1. Who is responsible
The data controller for the Services is BlurHorizon, LLC, registered in Delaware, United States, with its postal address at 131 Continental Dr Suite 305, Newark, DE 19713, United States. Questions about this policy or your data go to contact@rosettalab.dev.
"Services" has the meaning given in our Terms of Service: rosettalab.dev and its subdomains, Rosetta Intel, the Rosetta app, Rosetta Agent and command-line tools, and our APIs.
2. What we collect
Account information. When you sign in we receive, from you or from your sign-in provider:
- your email address (if you use Apple's Hide My Email, the relay address Apple gives us instead);
- the name and profile image your provider shares, if any (Apple shares your name only the first time you sign in);
- a unique identifier from the provider that lets us recognise your account on later sign-ins;
- a username or display name you choose, and preferences such as language and theme.
We never see your Apple or Google password. If you sign in with an email code, we send a one-time code to your address and store nothing but the address and the time of the sign-in. We do not use passwords.
Subscription and billing. If you subscribe, Stripe processes your payment. We receive and store your Stripe customer identifier, your plan, its status and renewal dates. Card numbers are held by Stripe, not by us.
Usage and technical data. Our servers and hosting provider record standard request logs: the pages or API endpoints requested, the time, your IP address, and the type of browser or client. We use these to keep the Services running, to detect abuse and automated crawling, and to see which parts of the product are used. Server logs are kept for a short period (typically days) and are not joined to your account except when needed to investigate abuse or a security incident.
Analytics. We use Umami, a privacy-preserving analytics service, to count page views and referrers. It sets no cookies, does not fingerprint devices, and does not track you across other sites. We do not use Google Analytics or advertising pixels.
App data. The Rosetta app stores your sign-in session and preferences on your device. If you turn on notifications, your device's push token is stored so we can deliver them; you can turn this off in iOS Settings at any time. The app does not request your location, contacts, photos or microphone.
API keys and the Rosetta Agent. If you create API keys, we store a hashed form of each key, its name, and when it was last used. Where the Agent reports activity to your account, we store the records needed to show you that activity and to audit it.
Communications. If you email us, we keep the correspondence to answer you and for our records.
What we do not collect. We do not buy data about you from third parties, do not build advertising profiles, and do not collect precise location, contacts or sensitive categories of personal data.
3. Why we process it and on what basis
- To provide the Services you ask for: operating your account, remembering your preferences, delivering content and notifications, processing your subscription. Legal basis: performance of a contract.
- To keep the Services secure and working: detecting abuse, blocking automated crawling, debugging, measuring usage in aggregate. Legal basis: our legitimate interests in running a reliable, secure service.
- To communicate with you about your account, security notices and changes to our terms. Legal basis: contract and legitimate interests.
- To comply with law, including tax, accounting and lawful requests from authorities. Legal basis: legal obligation.
- With your consent, where we ask for it (for example, optional product emails). You can withdraw consent at any time.
We do not make decisions about you using solely automated processing that produce legal or similarly significant effects.
4. Who we share it with
We share personal information only with processors that help us run the Services, under contracts that limit their use of it, and otherwise only where the law requires. We do not sell personal information and do not share it for cross-context behavioural advertising.
- Supabase (database, authentication and storage; hosted in the United States).
- Vercel (web hosting and request logs; United States).
- Stripe (payments; subject to Stripe's own privacy policy).
- Apple and Google (sign-in providers; what they share with us is described in section 6).
- Resend (sending sign-in codes and account email).
- Umami (cookie-free analytics).
- Professional advisers, and authorities or courts where disclosure is legally required or necessary to protect our rights or the safety of others.
- A successor, if the business is sold or merged; we will tell you before your data becomes subject to a different policy.
5. Information about third parties in our intelligence content
Rosetta Intel's purpose is to report on public cybersecurity events. To do that, it collects and republishes information from public sources: vendor and government advisories, vulnerability catalogues such as CISA KEV and NVD, security research and news, open threat-indicator feeds, and public trackers that monitor what ransomware groups post on their own leak sites. That material can include the names of organisations, domain names, IP addresses, software versions and, occasionally, the names of individuals as they appear in the cited source.
- We process this information on the basis of our legitimate interest, and the public interest, in security research and in making public threat information easier to understand. We publish it with its source so that readers can check it.
- We do not add personal data about individuals beyond what the cited public source contains, and we do not attempt to identify or profile individuals.
- Datasets are mirrors of their sources. An entry means the source reported it; it is not our own finding or allegation.
- Public records of security events are kept as an archive and are not routinely deleted when the source removes them, because the removal itself is part of the record.
If you believe content about you or your organisation is inaccurate, misattributed or unlawful, or you wish to object to its processing, email contact@rosettalab.dev with the URL and your request. We will assess every request individually and respond within a reasonable time; we correct errors and add context, and we honour removals required by law.
6. Signing in with Apple or Google
When you sign in with Apple or Google, the provider sends us a token confirming your identity together with your email address and, where you allow it, your name and profile image. We use these only to create and recognise your account. We do not receive your password and we do not post to, read from or otherwise access your Apple or Google accounts. If you use Apple's Hide My Email, mail from us reaches you through Apple's relay and we never see your real address. Accounts that use the same verified email address through different providers are treated as one account; you can link or unlink sign-in methods from your account page.
7. Cookies and local storage
We use only the cookies and local storage needed to run the Services:
- a session cookie that keeps you signed in. It is set for the rosettalab.dev domain so that signing in on one Rosetta site signs you in on the others, and it is removed when you sign out;
- preference cookies for language and theme;
- security cookies that protect sign-in flows against forgery.
We set no advertising or third-party tracking cookies. Because of this, we do not show a cookie banner. Blocking cookies in your browser will prevent you from staying signed in.
8. How long we keep it
- Account data: until you delete your account, after which it is removed from our live systems promptly and from backups within thirty days.
- Billing records: for as long as tax and accounting law requires, typically seven years.
- Server logs: a short period, typically days, unless retained for an investigation.
- Analytics: aggregated and not linked to you.
- Public security records in our datasets: as an archive, as described in section 5.
9. Security
All traffic to the Services is encrypted in transit. Access to the database is controlled per row by the database itself, so that each account can read only its own data and the public content. We do not store passwords. Secrets such as API keys are stored hashed. No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you and the relevant authorities as the law requires.
10. International transfers
We are based in the United States and our processors store data there. If you use the Services from outside the United States, your information is transferred to and processed in the United States. Where the law requires a transfer mechanism, we rely on our processors' standard contractual clauses or equivalent safeguards.
11. Your rights and choices
Depending on where you live you may have rights to access, correct, delete, restrict or object to the processing of your personal information, to receive a copy of it in a portable form, and to withdraw consent. Regardless of where you live, we offer everyone the following:
- See and change your profile, preferences and linked sign-in methods from the account page in any Rosetta service.
- Delete your account from the account page, which removes your personal data as described in section 8.
- Export your account data by emailing us.
- Object or complain by emailing contact@rosettalab.dev. We respond within thirty days. You may also complain to your local data protection authority; in the European Economic Area and the United Kingdom that is the authority in your country of residence.
United States residents. Residents of California and other states with comprehensive privacy laws have rights to know, access, correct and delete personal information and to opt out of its sale, sharing for targeted advertising, or certain profiling. We do not sell personal information and do not share it for targeted advertising, so there is nothing to opt out of; the other rights are exercised through your account page or by email. We will not discriminate against you for exercising them. You may authorise an agent to act for you; we will verify the request. We do not respond to browser "Do Not Track" signals, because no common standard for them exists, but we honour Global Privacy Control signals where the law requires.
12. Children
The Services are not directed at children and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, email us and we will delete it.
13. Changes to this policy
We may update this policy. Material changes will be posted here with a new date and, for account holders, announced by email or inside the Services before they take effect. The date at the top tells you when it last changed.
14. Contact
BlurHorizon, LLC
131 Continental Dr Suite 305
Newark, DE 19713
United States
contact@rosettalab.dev