Privacy policy

Who we are

RootSpend runs this website and the RootSpend app. When this policy says "we", it means RootSpend. We decide how the personal data described here is used.

On this website

What you send us

When you use the contact form to join the waitlist, book a demo or ask a question, we receive your name, your work email, and anything else you choose to type in: your company, the tools you use and your message. We use it to reply to you, to let you know when RootSpend opens, and to set up a demo if you asked for one.

The form is delivered by Web3Forms, which passes your message to our inbox by email. We don't add you to any marketing list.

What the website collects on its own

This website sets no cookies and runs no analytics or advertising trackers. Your browser stores one setting, your light or dark theme choice, and it never leaves your device. Like every website, the company hosting it keeps standard server logs, such as IP addresses and the pages requested, to keep the site running and secure.

In the RootSpend app

The app isn't open yet. When it is, this is what it will handle.

Your account

Your name, your email, your organization's name and your role. Your password is stored only as a secure hash, so nobody can read it, including us. The app uses one essential cookie to keep you signed in. It isn't used for tracking.

Data from the tools you connect

RootSpend reads billing and usage data from the tools you connect, so it can show what they cost and who used them. That includes:

• costs, usage numbers such as tokens or credits, and dates
• names of things like projects, workspaces, warehouses, cloud accounts and API keys (never the keys themselves)
• the people behind the usage, such as names, emails and user IDs from your tools' member lists

RootSpend never reads the contents of your tools: no tables, files, prompts or responses. The keys you give it are encrypted at rest and only used to read this data. You can switch off costs per person for your whole organization.

Emails the app sends

Password resets, invitations, the budget and spike alerts you set up, and the reports you schedule. These go only to the people your organization chooses.

Why we are allowed to use it

We use your data to answer your requests and to run the service your organization signed up for. We also use it where we have a legitimate interest, such as keeping the service secure, and where the law requires us to keep records.

Who else handles it

We share data only with the companies that help us run RootSpend, and only what each of them needs:

• the company hosting this website and the app
• Web3Forms, which delivers contact form messages to our inbox
• our email provider, which sends the app's emails
• our payment provider, once we start charging. It handles card details, and we never see your full card number

We don't sell personal data and we don't share it for advertising. Some of these companies may process data outside your country. When they do, we rely on the safeguards the law requires.

How long we keep it

Contact form messages: until we have answered you, and waitlist entries until RootSpend opens or you ask us to remove you. App data: for as long as your organization has an account. Owners can export all of their organization's data at any time, or delete the organization and its data for good. To delete your own login as well, just ask us.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, or to stop using it. You can also object to how we use it, or complain to your local data protection authority. Write to us and we will answer within 30 days.

Children

RootSpend is a business tool. It isn't meant for anyone under 16, and we don't knowingly collect their data.

Changes to this policy

If we change this policy, we will update the date at the top. If a change matters, we will tell you by email or in the app before it takes effect.

Contact

RootSpend, Tunis, Tunisia. Write to us through our contact page, or email hello@rootspend.com.