Last updated: 23 March 2026
Rowpa is operated by Rowpa Ltd ("we", "us", "our"). We are the data controller for the personal data we collect through the Rowpa platform at rowpa.app and rowpa.app.
If you have questions about this policy or your data, contact us at privacy@rowpa.app.
We collect and process the following categories of personal data:
| Data category | Examples | Purpose |
|---|---|---|
| Account data | Email address | Authentication, account management, billing |
| Business data | Business name, website, description, business type, employee count | Generating your ROPA, privacy policy, and compliance outputs |
| Usage data | Pages visited, features used, actions taken within the platform | Improving the product, debugging errors |
| Payment data | Handled entirely by Stripe. We do not see or store your card number. | Processing subscription payments |
| Technical data | IP address, browser type, device type | Security, fraud prevention, debugging |
We do not collect special category data (health data, biometric data, ethnic origin, etc.) about our users. If your ROPA describes processing activities involving special category data about your customers, that information is stored as part of your compliance documentation and is covered by the data processing arrangements described in section 5.
We process your data under the following legal bases under UK GDPR:
| Processing activity | Legal basis |
|---|---|
| Providing the Rowpa service (ROPA generation, policy generation, vendor matching) | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails (magic links, subscription confirmations) | Contract performance (Art. 6(1)(b)) |
| Processing payments via Stripe | Contract performance (Art. 6(1)(b)) |
| Product improvement and error debugging | Legitimate interests (Art. 6(1)(f)) |
| Security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Sending product updates and feature announcements | Legitimate interests (Art. 6(1)(f)), with opt-out |
Rowpa uses Anthropic's Claude API to generate your ROPA, privacy policy, vendor assessments, and other compliance outputs. When you use these features, the following data is sent to Anthropic's API:
Anthropic does not use data sent via their API to train models. Their API data usage policy confirms that inputs and outputs from the API are not used for model training. Data is processed on Anthropic's infrastructure in the United States.
We do not use automated decision-making that produces legal effects concerning you. AI outputs are drafts for your review, and you control what is published or exported.
We use the following sub-processors to deliver the service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database hosting, authentication, file storage | EU (Frankfurt, Germany) |
| Vercel | Application hosting and CDN | Global edge network (EU primary) |
| Anthropic | AI model inference (Claude API) | United States |
| Stripe | Payment processing and billing | United States / Ireland |
| Resend | Transactional email delivery | United States |
Your database is hosted in the EU (Supabase, Frankfurt). Some data is transferred to the United States when processed by Anthropic (AI inference), Stripe (payments), Vercel (hosting), and Resend (email delivery).
These transfers are protected by Standard Contractual Clauses (SCCs) including the UK International Data Transfer Addendum (IDTA), and where applicable by the UK Extension to the EU-US Data Privacy Framework.
Rowpa uses only essential cookies required for authentication and session management. We do not use advertising cookies, analytics cookies, or tracking pixels.
For full details, see our Cookie Policy.
| Cookie | Purpose | Duration |
|---|---|---|
| sb-*-auth-token | Supabase authentication session | Session / 7 days |
| cookie_consent | Records your cookie consent choice | 365 days |
Under UK GDPR, you have the following rights:
To exercise any of these rights, email privacy@rowpa.app. We will respond within one calendar month.
You can also export your ROPA and compliance data at any time from within the platform using the audit-ready export feature (PDF, CSV, or JSON).
Rowpa is a business-to-business service. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
We may update this policy from time to time. If we make material changes, we will notify you by email or by a notice in the platform. The "last updated" date at the top of this page shows when it was last revised.
If you are unhappy with how we handle your data, please contact us first at privacy@rowpa.app so we can try to resolve it.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
For any questions about this privacy policy or your personal data: