Privacy
Privacy Policy
Last updated: 2026-07-01
This policy explains what personal data Daniil Kosolapov, an individual trading as "roitrack" ("roitrack", "we", "us") collects when you use the roitrack website, the customer portal at account.roitrack.app, and the roitrack license validation service — collectively, the "Service". It does not cover data processed by the roitrack software running on your own server; that data stays on your infrastructure and never reaches us.
1. Data controller
The data controller is Daniil Kosolapov, an individual trading as "roitrack", postal address available on request via support@roitrack.app. For any privacy-related question, contact support@roitrack.app.
2. What we collect and why
| Data | When | Why |
|---|---|---|
| Email address | Account signup, license issuance | Login, account recovery, transactional emails (welcome, verification, password reset, payment failure notice) |
| Password (bcrypt-hashed, never stored in plaintext) | Account signup | Authentication |
| IP address | Account requests, license validation calls from your server | Security (rate limiting, abuse detection), license-per-server pinning |
| License key, subscription ID, plan, expiry | Purchase or trial issuance | Delivering the paid service |
| Creem customer ID | Purchase | Linking your portal account to your subscription for billing management |
| License validation events (timestamp, tracker version, source IP) | Each license check from your server | Enforce the license, help support diagnose "why is my install blocked" tickets |
| Session tokens | Login | Keep you logged in without re-entering credentials each request |
We do not use any third-party website analytics, tracking cookies, ad networks, or cross-site trackers on our marketing site, docs, or portal.
3. Legal basis (EU/UK visitors)
Under the GDPR / UK GDPR:
- Contract — data listed above is processed to provide the Service you've purchased or signed up for.
- Legitimate interests — IP addresses and validation event logs are processed to prevent abuse, detect fraud, and keep the license system honest. You can object to this processing by contacting us.
- Legal obligation — payment records are retained as required by tax and accounting laws in Vietnam.
4. Cookies
We use a small number of strictly necessary cookies:
roitrack_license_sessionand account portal auth cookies — HTTP-only, mark you as logged in. Cannot be read by JavaScript, expire on logout or after a period of inactivity.
No third-party cookies. No analytics cookies. No ad cookies. Because of this, no cookie banner is required on our site.
5. Payment processing
All payments are processed by Creem as our merchant of record. Card details are entered on Creem's secure checkout page and are never transmitted to or stored by roitrack. We receive only the customer identifier, subscription status, invoice metadata, and country. See Creem's privacy policy for how they handle your card data.
6. Email delivery
Transactional emails (welcome, verification, password reset, receipt, dunning) are sent through Resend. Resend processes the recipient email address and message body for the sole purpose of delivering the message.
7. Hosting and infrastructure
Our website is hosted on Cloudflare Pages. The customer portal and license service run on virtual servers in the European Union. Cloudflare acts as a network reverse proxy and a DDoS/security layer.
7.1 International transfers
roitrack is operated from Vietnam by an individual. Personal data collected through the Service is stored on servers located in the European Union. Where the operator accesses that data from Vietnam for support and administration, this may constitute an international transfer under the GDPR and UK GDPR. Such transfers rely on the Standard Contractual Clauses adopted by the European Commission.
7.2 Vietnamese users
For users resident in Vietnam, we process personal data in accordance with Decree 13/2023/ND-CP on Personal Data Protection.
8. How long we keep your data
- Account and license records — for as long as your account is active, plus a reasonable period for support, dispute resolution, and legal record-keeping.
- Validation event logs — rolling 12 months.
- Session cookies — cleared on logout or when they expire.
- Payment records — as required by applicable tax and accounting laws in Vietnam (typically 5–10 years).
9. Sharing your data
We do not sell your personal data. We share it only with the processors listed above (Creem, Resend, Cloudflare) so we can deliver the Service. Each processor is contractually bound to protect your data. We may also disclose data if legally required to (court order, valid law-enforcement request).
10. Your rights
Depending on where you live, you may have rights to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and associated data
- Object to certain processing based on legitimate interest
- Receive your data in a portable format
- Lodge a complaint with your local data protection authority
To exercise any of these rights, email support@roitrack.app. We respond within 30 days.
11. Security
Passwords are hashed with bcrypt. Sessions live in HTTP-only cookies. Traffic to our servers is served over TLS. Backups of our license database are encrypted before leaving the primary server. We do not claim any system is perfectly secure — if you have a security concern, please email us so we can address it.
12. Children
The Service is not intended for children under 16. We do not knowingly collect personal data from anyone under 16.
13. Changes to this policy
We may update this policy from time to time. When we do, we'll update the "Last updated" date above. Material changes will be announced by email to registered customers.
14. Data protection contact
As a small operator, roitrack is not required to appoint a formal Data Protection Officer. Privacy questions and rights requests are handled directly by the founder at support@roitrack.app.