Privacy policy

Last updated: September 17, 2026

1. Data controller

RosoAI is the controller for the processing described on this page. For questions or requests about your personal data, write to contact@rosoai.fr.

2. Data processed

Depending on how you use the site, RosoAI may process:

• your contact details, including your name and email address;
• information about your order, purchased products, amount, date and payment status;
• information needed to deliver files and provide support;
• if you purchase Roso SEO Watch’s done-for-you setup, your domain, choice of Discord, Slack or another compatible messaging platform, account readiness, availability and non-sensitive information you add to the form;
• your email address when you join a waitlist to be notified of a launch;
• messages you send to RosoAI;
• limited technical data related to security, site operation and referral attribution.
• if you agree and analytics are enabled, product pages viewed, clicks to checkout, purchase journey status and data needed for campaign attribution.

Stripe processes payment information directly. RosoAI does not receive or store your full card number.

The setup preparation form does not request passwords, API keys or two-factor authentication codes. These must not be submitted in the form or by email.

3. Purposes and legal bases

• processing payment, delivering Kits, preparing done-for-you setup and providing support: performance of the contract;
• retaining order records and meeting accounting and tax obligations: legal obligation;
• preventing fraud, securing the site and resolving incidents: RosoAI’s legitimate interests;
• attributing a sale to a partner when you arrive through a referral link: RosoAI’s and the partner’s legitimate interests, subject to your rights;
• notifying you of the release of a product whose waitlist you joined: your consent, which you may withdraw at any time;
• measuring how useful pages are and improving sales journeys: your consent, which you may refuse or withdraw at any time.

4. Recipients and service providers

Data is not sold. It is accessible only to RosoAI and providers needed for the purposes described:

• Stripe for payment, fraud prevention and transaction records;
• Resend for transactional emails, file delivery and waitlist management;
• OpenAI Sites and Cloudflare for hosting and site security;
• OVH for the domain name and email;
• Endorsely for referral and partner-sale attribution, when enabled.
• PostHog Cloud Europe for audience measurement and journey analysis, only when enabled and with your consent.
• Google Analytics 4 for page-view statistics, only when enabled and with your consent.
• OpenAI for measuring and attributing ChatGPT Ads campaign results, only when enabled and with your consent.

5. Audience measurement with Google Analytics 4, PostHog and the OpenAI Pixel

The Google Analytics 4 tag only loads after you accept audience measurement. It measures page views without transmitting URL parameters, personal download links, payment references or form contents. Transmitted titles are fixed and contain no customer data. Google advertising features are disabled. GA4 measurement cookies last for a maximum of six months, renewed during authorized visits; withdrawing consent deletes them and blocks new transmissions.

PostHog only loads with your consent. RosoAI has disabled session recording, automatic click capture and named profiles. The site sends only useful journey events: product page views, Stripe Checkout start and outcome, optional setup purchases, and setup form views, starts and submissions.

Fields entered in Stripe or the setup form, card numbers, your name and email address are not sent to PostHog. A random identifier kept in the browser’s local storage connects the steps of the same visit. Campaign parameters and the referring page may also be associated with the journey.

When configured, the OpenAI Pixel is initialized with RosoAI’s public identifier but remains unauthorized for measurement until you consent. After consent, it may retain the advertising click reference oppref and send configured conversion events to attribute results to ChatGPT Ads campaigns. If advanced matching is enabled in Ads Manager, certain recognized contact details may be normalized and hashed in your browser before transmission; raw values are not sent by this mechanism. When payment is confirmed and you have agreed to measurement, the server may also send the purchase event, amount, currency, products ordered and OpenAI attribution references. Your name, email address and payment details are not included in that transmission.

You can change your choice at any time. If you refuse or withdraw consent, no new measurement events are sent from your browser.

X advertising: a separate choice

X Ads requires separate consent. Accepting Google Analytics, PostHog or OpenAI Ads does not activate X. After your consent, the X pixel measures visits to public pages. Your X click identifier (twclid), if present, is retained for no more than 30 days to connect a purchase to an ad. A preference cookie and consent receipt remember your choice for six months.

After Stripe confirms payment, the browser pixel may send X that identifier, the amount actually paid for the SEO/GEO Kit after any discount, the currency, quantity and a technical deduplication reference. Other products in the cart, your email address, name and card data are not included. A technical reference is retained in your browser to avoid sending the same purchase again when you reload the confirmation page.

You may refuse X without preventing payment or delivery, or withdraw consent through ‘Manage analytics preferences’. Withdrawal blocks future transmissions and cancels pending ones; it does not remove an event already received by X. X may process data outside the European Economic Area. X Privacy Policy.

6. Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area. Such transfers must rely on a mechanism recognized by applicable law, including an adequacy decision or standard contractual clauses. Each provider’s safeguards are described in its privacy documentation.

7. Retention periods

• order data and accounting records are retained for the applicable statutory period, generally ten years;
• support messages are retained for the time needed to handle the request, then for no more than three years after the last exchange, unless an obligation or dispute requires longer;
• setup preparation information is retained while the service is performed, then for up to five years when needed for support or proof of the contract;
• technical and security logs are retained for a period proportionate to their purpose, no more than twelve months unless an incident requires longer retention;
• partner attribution data is retained for the time needed for attribution, sale tracking and fraud prevention;
• waitlist email addresses are retained until consent is withdrawn or, at the latest, three years after the last contact;
• audience measurement preferences and PostHog or OpenAI Ads data are retained for a period proportionate to journey analysis and attribution, then deleted or aggregated when no longer useful.

8. Your rights

Depending on the situation, you may request access, rectification, erasure, restriction or portability of your data, and object to processing based on legitimate interests. You may also withdraw consent when processing relies on it. Write to contact@rosoai.fr with details of your request. Proof of identity may be requested if there is reasonable doubt.

If you believe your rights have not been respected, you may lodge a complaint with the CNIL at cnil.fr.

9. Security and updates

RosoAI implements appropriate technical and organizational measures to limit unauthorized access, loss and alteration of data. This policy may change to reflect services used or applicable obligations; its update date appears at the top of the page.