Privacy at Roder.

Last updated: 31 May 2026 · Effective: 31 May 2026

1. Who we are

Roder Oy (“Roder”, “we”, “us”) is the data controller for personal data collected through roder.ai and processed in connection with the Roder AI security platform. Roder is headquartered in Helsinki, Finland, with operations in Sweden. All production infrastructure is hosted in the EU.

2. Data we collect

Roder collects only the personal data needed to deliver the service, run the business and meet legal obligations.

• Visitor data: IP address (truncated), browser type, pages viewed, referring URL. Used for security and aggregate analytics. No third-party advertising cookies.
• Prospect and customer contact data: name, work email, company, role, country, fields you submit through forms (trial application, scoping session, partner application, contact).
• Account data: authentication identifiers, SSO claims, audit log of admin actions inside the Roder platform.
• Service data: request metadata routed through the Roder gateway (timestamps, identifiers, redacted content). Customers control content retention via Roder policies.
• Billing data: company name, VAT/Business ID, billing contact, payment metadata. Card numbers are handled by our PCI-compliant payment processor and never stored by Roder.

3. Why we process data and the legal basis

• Contract performance (GDPR Art. 6(1)(b)): to deliver the platform, support customers, manage billing.
• Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, product analytics, B2B prospecting limited to publicly identified business contacts.
• Legal obligation (Art. 6(1)(c)): accounting, tax, regulatory reporting.
• Consent (Art. 6(1)(a)): marketing newsletter sign-ups, optional cookies. You can withdraw consent at any time.

4. Sharing and sub-processors

Roder shares personal data only with sub-processors strictly necessary to deliver the service. Named processors include Snitcher (Snitcher BV) for first-party website analytics and B2B company identification on roder.ai, loaded only after you accept analytics cookies. A complete sub-processor list with locations and DPAs is available on request from compliance@roder.ai. Categories include EU-region cloud hosting, transactional email, observability, and authentication.

5. International transfers

Production data is stored and processed in the European Union. Where any sub-processor processes data outside the EU/EEA, transfers rely on EU Standard Contractual Clauses and additional safeguards as required by the Schrems II ruling. Customers can request an EU-only deployment under the Roder Enterprise option.

6. Retention

Personal data is kept only as long as needed for the purpose for which it was collected, after which it is deleted or anonymised. Default retention windows: visitor logs 90 days, prospect data 24 months from last interaction, customer account data for the term of the contract plus 12 months, billing data 6 years (tax law). Customers can request earlier deletion subject to legal obligations.

7. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to lodge a complaint with your supervisory authority (in Finland, Tietosuojavaltuutettu; in Sweden, Integritetsskyddsmyndigheten / IMY). Requests: compliance@roder.ai. We respond within one month.

8. Cookies

See our separate Cookies Policy.

9. Security

Roder operates a defence-in-depth security programme aligned to ISO 27001 and ISO 42001 and audited under SOC 2 Type II. Encryption in transit (TLS 1.3) and at rest (AES-256), least-privilege access, continuous logging, customer-controlled audit trail. Responsible disclosure: security@roder.ai.

10. Changes to this policy

Material changes are notified by email to active customers and posted on this page with a new “Last updated” date. Continued use of the platform after the effective date constitutes acceptance.

11. Contact

Roder Oy · Helsinki, Finland · compliance@roder.ai