Legal · last updated 06 Sep 2026
Three documents, each starting with a summary in plain language.
Three documents and one list. Each starts with a summary in plain language of what it actually commits us to; the legal text is below.
v2.1 · August 2026 · PDF
Privacy policyWhat we collect (account, billing, usage counters), what we never collect (the content of your mail when self-hosted), how long we keep it, and the two buttons that end it: export and delete.Read the policy →v1.4 · PDF
Terms and conditionsMonthly subscription, always cancellable, no notice period. What Rosa does not do on your behalf, what happens to your data when you leave, and the limits of our liability under Dutch law.Read the terms →v1.0 · September 2026 · AVG art. 28
Data processing agreementPre-signed and downloadable; you do not need to ask. Covers processing purposes, security measures, sub-processors, notification of a data breach within 24 hours and deletion upon termination.Download the DPA →Current list
Sub-processorsEveryone who can theoretically touch your data, why they exist and where they are located. Four with managed hosting; one with self-hosted. Additions are announced 30 days in advance.View the list ↓
Sub-processors · managed hosting
Party
Why they exist
Location
Also when self-hosted?
Anthropic
The reasoning itself. Receives anonymised context, never raw identifying data. Contractually excluded from training.
US · SCCs
Yes, the only one
Hetzner
The machine your container runs on. Encrypted volumes; they do not have the keys.
DE · Falkenstein
No
Stripe
Subscription and add-on payments. Sees your billing details; never your content.
IE · EU entity
License only
Apple (APNs)
Push notifications to the iOS app. The payload is a wake signal; the content stays with Rosa.
IE · EU region
If you use the app
no analytics · no ad pixels · no data brokers · no session recordings
For transfers to Anthropic (US), Standard Contractual Clauses (SCCs) have been executed pursuant to Implementing Decision 2021/914. A Data Transfer Impact Assessment is available upon request via privacy@meet-rosa.ai.
Force majeure · In circumstances beyond our control (third-party outages, government measures, natural disasters), obligations are suspended. If force majeure lasts longer than 60 days, either party may terminate at no cost.
Right of withdrawal · If you are a consumer, you have 14 days to reconsider after entering into the agreement. You can withdraw via the portal or by emailing hello@meet-rosa.ai. This right expires once the service has been fully performed with your explicit consent.
Cookies · Rosa uses only strictly necessary cookies (session, language preference). No tracking, no analytics, no advertising cookies. Consent is not required for functional cookies.
Inactivity means: no portal login and no processed mail for three consecutive months.
Rates are discussed during the intake call and confirmed by email. The founding rate is locked in for as long as the account remains active.
HGE Ventures B.V. t/a Rosa AI · CoC 90688759 · Amsterdam, Netherlands
Need something signed, or a security questionnaire?
HGE Ventures B.V. (t/a Rosa AI) · Data protection contact: privacy@meet-rosa.ai
Get in touch