Legal: privacy, terms and cookies

1. Who we are

Main Perfection, Lda. (ROOTKey), Campo Grande n.º 28, 4.º B, 1700-093 Lisboa, Portugal ("ROOTKey", "we", "us"), is responsible for the personal data described in this policy. We have not appointed a data protection officer, as the law does not require one for our activity. For any question or request about your personal data, write to security@rootkey.ai.

2. Our two roles

Controller. We decide how and why we use the data of website visitors, people who contact us or subscribe to our newsletter, job applicants, account holders and billing contacts. This policy covers that data.

Processor. When a customer connects or uploads files, documents, tables or databases to the ROOTKey platform, the customer decides what that content is used for. For that content we act on the customer's instructions, under our Terms and a data processing agreement, which is available on request at security@rootkey.ai. If your data is in content that a customer of ours processes, see section 10.

3. What we collect, why and for how long

We do not sell personal data, and we do not make decisions about you based solely on automated processing.

4. Integrity proofs and the public blockchain

To prove that a file has not changed, the platform calculates a SHA-256 fingerprint of it and records that fingerprint on the Polygon public blockchain. Only fingerprints and technical identifiers are recorded, never the content of a file, its name or personal data. A fingerprint cannot be turned back into the file.

Records on a public blockchain are permanent: nobody, including ROOTKey, can change or delete them. When you delete a file or close your account, we delete the link between the fingerprint and you in our own systems, so the record on the blockchain can no longer be associated with you.

5. Where the data is stored

On the SaaS version of the platform, data is stored in data centres in the European Union, with Amazon Web Services, Cloudflare and, for some services, Microsoft Azure or Google Cloud, all in EU regions. When a customer runs ROOTKey in its own private cloud or on its premises, its content stays in its infrastructure and we only access it as agreed with the customer, for example for support.

6. Who we share data with

We use the following service providers, who process personal data on our behalf, under contract and only for the purposes described here:

We may also share data with public authorities when the law requires it, with our professional advisers under a duty of confidentiality, and with a buyer or successor if ROOTKey is involved in a merger or acquisition, who must keep protecting the data as described here.

7. Transfers outside the European Union

We prefer providers and regions in the European Union. Some providers, such as Google, HubSpot, Microsoft and Stripe, are based in the United States or may access data from there. In those cases the transfer relies on the EU-U.S. Data Privacy Framework when the provider is certified under it, or on the Standard Contractual Clauses approved by the European Commission, with additional safeguards where needed.

8. Security

We protect personal data with encryption in transit, access control based on need, logging of access, and integrity verification of our own records. No system is free of risk: if a personal data breach is likely to put you at risk, we will notify the supervisory authority and, where required, you, as the law sets out.

9. Your rights

You can ask us to access, correct or delete your personal data, to restrict or object to its use (including for direct marketing, at any time), to receive it in a portable format, and you can withdraw any consent you gave, without affecting what was done before. Write to security@rootkey.ai; we answer within one month, and may ask you to confirm your identity. You can unsubscribe from the newsletter through the link in every email, and change your cookie choices at any time with the Cookie settings link at the bottom of every page.

You also have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or to the authority of the country where you live.

10. People whose data our customers process

If your personal data is in files or systems that a customer of ours protects with ROOTKey, that customer is responsible for it. Please send your request to them; we will help them answer it.

11. Children

Our website and services are meant for professionals and are not directed to children under 16. We do not knowingly collect their personal data; if you believe we have, contact us and we will delete it.

12. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version. If a change is significant, we will tell account holders by email before it takes effect.

1. About these terms

These terms are an agreement between you and Main Perfection, Lda. (ROOTKey), Campo Grande n.º 28, 4.º B, 1700-093 Lisboa, Portugal ("ROOTKey", "we"). They apply to the website www.rootkey.ai and to the ROOTKey platform (app.rootkey.ai) on the Starter, Pro, Business and Advanced plans. Enterprise plans are governed by their own written agreement, which prevails over these terms where they differ.

By creating an account or using the platform you accept these terms. If you accept them on behalf of an organisation, you confirm that you are authorised to bind it, and "you" means that organisation. How we handle personal data is described in our Privacy Policy and Cookie Policy.

2. Accounts

You must be at least 18 years old and able to enter into a contract. Keep the information in your account accurate and your sign-in credentials secret; you are responsible for activity under your account. Tell us at once at security@rootkey.ai if you suspect unauthorised use.

3. The service

ROOTKey records integrity proofs of your files and data, detects what changed, and helps restore the last verified version. The features, limits and usage allowances of each plan are described on the pricing page at the time you subscribe. We keep improving the service and may change features, as long as the core of what you subscribed to stays available during your current billing period. Features marked as beta or preview are offered as they are and may change or end.

4. Plans, prices and payment

Prices are shown on the pricing page in euros, excluding VAT, which is added where it applies. Paid plans are billed in advance, monthly or yearly, through our payment provider Stripe. Yearly billing has the discount shown on the pricing page.

Subscriptions renew automatically for the same period until you cancel. You can cancel at any time in your account; the cancellation takes effect at the end of the period already paid, and the plan stays available until then. Except where the law gives you a right to a refund (see section 5), payments are not refundable.

We may change prices with at least 30 days' notice by email; the new price applies from your next renewal, and you can cancel before it does. If a payment fails, we may suspend paid features until it is settled.

5. If you are a consumer

If you use the platform for purposes outside your trade or profession, you are a consumer and keep every right the law gives you, which these terms never limit. In particular, you may withdraw from a paid subscription within 14 days of taking it out, without giving a reason, by writing to support@rootkey.ai. If you ask us to start the service during those 14 days, you will be asked to confirm it at checkout, and if you then withdraw you will pay only for the part of the service already provided.

6. Acceptable use

You must not use the website or the platform to break the law or anyone's rights; upload malware or content you have no right to use; try to access accounts, systems or data that are not yours; copy, resell or reverse engineer the platform; get around usage limits or security measures; or test the security or load of the service without our written permission. If you find a vulnerability, please report it to security@rootkey.ai.

7. Your content and data

You keep all rights to the files and data you connect or upload ("your content"). You allow us to process your content only as needed to provide, secure and support the service. You are responsible for having the right to use your content and a legal basis for any personal data in it; for that content we act as your processor, under a data processing agreement available on request.

Integrity proofs are recorded on the Polygon public blockchain and cannot be changed or deleted by anyone, including ROOTKey. They contain only fingerprints and technical identifiers, never your content.

When your account is closed you have 30 days to export your content and proofs; after that we delete them, except what the law requires us to keep.

8. What an integrity proof means

A ROOTKey proof shows that a file matched a given fingerprint at a given time, and lets anyone check it independently. It is technical evidence, not legal advice, and on its own it does not make you compliant with any regulation. ROOTKey is not a qualified trust service provider under the eIDAS Regulation, and whether a proof is accepted as evidence is for the court or authority concerned to decide.

9. Availability and support

We work to keep the platform available at all times and target 99.9% uptime, but on the self-service plans this is a target, not a contractual commitment; contractual service levels are part of the Enterprise agreements. We may interrupt the service for maintenance, and announce planned maintenance in advance whenever we can. Support is provided by email at support@rootkey.ai, at the level included in your plan.

10. Intellectual property

The website, the platform, its software, design and brand belong to ROOTKey or its licensors. Subject to these terms, we give you a personal, non-exclusive and non-transferable right to use the platform during your subscription. If you send us ideas or feedback, we may use them freely, without any obligation to you.

11. Third-party services and links

The website and the platform may link to, or connect with, services that we do not control, such as storage services you choose to connect. Their own terms apply to them, and we are not responsible for their content, availability or practices.

12. Confidentiality

Each of us will keep confidential the non-public information received from the other in connection with the service, use it only for the purposes of these terms, and protect it with at least reasonable care.

13. Suspension and termination

You can close your account at any time. We may suspend or close an account, after notice where possible, if these terms are seriously breached, if a payment remains unpaid, or if needed to protect the service, other users or the law. If we end the service for reasons that are not your fault, we will refund the unused part of any prepaid period.

14. Warranties

We provide the service with reasonable care and skill. Beyond that, and to the extent the law allows, the service is provided as it is and as available, without other guarantees. The content of the website, including articles, guides and tools such as the NIS2 simulator, is general information, may contain errors, and is not legal, regulatory or professional advice.

15. Limitation of liability

To the extent the law allows, ROOTKey is not liable for indirect or consequential losses, such as loss of profits, revenue or business, and its total liability arising from these terms in any 12-month period is limited to the amounts you paid us for the service in the 12 months before the event that caused it.

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, for wilful misconduct or gross negligence, or any liability that cannot be limited under the law, including consumers' statutory rights.

16. Changes to these terms

We may update these terms. The date at the top shows the latest version. We will give account holders at least 30 days' notice by email of any change that affects them significantly; if you do not agree, you can cancel before it takes effect.

17. Law, disputes and complaints

These terms are governed by Portuguese law, and the courts of Lisbon have jurisdiction, without prejudice to the mandatory protections that consumers have under the law of the country where they live.

Consumers may also refer a dispute to a consumer arbitration centre, such as the Centro Nacional de Informação e Arbitragem de Conflitos de Consumo (www.cniacc.pt), and submit a complaint in the electronic complaints book (www.livroreclamacoes.pt).

These terms are available in several languages. If the versions differ, the Portuguese version prevails, except where the law of a consumer's country requires otherwise.

18. Contact

Questions about these terms: support@rootkey.ai. Privacy and security: security@rootkey.ai. Postal address: Main Perfection, Lda., Campo Grande n.º 28, 4.º B, 1700-093 Lisboa, Portugal.

1. What cookies are

Cookies are small files a website stores in your browser. This policy also covers similar technologies, such as the browser's local storage. Some are needed for the website to work; others help us understand how it is used or measure our advertising, and those are only used with your consent.

2. Cookies we use

Strictly necessary (always on)

Analytics (only with your consent)

Marketing (only with your consent)

We use Google Consent Mode: until you accept, no Google tag is loaded, and if you withdraw your consent, Google Analytics and Google Ads stop at once.

3. Embedded videos

Some blog articles include YouTube videos in privacy-enhanced mode. Nothing is loaded from YouTube until you play a video; once you do, YouTube may set its own cookies under its policies.

4. How to choose or change your mind

On your first visit a banner lets you accept all, reject all, or choose by purpose. You can change your choice at any time with the Cookie settings link at the bottom of every page, or with the button below. You can also block or delete cookies in your browser settings; the website will keep working, but your preferences may not be remembered.

5. The ROOTKey platform

The platform at app.rootkey.ai uses its own strictly necessary cookies to keep you signed in and secure, and asks for your consent before using analytics tools.

6. Changes to this policy

We update this policy when the cookies we use change. The date at the top shows the latest version, and if we add a new purpose we will ask for your consent again.