Last Updated: March 14, 2026 · Version 1.0
Rokito is a Europe-based web application for financial tracking and management. Rokito operates as the Data Controller responsible for the collection and processing of your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
We are committed to protecting your privacy and ensuring that your personal data is handled in a transparent, secure, and lawful manner.
For all privacy-related inquiries, data subject requests, or concerns regarding this Privacy Policy, please contact us at:
Email: contact.rokito@gmail.com
We ask that you only use this email for legitimate privacy and data protection requests. We aim to respond within 5 business days for general inquiries and within 45 calendar days for formal data subject requests.
We collect and process the following categories of personal data in order to provide the Service:
You create and manage the following data within the Service. This data is entered by you and is under your control:
Important: We do not store full credit card numbers or payment card details. All payment processing is handled by Polar, a PCI-DSS compliant payment processor.
We do not use your data for behavioral profiling or targeted advertising.
Under GDPR Article 6, we are required to identify a lawful basis for each category of data processing. The following table describes the legal basis for our processing activities:
| Processing Purpose | Lawful Basis |
|---|---|
| User authentication and account management | Contract (Art. 6(1)(b)) |
| Service delivery (data storage, invoice generation) | Contract (Art. 6(1)(b)) |
| Payment processing | Contract (Art. 6(1)(b)) |
| Maintaining financial records and audit logs | Legal Obligation (Art. 6(1)(c)) |
| Fraud prevention and security monitoring | Legitimate Interest (Art. 6(1)(f)) |
| Service improvement and bug fixing | Legitimate Interest (Art. 6(1)(f)) |
| Non-essential cookies (if added in future) | Consent (Art. 6(1)(a)) |
| Marketing emails (if you opt in) | Consent (Art. 6(1)(a)) |
We retain your personal data only for as long as necessary to provide the Service and comply with applicable legal obligations. Retention periods vary depending on the type of data, applicable law in your jurisdiction, and operational and security requirements.
| Data Category | Typical Retention | Notes |
|---|---|---|
| Account data (email, name) | Duration of account | Or longer if legally required |
| Financial records (invoices, transactions) | As required by law | May vary by jurisdiction (typically 5–7 years) |
| Audit logs | As required for security and compliance | Or longer if legally required |
| Payment data (via Polar) | Per Polar’s policy | PCI-DSS compliance |
| Email metadata (via Resend) | Per Resend’s policy | Email delivery |
| Backup data | Aligned with primary data | Disaster recovery |
| Team invitations | Not retained | Auto-deleted after response |
| Failed login attempts | Limited period | Security monitoring |
Note: The retention periods above are guidelines only. These timeframes may be extended or shortened at our discretion to comply with legal obligations, security requirements, or operational needs. We may implement automated deletion processes that supersede these guidelines. For questions about your specific data, contact us at contact.rokito@gmail.com.
Beta Notice: As this is a beta service, data loss may occur without notice. We do not guarantee permanent data retention at this stage. You are strongly advised to maintain your own backups and archives of critical financial information.
When you request account deletion:
We share your data only with the following service providers, strictly for the purposes described below. We do not sell, rent, or trade your personal data to any third party.
We may integrate additional third-party services in the future, such as analytics or error-tracking tools. If such integrations involve sharing your personal data, we will update this Privacy Policy accordingly and, where required, obtain your consent before sharing.
All third-party processors are contractually obligated to:
Under GDPR and other applicable data protection laws, you have the following rights regarding your personal data:
You can request a copy of all personal data we hold about you. We will respond within 45 calendar days. Data is provided in CSV or JSON format. See Section 8 for details on Subject Access Requests.
You can correct inaccurate personal data at any time through your account settings, or by submitting a request to contact.rokito@gmail.com. We will confirm corrections within 45 days.
You can request deletion of your personal data. Upon request, your account is anonymized and personal data is removed within 30 days.
Exceptions — we cannot delete:
You can export your data in a machine-readable format (CSV or JSON). This includes your personal data and all data from teams you own. Data from teams where you are only a member is not included (see Section 8 and Section 11).
You can object to processing based on legitimate interest. You can opt out of marketing emails at any time via the unsubscribe link in each email or by contacting contact.rokito@gmail.com.
You can request that we restrict processing of your data (stored but not actively used) while the accuracy of data is disputed or the legality of processing is under review.
Rokito is not directed to children under 13 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact contact.rokito@gmail.com and we will delete it promptly.
To exercise any of the above rights, contact us at contact.rokito@gmail.com. We will verify your identity before processing your request and respond within 45 calendar days. There is no charge for exercising these rights.
A Subject Access Request (SAR) is your right under GDPR Article 15 to obtain a copy of all personal data we process about you.
We will verify your identity by confirming your email address and account details before disclosing any data. This protects your data from unauthorized access.
When you are invited to a team, you have access to view the team’s data, but you do not own it. The team owner is the data controller for that team’s financial information. Including member team data in your export would violate the privacy and business confidentiality of the team owner.
If you need data from a team where you are a member, please contact the team owner directly or submit a request to us and we will forward it to the owner.
We plan to add an automatic data export feature within your account settings, allowing you to download your data at any time without submitting a formal request. This feature will include one-click export for all owned teams.
We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.
Our administrator can view account metadata (email addresses, team names, subscription status) but cannot access your financial data (invoices, transactions, projects) under normal circumstances.
In exceptional cases where technical support or security investigation requires access to your data, such access is:
While we implement industry-standard security measures, no system is perfectly secure. We cannot guarantee absolute protection against all threats. As a beta service, we are continuously improving our security posture. We disclaim liability for breaches resulting from circumstances beyond our reasonable control.
Rokito supports multi-user team collaboration. This section explains how data ownership and privacy work within teams.
When you create a team, you become the owner. As owner, you:
When you are invited to a team, you become a member. As a member, you:
Important: Even if you created a record (such as an invoice) within a team, that record belongs to the team owner, not to you. This ensures the owner’s business confidentiality is protected.
Within a team, members can see:
If a team’s subscription downgrades:
When a member is removed from a team:
A data breach occurs when personal data is accessed, disclosed, altered, or destroyed without authorization.
In the event of a breach, our notification will include:
We may not notify you individually if the data was encrypted or otherwise rendered unintelligible to unauthorized parties, or if subsequent measures have eliminated the risk. In such cases, we may issue a public notice instead.
If you suspect that your data has been compromised, please contact us immediately at contact.rokito@gmail.com. We will investigate promptly.
Rokito is fully committed to compliance with the General Data Protection Regulation (GDPR). Our compliance measures include:
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
All primary data is stored on servers located in Europe. Backups are also stored within the EU region.
If data is transferred outside the European Economic Area (EEA) in the future (for example, through a third-party service provider), we will ensure adequate protection through Standard Contractual Clauses (SCCs) or equivalent safeguards approved by the European Commission.
If you are located in a jurisdiction not covered above, we default to GDPR standards as our baseline for data protection, which represents one of the highest levels of privacy protection globally. If your local law requires additional protections, please contact us.
We may update this Privacy Policy when:
Minor changes (no notification required):
Material changes (email notification required):
For material changes, we will notify you via email at least 30 days before the change takes effect.
Your continued use of the Service after the notification period constitutes acceptance of the updated Privacy Policy. If you disagree with changes, you may request data deletion and deactivate your account at any time.
Policy changes apply only to data collected after the effective date of the change. Data collected under a previous version of this policy is protected under the terms that were in effect at the time of collection.
If you believe that Rokito has violated your privacy rights, we encourage you to contact us first so we can resolve the issue directly:
If we are unable to resolve your concern to your satisfaction, you have the right to lodge a complaint with your local data protection authority. You can find your national authority through the European Data Protection Board:
European Data Protection Board — Members
If you are a California resident and wish to file a complaint under the CCPA, you may contact the California Attorney General’s office:
California Attorney General — Privacy Protection
If you exercise any of your privacy rights, Rokito will not: