This policy explains which personal data is collected when you use the roonaworks.com website and the Roona service, why it is collected, how long it is kept, and how to exercise your rights. It is written to be read by a business owner, not only by a lawyer. Any question can be sent to rgpd@roonaworks.com.
1. Who processes your data
The data controller is CLEO IA, a simplified joint-stock company (société par actions simplifiée) under French law with share capital of €1,000, registered with the Bourg-en-Bresse Trade and Companies Register under number 995 370 319, whose registered office is at 374 E Route de Charmeil, 01340 Attignat, France, and which operates the service under the Roona brand. EU VAT number: FR16995370319. Legal representatives: Clément Thomas, President, and Théo Gouin-Pelletan, Managing Director.
2. The data we collect
We collect only what is necessary to run the service. This data falls into five categories.
Account data: surname, first name, work email address, password in encrypted form, language and display preferences.
Business data: company name, business sector, your website address, and the information you provide during set-up.
Content you entrust to us: the documents you upload, your conversations with Roona, your voice dictations, and the files produced for you. This content is encrypted before it leaves your browser.
Connection data for third-party services: when you link your mailbox, your calendar or a business application, the authorisation tokens required. We never have access to your Google or Microsoft passwords.
Technical and billing data: connection logs, IP address, browser type, subscription and payment history.
3. Why we process it
Every item of data has an identified purpose.
Providing the service: creating your account, producing your documents, finding information in your files, carrying out the tasks you ask for.
Keeping the service secure: detecting intrusion attempts, preventing fraud, keeping a record of access.
Support and guidance: answering your requests, training you on the tool, fixing faults and improving the service.
Keeping you informed: messages relating to the operation of the service and, if you have consented, news about new features.
4. On what legal basis
Each processing operation rests on one of the legal bases provided for by the GDPR.
Performance of the contract between us, for everything relating to the provision of the service and invoicing.
Your consent, for optional processing: audience measurement, marketing communications, connecting a third-party service, voice cloning. Each consent is time-stamped and can be withdrawn at any time.
Our legitimate interest, for the security of the service and the prevention of fraud.
Our legal obligations, in particular for accounting and the retention of invoices.
5. How long we keep it
The following retention periods apply.
Account data and content entrusted to us: for the whole duration of your subscription. Deleting your account erases your documents, your conversations and your history, and destroys the keys that made them readable.
Technical data: logs older than 180 days are automatically anonymised.
Accounting records and invoices: kept for the period required by French law, namely ten years.
Prospecting data: until you withdraw your consent, and at the latest three years after the last contact.
Account data and documents: kept for the duration of your subscription, then deleted after termination or at your request, within the time limits set by law.
6. Where your data is hosted
The service’s data is hosted on servers located in the European Union. The roonaworks.com website is served from Google Cloud infrastructure in Belgium; the application is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, United States, on servers located in the European Union. Your documents are not stored on the public website: they are encrypted in your browser, then kept in Europe. Your supervisory authority is the CNIL.
7. How your data is protected
Protection does not rest on a promise, but on the architecture of the service.
Your files are encrypted in your browser before they are sent. Each document has its own key.
Your password generates the decryption key: without your authentication, your content remains unreadable.
Each customer operates in a strictly partitioned space, and access control is enforced in the database itself, on every request.
Connections to third-party services use the OAuth2 protocol with enhanced security, without ever passing your passwords to us.
Your account is locked automatically after five failed login attempts, and session cookies cannot be accessed by scripts on the page.
8. Our processors
We use a limited number of service providers, each bound by a data processing agreement that complies with the GDPR. No data is sold to a third party, under any circumstances.
Hosting of the public website: Vercel Inc., United States.
Payment and invoicing: Stripe.
Audience measurement and consent management: Google Tag Manager and Axeptio.
Providers of artificial intelligence models, used under enterprise agreements, who are not permitted to reuse your content.
The list of processors by name, with their role and country, is provided on request at the address given in section 13.
9. Your data is not used to train models
The documents you entrust to Roona are used to produce your answer, and for nothing else. They are never used to train an artificial intelligence model, neither by us nor by our providers. That is a contractual commitment, not an option you would have to go and untick somewhere.
10. Cookies and audience measurement
The website uses cookies that are strictly necessary for it to work, which do not require your consent, and audience measurement cookies, which are set only after you have consented. A banner lets you accept, refuse or choose category by category, and change that choice at any time from the consent management button. The details of the cookies set, their purpose and their lifespan can be viewed at any time from that same button.
11. Your rights and how to exercise them
The GDPR grants you data subject rights, which we honour free of charge and within one month.
Right of access: obtain a copy of the data we hold about you.
Right to rectification: correct inaccurate or incomplete data.
Right to erasure: delete your account and its content. The deletion is real, and the decryption keys are destroyed along with the files.
Right to data portability: retrieve your data in a readable format to take it elsewhere.
Right to object and right to restriction: object to processing based on our legitimate interest, or ask for it to be frozen.
Right to withdraw your consent at any time, without affecting what was done before.
To exercise any of these rights, write to rgpd@roonaworks.com stating your request. Proof of identity may be requested if there is serious doubt about your identity.
12. Lodging a complaint with the CNIL
If you are not satisfied with our response, you can lodge a complaint with the Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or via the cnil.fr website.
13. Contacting us
For any question about your personal data: rgpd@roonaworks.com. For any other question: contact@roonaworks.com, or by post to 374 E Route de Charmeil, 01340 Attignat, France.
14. Changes to this policy
This policy evolves with the service and with the law. The date of the last update is shown at the top of the page. In the event of a significant change to the purposes or the recipients of your data, you will be informed by email before it takes effect.