Privacy policy
Last updated 2 November 2026
1. Who we are
ROASaurus is operated by Bullito, trading as ROASaurus, Ceintuurbaan 211, 3051 KC Rotterdam, the Netherlands, Chamber of Commerce (KvK) number 68137303. Questions about privacy go to hello@roasaurus.com.
2. Our two roles
Controller. For the people who visit this website or use the ROASaurus dashboard (our customers and their team members), we decide what data we process and why. This policy explains that processing.
Processor. For the visitors and customers of the online stores that use ROASaurus, the store is the controller and we process data on its behalf under our data processing agreement. If you shopped at a store that uses ROASaurus, please contact that store about your data. We will help the store answer your request.
3. Data we collect as controller
- Account: your email address, company name, team memberships and roles, and your password (stored only as a salted scrypt hash).
- Billing: your plan, subscription status and Stripe customer id. Card details are entered at Stripe and never reach our servers.
- Support and Ask AI: the messages you send our team and the questions you ask the Ask AI assistant.
- Technical data: IP address, browser user agent and request details in our server logs, and a log of the emails we send you.
- Referrals: if you arrive through an affiliate link, the affiliate code, so the referral can be credited.
- Advertising measurement: only if you click Accept in the cookie banner, this website loads the Meta pixel. It sends Meta your IP address, browser details, the pages you view and, when you create an account, that you signed up. We use this to measure and improve our own ads on Facebook and Instagram. If you decline, the pixel is not loaded.
- Website analytics: only if you click Accept, this website also loads Google Analytics. It sends Google your IP address, browser details, the pages you view and how you use them and, when you create an account, that you signed up. We use this to understand and improve this website. Google signals and Analytics advertising features are off. If you decline, Google Analytics is not loaded.
- Google Ads: only if you click Accept, this website also loads the Google Ads tag. It sends Google your IP address, browser details, the pages you view and, when you create an account, that you signed up, so we can measure our ads on Google and show our ads to people who visited this website (remarketing). If you decline, the tag is not loaded.
Our fonts load from Google Fonts, so your browser sends your IP address to Google when you open a page.
4. Why we use it and our legal basis
- To provide the service, your account and support: performance of our contract with you (GDPR art. 6(1)(b)).
- To bill you and keep financial records: contract and legal obligation (art. 6(1)(c)); Dutch tax law requires us to keep invoices and payment records for seven years.
- To secure the service, prevent abuse and send essential service emails such as usage alerts: legitimate interest (art. 6(1)(f)).
- To measure our own ads with the Meta pixel and Google Ads, show our ads to past visitors, and measure our website with Google Analytics: your consent (art. 6(1)(a)), which you can withdraw at any time with Cookie settings at the bottom of every page.
We do not sell personal data. Data we process for stores is never used for our own advertising.
5. Data we process for stores (as processor)
When a store connects ROASaurus, we process on its instruction:
- An anonymous visitor id, IP address, user agent, pages viewed, cart and checkout events, ad click ids (such as fbclid, gclid and ttclid) and UTM parameters.
- Order details from the store platform: order id, products and amounts, and the customer's name, email address, phone number and address.
We use this to match orders to the ad click that led to them, to send conversion events to the ad platforms the store has connected, and to show the store its analytics. Emails, phone numbers, names and addresses are hashed with SHA-256 before they are sent to an ad platform. With Respect visitor consent switched on (the default), we follow the store's cookie consent signals. For visitors who declined marketing cookies we set no visitor id and store no click ids or campaign tags from their browsing; their page views and other browser events are kept without a visitor id, IP address or browser details and are not sent to ad platforms. A paid order from such a visitor is still sent to the ad platforms the store has connected, with the customer's details from the order hashed and the IP address and browser the order was placed from. On Shopify, the order's landing page address, which can contain campaign tags and click ids, is part of the order data and is used only in the store's ROASaurus reports.
6. Cookies and local storage
| Name | Set on | Purpose | Kept for |
|---|---|---|---|
tl_sess | roasaurus.com | Keeps you logged in (strictly necessary) | 30 days |
tl_store | roasaurus.com | Remembers the store you last opened | 1 year |
tl_ref | roasaurus.com | Remembers the affiliate who referred you | 30 days |
tl:consent | roasaurus.com (local storage) | Remembers whether you accepted or declined marketing cookies | Until cleared |
tl_consent | roasaurus.com and app.roasaurus.com | The same choice, shared by the website and the app so you are asked once | 1 year |
_fbp | roasaurus.com | Meta pixel browser id, only after you accept marketing cookies | 90 days |
tl_conv | roasaurus.com | Passes your sign-up to the Meta pixel, Google Analytics and Google Ads once, only after you accept marketing cookies | Deleted on the next page, at most 1 hour |
_ga, _ga_* | roasaurus.com | Google Analytics visitor and session ids, only after you accept marketing cookies | 2 years |
_gcl_au | roasaurus.com | Google Ads click and visit id for measuring and showing our ads, only after you accept marketing cookies | 90 days |
_tl | The store's domain | Anonymous visitor id for attribution, set on behalf of the store | 1 year |
_fbc, _fbp | The store's domain | Meta click and browser ids, set on behalf of the store | 90 days |
tl:attributes | The store's domain (local storage) | Ad click ids and UTM parameters of the visit | Until cleared |
On roasaurus.com, the Meta pixel, Google Analytics, the Google Ads tag and their cookies load only after you click Accept in the cookie banner. You can change your choice at any time with Cookie settings at the bottom of every page. The cookies on a store's domain are only used when that store connects ROASaurus; the store decides on them and asks its visitors for consent where the law requires it.
7. Who receives data
We use a small number of service providers (sub-processors) to run ROASaurus. They are listed below and in our data processing agreement, and they may only use the data to provide their service to us.
| Provider | Purpose | Location | Data |
|---|---|---|---|
| DigitalOcean, LLC | Hosting of the application, database and backups | Amsterdam, the Netherlands (EU) | All data in the service |
| Resend, Inc. | Transactional email: password resets, invitations, alerts and scheduled reports | United States | Recipient email addresses and email content |
| Stripe Payments Europe, Ltd. | Subscription billing and payments | Ireland (EU), with transfers to Stripe, Inc. (United States) | Billing contact and payment details of the Customer only |
| Anthropic, PBC | Ask AI assistant and AI briefings, only when a user asks a question or switches a briefing on | United States | The question and aggregated store metrics; no contact details of End Customers |
| Zoho Corporation B.V. | Our mailbox for support, sales and privacy requests | the Netherlands and Ireland (EU) | Emails sent to our @roasaurus.com addresses |
Ad, analytics, affiliate and email platforms (such as Meta, TikTok, Google, Snapchat, Pinterest, Reddit, X, Microsoft, LinkedIn, Awin, Segment and Klaviyo) and store platforms (such as Shopify and WooCommerce) receive data only when a store connects them, on that store's instruction and under the store's own agreement with them. We disclose data to authorities only when the law requires it.
When you accept marketing cookies on this website, Meta Platforms Ireland Ltd. receives the pixel data described in section 3. We and Meta are joint controllers for collecting and sending that data, under Meta's controller addendum; Meta's further use of it is covered by Meta's privacy policy.
When you accept, Google Ireland Ltd. receives the Google Analytics data described in section 3 and processes it for us under Google's data processing terms. For the Google Ads tag, Google Ireland Ltd. receives the data described in section 3 and uses it as an independent controller to measure and show our ads; see how Google uses this data.
Google user data
When you connect Google Ads, ROASaurus reads your campaign, spend and account data, sends conversion adjustments and customer lists you choose to send, and changes campaigns only after an owner or admin approves it or through a rule you set to automatic. We use this data only to provide these features to you, do not sell it, do not use it for advertising of our own and do not use it to train AI models. Login tokens are stored encrypted. If you use Ask AI or switch on AI briefings, campaign metrics from Google Ads can be sent to Anthropic to answer you; no customer lists are sent. You can disconnect an account at any time under Setup, which deletes its synced spend.
ROASaurus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
8. Transfers outside the EU
Our servers and database are in Amsterdam. Some providers above, Meta's parent Meta Platforms, Inc. and Google's parent Google LLC, are based in the United States. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
9. How long we keep data
- Account data: as long as your account exists. When you ask us to close your account, we delete it within 30 days.
- Billing records: seven years, as required by Dutch tax law.
- Store data: as long as the store is connected. Removing a store in the dashboard deletes its data right away; uninstalling the Shopify app deletes it when Shopify sends its shop deletion request (48 hours later).
- Backups: nightly database backups are kept for 14 days and then overwritten.
10. Security
All traffic is encrypted with TLS. Ad platform tokens are encrypted at rest with AES-256-GCM, passwords are hashed with scrypt, and the database is only reachable from inside our server network. Server access is limited to key-based SSH behind a firewall. More detail is in annex 1 of the data processing agreement.
11. Your rights
You can ask us for access to, correction, deletion, restriction or a copy of your personal data, and you can object to processing based on legitimate interest. You can withdraw your consent for the Meta pixel, Google Analytics and Google Ads at any time with Cookie settings; this does not affect what was sent before. Email hello@roasaurus.com; we answer within one month. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
12. Changes
When we change this policy, we update the date at the top. We email customers about material changes before they apply.