Privacy policy

Last updated 25 September 2026

This policy explains which personal data we process when you visit staging.rollout.so, use the rollout dashboard (app-staging.rollout.so), the documentation (docs-staging.rollout.so), and the rollout API, widget and MCP server (api-staging.rollout.so), why we do it, and which rights you have under the General Data Protection Regulation (GDPR).

1. Controller

Our full company details are in the imprint. For anything about your data, write to the address above.

2. Hosting and server logs

Our websites, dashboard and API run on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in data centres in Germany and Finland. When you open one of our pages or an app calls our API, the servers process your IP address, the date and time, the address requested, and technical details your browser or app sends (such as its user agent). We need this to deliver the pages, keep the service secure and limit abuse (for example rate limits). Requests to the API are logged, including the IP address; these logs are deleted after 30 days at the latest.

Legal basis: our legitimate interest in running a secure, working service (Art. 6(1)(f) GDPR). Hetzner processes this data on our behalf under a data processing agreement (Art. 28 GDPR).

3. This website

staging.rollout.so and docs-staging.rollout.so set no cookies and load nothing from other companies' servers unless you accept analytics (section 8): fonts and images are served by us. The example feed on the home page runs entirely in your browser and sends nothing to us.

4. Your rollout account

To use the dashboard you create an account. We process your name, email address, your workspace (organisation) and role, and what you create in rollout: projects, announcements, snippets, images and settings. We also record which account made which change, so a workspace can see who did what.

Legal basis: the contract for using rollout (Art. 6(1)(b) GDPR). We keep your account data as long as your account exists, and delete it when you delete the account or ask us to, unless the law requires us to keep it longer (for example tax records).

Sign-in (Clerk)

Sign-in and accounts are provided by Clerk, Inc. (USA). Clerk processes your name, email address, sign-in methods and session information, and sets cookies that are needed to keep you signed in. These cookies are strictly necessary for the service you request (§ 25(2) no. 2 TDDDG), so we don't ask for consent to them. Clerk processes this data on our behalf under a data processing agreement.

Sign in with Google

If you choose “Sign in with Google”, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) confirms your identity and shares your name, email address, profile picture and Google account ID with us through Clerk. We use this information only to create your rollout account and sign you in. We don't use it for advertising, don't sell it, and don't share it with anyone other than the service providers named in this policy.

rollout's use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements.

Data storage (Supabase)

Our database, image storage and the encrypted storage for secrets (such as API keys you connect) are provided by Supabase, Inc. (USA). The data is stored in the EU (Frankfurt, Germany). Supabase processes it on our behalf under a data processing agreement.

5. Data about your users (widget and API)

When you use rollout in your product, rollout processes data about your users on your behalf: the user and organisation identifiers you send, attributes you choose to send for targeting, when they were first and last seen, and which announcements they have read. For this data you are the controller and we are your processor (Art. 28 GDPR); we process it only to provide rollout to you. Contact us for our data processing agreement.

The widget stores nothing on your users' devices: no cookies and no local storage. Their requests to our API are logged as described in section 2.

6. Email through Loops

If you connect your Loops account, rollout sends the content and images of your announcements to Loops to prepare campaign drafts, using your Loops API key. Your recipient lists stay in Loops; rollout does not receive them. If you set up Loops' webhooks, rollout receives events about your campaigns and keeps only counts (sent, delivered, opened, clicked, bounced, unsubscribed). Loops is a service you choose and contract with yourself.

7. AI assistants (MCP)

If you connect an AI assistant to rollout's MCP server with an API key or by signing in, rollout processes the requests it makes on your behalf like any other use of your account (section 4). What the assistant's own provider does with your data is covered by that provider's terms.

8. Analytics and error tracking (PostHog)

We use PostHog to understand how rollout is used, to find errors and to see where it is slow. PostHog is provided by PostHog Inc. (USA); the data is stored in the EU (Frankfurt, Germany), and PostHog processes it on our behalf under a data processing agreement. PostHog receives no data about your users (section 5).

In your browser, only with your consent

On staging.rollout.so, docs-staging.rollout.so and in the dashboard, PostHog is only loaded after you click “Accept”. From then on it stores an identifier in a cookie and in your browser's storage, valid for staging.rollout.so and its subdomains, and records the pages you view, what you click, errors, and technical details of your browser and device. In the dashboard it also links this to your account and records your sessions as replays in which all text, all form input and all images are hidden, so that we can see how pages are used, not what you wrote.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time, with effect for the future, under “Privacy settings” in the footer or in the dashboard's account menu; PostHog's cookies and stored data are then deleted from your browser. Your choice itself is kept in the cookie rollout_analytics for 180 days, so we don't ask again on every visit (§ 25(2) no. 2 TDDDG).

On our servers

When you use the dashboard or the MCP server, our API records which actions are taken (for example “announcement published” or “snippet created”) with your account and workspace, the errors that occur, and traces of how requests were handled (which steps and database queries ran and how long they took, without their content). This happens on our servers, not in your browser. Legal basis: our legitimate interest in running, securing and improving rollout (Art. 6(1)(f) GDPR). You can object at any time (section 11).

We delete this data when it is no longer needed for these purposes.

9. Contacting us

If you email us, we use your message and contact details to answer you. Legal basis: our legitimate interest in answering enquiries, or steps towards a contract (Art. 6(1)(f) and (b) GDPR). We delete the correspondence when it is no longer needed, unless we must keep it.

10. Transfers outside the EU

Clerk, Supabase, Loops and PostHog are companies based in the USA, so personal data may be accessed from there. Such transfers are based on the EU–US Data Privacy Framework where the company is certified under it (Art. 45 GDPR), and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

11. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR);
• have it corrected (Art. 16) or deleted (Art. 17);
• restrict its processing (Art. 18);
• receive it in a portable format (Art. 20);
• object to processing based on our legitimate interests, for reasons arising from your particular situation (Art. 21);
• withdraw any consent you have given, with effect for the future (Art. 7(3)).

Write to info@mitaflow.com. If your data was sent to us by a company that uses rollout in its product, please contact that company first; we support it in answering your request.

You can also complain to a data protection supervisory authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

We don't use automated decision-making or profiling.

12. Changes

We update this policy when our services or the law change. The date at the top shows the latest version.