How Rooted handles your data

What "read" and "write" mean

Read means we look and change nothing. Audits only read. Write means changing your tracking settings or your CRM records, and only after you approve. Every write leaves a receipt that says how to undo it, or why it cannot be undone. We never write to your financial records, and Rooted never writes to your Stripe.

What we keep

Your workspace and the people on it, your connections to your tools, your answers to the exercises, your goal and measurement plan, audit results and findings, your campaigns and their drafts, the evidence and signals we gather for you, your chat history, and a receipt for every change we make in your tools.

Where it is kept

In our database, on Supabase in Canada (ca-central-1). The service that runs audits and fixes runs on Google Cloud in Montreal, Canada. Keys and tokens for your tools are encrypted in the database.

How long

How long we keep each kind of data:

• Contact matches, when we join one person across your tools: the raw match for 30 days, then only a scrambled fingerprint that cannot be turned back into the person's details.
• Run details, logs and reports: 90 days.
• Your chat: 12 months after your last message, or sooner if you ask.
• Free audits nobody claims: 30 days.
• Totals and findings: as long as your workspace exists.
• Market signals: 90 days.
• Posts from X: at most 24 hours after X last confirms they still stand.
• Approvals: kept as the record of what you approved, and when.
• Our own billing records: 7 years.

Custom retention periods: possible later.

Who can see it

People on your workspace. Every request to our database is limited to your workspace, by rules in the database itself. The service that runs audits and fixes gets a key for your tools only for the run it is doing. Rooted's admins can open any workspace, to support you and to check Rooted's work; the list of admins is kept in our own records. Changes an admin makes to a workspace's domains and settings are written to an admin log.

Revenue data

Rooted reads revenue only in the tools you connect, and changes nothing there without your approval. In HubSpot: each deal's stage, amount and close date. The audit reports on them, for example how many open deals have no amount, and the funnel keeps a count of deals at each stage per day, not their amounts. In Attio: your deals and their stages. In Google Analytics and PostHog: the purchase events your site or app sends. Stripe: Rooted does not read your Stripe yet. When it does, it will read charges, subscriptions and customers with a read-only key, and never write. Who can see it is the same as everything else on this page.

Training

Your content goes only to AI model vendors that do not train on it: Anthropic, xAI, OpenAI, Perplexity, and RunPod (our own pod).

Any other model sees your content only if your workspace picks it and accepts its terms. This page then names the model, what it may train on, and who benefits.

Today one such model can be picked:

• Gemini 2.5 Flash or Gemini 2.5 Pro, from Google (Gemini on Vertex AI).

Enforced in code on every model call; a call that breaks this rule is refused before anything is sent.

How to delete it

Disconnect any tool on the Integrations page, and its connection and stored key are removed. You can also revoke Rooted's access in each tool's own settings.

To delete your whole workspace, go to Account, Your data, and press Delete my workspace. Only an owner of the workspace can do this, and you type DELETE to confirm. We then disconnect every tool at the vendor's end, where the vendor allows it, and delete our copies of every key either way. The workspace closes at once. For 30 days an owner can undo the deletion; your tools then need connecting again. After 30 days your workspace data and files are deleted for good. We keep only a receipt that the deletion happened, with counts and no content.

Your chat history

We keep your chat history so Rooted can pick up where you left off. Ask in the chat and Rooted explains what it keeps. It is deleted with your workspace, or sooner if you ask.

Vendors Rooted uses

• Google Analytics, Tag Manager, Search Console: Audits and the Google playbook. Reads your property, container and search data. Changes tracking settings and publishes your container only when a playbook step or a fix you approve runs.
• HubSpot: The customer profile, audits and the HubSpot playbook. Reads contacts, companies, deals, forms, owners and pipelines. Changes CRM records and settings only when a playbook step or a fix you approve runs.
• PostHog: Audits and the PostHog playbook. Reads your events, people and dashboards. Changes project settings, actions, insights, dashboards and replay only when a playbook step or a fix you approve runs.
• X: The rival claims campaign and market signals. Reads your posts and bookmarks. Posts only from a card you approve. Posts we keep are checked against X and deleted within 24 hours if removed there.
• GitHub: In use for the PostHog playbook, website fixes and the About page campaign. Opens pull requests on your site's or app's code through Rooted's GitHub app; nothing changes until you merge.
• Anthropic (Claude): Our main writing model: the chat, drafts, exercise rewordings and the fix agent. Reads what each job sends it. Changes nothing.
• xAI (Grok): Rewords chat replies into plain style. Reads the reply text. Changes nothing. Training: does not train on your content (in its contract).
• Google PageSpeed and Chrome real-user data: Your site's speed. Reads public speed data for your pages. Changes nothing.
• Tranco: Ranks your site and your competitors by traffic. Reads a public ranking list. Changes nothing.
• DataForSEO: Keyword data for your site and competitors. Reads public search data. Changes nothing.
• Resend: Sends your sign-in link emails. Holds your email address and a one-time link. Changes nothing.
• People Data Labs: Fills in job titles and LinkedIn profiles for people in your CRM, when you approve. Receives each person's email address. Rooted writes what it finds into your CRM.
• Typeform: Your lead form and its responses. Makes the lead form, its webhook and its theme when you approve, and sends each response to your CRM.

Stripe: Rooted never writes to your Stripe. The only skill that writes to Stripe seeds test data into our own test account, and it refuses any key that is not a restricted test key.