced today |
|---|---|---|
| Account and profile data | While the account is open, then erased or anonymized within 30 days of closure or a granted erasure request | Not yet |
| Leads from forms on this site | 24 months from your last activity, then deleted | Not yet |
| Audit records | 7 years, then the record is kept with your identity replaced by an anonymous marker, because a trail with holes is no trail. The same thing happens to it, sooner, if you ask us to erase your data | Not yet |
| Support tickets and their attachments | 3 years after the ticket is closed, then deleted with the files attached to it | Not yet |
| Visitor journey data | 14 months | Yes |
| Ad click identifiers and the conversions reported with them | 14 months | Yes |
| Your cookie consent decision | 5 years. Deliberately longer than the data it authorized, because the evidence of your choice has to outlive it | Yes |
| Identity-resolution records | 14 months, then deleted | Not yet |
Who else processes your data
We use a small number of outside services to run the platform. Each one is named, with what it does and where it processes data, on the subprocessor list.
Where your data is stored
Today, all of it lives in a single United States region. That is the whole infrastructure: one database, one application, one attachment store, all in the same place, and it is also what our subprocessor list's processing locations reflect.
When you set up your organization, this platform lets you declare a residency region. That declaration is recorded and audited, but it is not yet backed by regional infrastructure: only the United States region is actually served today, and a region we do not serve is refused at the point you would select it rather than accepted and quietly stored here anyway. We would rather say plainly what we do not yet offer than publish a commitment our infrastructure does not honor.
Your rights, and how to exercise them
Write to privacy@rollfuse.com to ask what we hold about you, to correct it, or to have it erased. We will ask you to confirm you are who you say you are, because handing someone else's data to the wrong person is the failure this check exists to prevent.
We respond within 30 days of a verified request. When the answer is that something is kept rather than deleted — an audit record, or a billing record we are obliged to retain — we tell you which store it is and the reason, rather than reporting an erasure that did not happen.
Data processing agreement
If you need a data processing agreement in place before your organisation can use the platform, write to privacy@rollfuse.com and ask for one. There is no form and no portal; a plain email naming your organisation is enough to start.
Changes to this policy
Every version of this page carries an effective date and a version marker, at the top. When the substance changes we move both, so you can tell at a glance whether what you read last time still applies.