Last updated: 29 April 2026
Rowpa is operated by TeZe Ltd ("we", "us", "our"), a company registered in England and Wales (company number 17137231), with its registered address at 66 Paul Street, London, EC2A 4NA. We are the data controller for the personal data we collect through the Rowpa platform at rowpa.app. You can learn more about TeZe at teze.app.
If you have questions about this policy or your data, contact us at compliance@rowpa.app.
We collect and process the following categories of personal data:
| Data category | Examples | Purpose |
|---|---|---|
| Account data | Email address | Authentication, account management, billing |
| Business data | Business name, website, description, business type, employee count | Generating your ROPA, privacy policy, and compliance outputs |
| Usage data | Pages visited, features used, actions taken within the platform | Improving the product, debugging errors |
| Payment data | Handled entirely by Stripe. We do not see or store your card number. | Processing subscription payments |
| Technical data | IP address, browser type, device type | Security, fraud prevention, debugging |
We do not collect special category data (health data, biometric data, ethnic origin, etc.) about our users. If your ROPA describes processing activities involving special category data about your customers, that information is stored as part of your compliance documentation and is covered by the data processing arrangements described in section 5.
We process your data under the following legal bases under UK GDPR:
| Processing activity | Legal basis |
|---|---|
| Providing the Rowpa service (ROPA generation, policy generation, vendor matching) | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails (magic links, subscription confirmations) | Contract performance (Art. 6(1)(b)) |
| Processing payments via Stripe | Contract performance (Art. 6(1)(b)) |
| Product improvement and error debugging | Legitimate interests (Art. 6(1)(f)) |
| Security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Sending product updates and feature announcements | Legitimate interests (Art. 6(1)(f)), with opt-out |
Rowpa uses Anthropic's Claude API to generate your ROPA, privacy policy, vendor assessments, and other compliance outputs. When you use these features, the following data is sent to Anthropic's API:
Anthropic does not use data sent via their API to train models. Their API data usage policy confirms that inputs and outputs from the API are not used for model training. Data is processed on Anthropic's infrastructure in the United States.
We do not use automated decision-making that produces legal effects concerning you. AI outputs are drafts for your review, and you control what is published or exported.
We use the following sub-processors to deliver the service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database hosting, authentication, file storage | EU (Frankfurt, Germany) |
| Vercel | Application hosting and CDN | Global edge network (EU primary) |
| Anthropic | AI model inference (Claude API) | United States |
| Stripe | Payment processing and billing | United States / Ireland |
| Resend | Transactional email delivery | United States |
Your database is hosted in the EU (Supabase, Frankfurt). Some data is transferred to the United States when processed by Anthropic (AI inference), Stripe (payments), Vercel (hosting), and Resend (email delivery).
These transfers are protected by Standard Contractual Clauses (SCCs) including the UK International Data Transfer Addendum (IDTA), and where applicable by the UK Extension to the EU-US Data Privacy Framework.
Rowpa uses only essential cookies required for authentication and session management. We do not use advertising cookies, analytics cookies, or tracking pixels.
For full details, see our Cookie Policy.
| Cookie | Purpose | Duration |
|---|---|---|
| sb-*-auth-token | Supabase authentication session | Session / 7 days |
| cookie_consent | Records your cookie consent choice | 365 days |
Under UK GDPR, you have the following rights:
To exercise any of these rights, email compliance@rowpa.app. We will respond within one calendar month.
You can also export your ROPA and compliance data at any time from within the platform using the audit-ready export feature (PDF, CSV, or JSON).
Rowpa is a business-to-business service. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
We may update this policy from time to time. If we make material changes, we will notify you by email or by a notice in the platform. The "last updated" date at the top of this page shows when it was last revised.
If you believe we have mishandled your personal data or breached UK data protection law, you have the right to make a complaint. We maintain a formal complaints procedure under Section 164A of the Data Protection Act 2018 (as inserted by Section 103 of the Data Use and Access Act 2025).
You can submit a complaint in any of the following ways:
We will acknowledge your complaint within 30 days and investigate without undue delay. You will be informed of the outcome, including any remedial steps taken. Full details of our process, timelines, and your escalation rights are set out in our Data Protection Complaints Procedure.
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):
For any questions about this privacy policy or your personal data: