Roxea
Start free review
Back to Roxea

Legal

Privacy Policy

Learn how Roxea collects, uses and protects personal data when providing its services.

Last updated: June 29, 2026

1. Introduction

Roxea respects user privacy and processes personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) where applicable. This policy explains what personal data may be processed, why it is used and the rights available to individuals.

2. Data controller

The data controller for Roxea is S&H Solutions.

Company
S&H Solutions
Address
13 rue d'Houchin, 62620 Barlin, France
Privacy contact
rgpd@roxea.app
General contact
contact@roxea.app

3. Personal data we collect

Depending on how the service is used, Roxea may process the following categories of data:

  • Account data: email address, first name, last name, password hash and authentication provider.
  • Organization data: organization name, sector, size and AI maturity level.
  • Member data: roles, invitation email addresses and organization memberships.
  • Billing data: subscription plan, billing status, Stripe customer or subscription identifiers, invoices and payment status handled by Stripe.
  • Usage data: agents created, tools declared, permissions, risk assessments, action items and reports generated.
  • Technical data: IP address, logs, browser and device information, and security logs.
  • Support data: messages sent to Roxea through email or support channels.

Payment card details are processed by Stripe and are not stored by Roxea.

4. Purposes of processing

Roxea may process personal data for the following purposes:

  • creating and managing user accounts;
  • providing access to the Roxea application;
  • managing organizations, members and invitations;
  • generating risk assessments and audit reports;
  • managing subscriptions, billing and payments;
  • securing the service and preventing abuse;
  • providing support and responding to requests;
  • improving the product; and
  • complying with legal obligations.

5. Legal bases

Depending on the processing activity, Roxea relies on one or more of the following legal bases:

  • performance of a contract or steps taken before entering into a contract;
  • legitimate interests, such as operating, securing and improving the service;
  • compliance with legal obligations; and
  • consent where required.

6. Data processors and recipients

Personal data may be shared with trusted service providers strictly as necessary to operate Roxea. These providers may include:

  • OVH, as hosting provider;
  • Stripe, for subscription and billing management;
  • Google, when a user chooses Google Sign-In; and
  • the configured email service used by Roxea for transactional emails, where applicable.

Roxea does not sell personal data.

7. International transfers

Some providers may process data outside the European Economic Area. Where applicable, Roxea relies on appropriate safeguards required by data protection laws.

8. Data retention

Roxea applies retention periods based on the purpose and nature of the data:

  • account data is retained while the account is active;
  • organization data is retained while the organization workspace is active;
  • billing records are retained as required by accounting and legal obligations;
  • logs are retained for a limited period for security and troubleshooting;
  • invitation and password reset tokens are retained only for a limited time; and
  • users may request deletion, subject to applicable legal retention obligations.

9. User rights

Subject to applicable law, individuals may have the following rights:

  • the right of access;
  • the right of rectification;
  • the right of deletion;
  • the right to restriction of processing;
  • the right to object to processing;
  • the right to data portability;
  • the right to withdraw consent where processing is based on consent; and
  • the right to lodge a complaint with a competent supervisory authority.

To exercise these rights, contact rgpd@roxea.app.

10. Security

Roxea implements technical and organizational measures intended to protect personal data, including access controls, authentication, password hashing, secure tokens and restricted access to production systems. No system can guarantee absolute security, and Roxea cannot promise that every risk will be eliminated.

11. Cookies and analytics

Roxea may use strictly necessary cookies or local storage to operate authentication and the application. Roxea may use Google Analytics 4 to measure use of the website and product. Analytics is loaded only after the user has consented when consent is required. Roxea does not intentionally transmit personal data or sensitive business information in analytics events. Users can reject analytics from the consent banner without affecting access to the service.

12. Changes to this policy

Roxea may update this Privacy Policy to reflect changes to the service, providers or applicable requirements. The “Last updated” date at the top of this page will be revised when the policy changes.