Privacy Notice

1. Controller

The controller is Sebastian Barez Software Development, proprietor: Sebastian Barez, at the address stated in the Legal Notice. Privacy requests: privacy@roost2d.com. General support: support@roost2d.com.

2. Data processed

• Account, invitation, age-confirmation and authentication data and public passkey credential metadata; Studio does not receive private passkey material, which remains within the authenticator or passkey-provider ecosystem
• Project source, instructions, agent messages, assets, builds, verification results and previews
• Usage, budget and quota state
• Security, audit, abuse, support and moderation records
• Optionally, encrypted credentials for your own AI-provider key

3. Data from other sources

Where data is not obtained directly from you, it may come from the person or organisation issuing your Beta invitation, an authentication provider, or a connected service you choose. The categories are limited to account, invitation, identity and transaction metadata required for the respective purpose.

4. Purposes and legal bases

• Providing Studio, authentication, quota control and performing the Beta agreement: Article 6(1)(b) GDPR
• Security, abuse and fraud prevention, service reliability, debugging, capacity and cost planning, and data-minimised improvements to usability and reliability: Article 6(1)(f) GDPR. Our legitimate interests are protecting Studio and its users, preventing misuse, maintaining reliable operation, controlling infrastructure costs and improving the service
• Consent-dependent features: Article 6(1)(a) GDPR; consent can be withdrawn at any time

5. AI, sandbox and voice input

Your instruction, selected source and verification feedback may be sent to an approved AI provider. Candidates run in isolated, short-lived build environments. Using your own API key changes billing, but does not automatically change the data transfer or responsibility. Studio does not make solely automated decisions with legal or similarly significant effects.

If you use voice input, speech recognition is provided by your browser or operating system. Studio receives recognised text, not the microphone recording; the browser or operating-system provider may process audio under its own terms.

6. Recipients and international transfers

Where required for an enabled Beta feature, recipients include Vercel for hosting, workflows and sandbox, Supabase for authentication, database and private storage, approved AI providers, and a transactional email service. An up-to-date overview of the providers actually enabled for the Beta, their roles, locations and, where applicable, transfer mechanisms is available on request from privacy@roost2d.com. You may also request a copy of applicable safeguards there.

7. Retention

Projects may be archived without deleting their data. When a project is moved to Trash, it is ordinarily retained for 30 days so the owner can restore it. The owner may permanently delete it sooner; that action cannot be undone. At the end of the 30-day window it is automatically deleted from active systems. Account and project data are also subject to documented technical deletion queues and backup retention. Data-minimised accounting, security and audit records may remain detached from the deleted project where required for legal obligations, abuse prevention, incidents or legal claims. Ephemeral sandbox workspaces terminate after the relevant job; provider logs and workflow metadata follow the periods in the Provider Register. Security and audit records are ordinarily retained for no more than twelve months unless an incident, claim or law requires longer.

8. Data-minimised usage measurement

Internal product measurement calculates cost, quota, build, success, failure and usage metrics on the server from records required for the requested Studio service. It uses no analytics or marketing cookies, persistent analytics identifier, fingerprinting or session replay and does not intentionally store referrers, full URLs, IP addresses or device profiles for that measurement. Hosting and security providers may process network identifiers such as IP addresses where technically necessary to deliver and protect the service. Identifiable quota values are available only to AAL2 administrators; product-development metrics are aggregated.

9. Your rights

Depending on applicable legal requirements, you may request access, correction, erasure, restriction or portability, object to processing based on Article 6(1)(f), and withdraw consent at any time without affecting processing before withdrawal. Use account settings or privacy@roost2d.com. You may complain to the Hamburg Commissioner for Data Protection and Freedom of Information or another competent authority.

10. Required data, age and changes

Fields marked as required are contractually necessary for the Beta. The Beta is invite-only and for adults aged 18 or older. Material changes are versioned and renewed acceptance is collected where required.