Privacy notice

1. Controller

Sebastian Barez, c/o IP-Management #21812, Ludwig-Erhard-Str. 18, 20459 Hamburg, Germany. Privacy requests: privacy@roost2d.com. General support: support@roost2d.com.

2. Data processed

• Account, invitation, age-confirmation and authentication data
• Project source, instructions, agent messages, assets, builds, verification results and previews
• Usage, budget, subscription and billing state; payment details ordinarily remain with the payment provider
• Security, audit, abuse, support and moderation records
• Optionally, encrypted credentials for your own AI-provider key

3. Purposes and legal bases

• Providing Studio and performing the Beta agreement: Article 6(1)(b) GDPR
• Security, abuse prevention, diagnostics and reliable evidence: Article 6(1)(f) GDPR
• Release payments, tax and commercial-law duties: Article 6(1)(b) and (c) GDPR
• Consent-dependent features: Article 6(1)(a) GDPR; consent can be withdrawn

4. AI and sandbox processing

Your instruction, selected source and verification feedback may be sent to the configured AI provider. Candidates execute in an isolated, short-lived build environment. Using your own API key changes billing, but does not automatically change the Studio operator's role or eliminate the data transfer. Studio does not make solely automated decisions with legal or similarly significant effects.

5. Recipients and international transfers

Depending on enabled configuration, recipients can include Vercel (hosting, workflow and sandbox), Supabase (authentication, database and private storage), OpenAI or another selected AI provider, a transactional email service, and Stripe in Release. Region, DPA, subprocessors and transfer mechanism must be recorded before production activation. Third-country transfers require a documented basis such as an adequacy decision or Standard Contractual Clauses with a transfer assessment.

6. Retention

Account data remains until account deletion. Projects and builds remain until project or account deletion; ephemeral sandbox working copies are destroyed after the build. Security and audit records are ordinarily retained for no more than 12 months unless an incident, claim or law requires longer. Contract, invoice and tax records follow statutory periods. Deleted data may remain in protected backups until the documented backup cycle expires.

7. Your rights

You may request access, correction, erasure, restriction, portability, object to processing, or withdraw consent. Use account settings or privacy@roost2d.com. You may complain to the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) or another competent authority.

8. Required data, age and changes

Fields marked as required are necessary to provide the Beta. The Beta is invite-only and for adults aged 18 or older. Material changes are versioned and renewed acceptance is collected when required.