On this page
This register records the processing activities Rahoto carries out as a controller under Article 30(1) GDPR: the account, billing, and operational processing needed to run the Service. Processing we perform on your behalf as a processor is governed by the Data Processing Agreement and is not repeated here. Rahoto is an EU-hosted service; the vendors that may process data are listed on the sub-processor page.
1. Account management & lifecycle
- Purpose
- Create and operate user accounts, authenticate sign-in, and run the closure lifecycle: immediate deactivation on closure, a 30-day grace period in which the account can be restored, then erasure.
- Categories of data subjects
- Account holders and their organisation’s authorised users.
- Categories of personal data
- Name, work email, organisation, authentication identifiers, and session records.
- Recipients / processors
- Hetzner (EU hosting) and EU S3-compatible object storage for snapshots. No third-party recipients beyond the sub-processors listed on the sub-processor page.
- Retention
- Retained while the account is active. On closure the account is deactivated immediately and, after the 30-day grace period, identifying fields are anonymised, the email is released for reuse, and the encryption keys are destroyed (crypto-shred). A minimal, append-only record of the erasure is kept to evidence it occurred, as required by law; a legal hold pauses erasure for its duration.
- Security measures
- Encryption in transit and at rest, role-based access control, PostgreSQL row-level security, an append-only hash-chained audit log, and crypto-shred of KMS-managed keys on erasure.
2. Report & document processing
- Purpose
- Store, render, version, and deliver the reports and documents users build in the editor.
- Categories of data subjects
- Account holders, plus any data subjects present within the Customer Data a user places in a report.
- Categories of personal data
- Report content and any personal data it contains, as determined by the sources connected and the reports built.
- Recipients / processors
- Hetzner (EU hosting) and EU S3-compatible object storage for assets, exports, and snapshots.
- Retention
- Retained while the account is active; erased with the account under the lifecycle above. Enterprise plans may pin residency by region.
- Security measures
- Encryption in transit and at rest, role-based access control, row-level security, and an append-only, hash-chained audit log; enterprise customer-managed keys (BYOK).
3. Data-source connection processing
- Purpose
- Connect to the data sources a user configures and bind live data into reports on the user’s instruction.
- Categories of data subjects
- Account holders, plus data subjects present within the sources a user connects.
- Categories of personal data
- Connection metadata and credentials (stored encrypted), and the personal data within connected sources as processed on the user’s instruction.
- Recipients / processors
- Hetzner (EU hosting) and EU S3-compatible object storage. The external data sources a user configures are the user’s own systems, not Rahoto sub-processors.
- Retention
- Connection configuration is retained while the account is active and erased with it. Query results are cached only as long as needed to render and refresh reports.
- Security measures
- Credentials encrypted at rest with KMS-managed keys, encryption in transit, role-based access control, row-level security, and audit logging.
4. AI-assisted features
- Purpose
- Provide AI report generation, chart suggestions, and reader Q&A when a user invokes them.
- Categories of data subjects
- Account holders, and data subjects within the content a user asks the AI to work on.
- Categories of personal data
- The user’s prompt or instruction, plus schema and aggregate profiles derived from Customer Data, never raw dataset rows. Personal details detected on Rahoto’s servers (names, postal addresses and postcodes, email addresses, phone, card, bank account and national ID numbers, IP addresses and dates of birth) are pseudonymised; other free text in the prompt is sent as written; images and audio submitted for transcription are sent as submitted.
- Recipients / processors
- Anthropic (Claude API) as the primary report-reasoning provider; Google (Gemini API) for configured multimodal and design tasks; OpenAI (OpenAI API) as a configured alternative or failover; and Recraft for editable-vector artwork when enabled. Each provider receives only the restricted input needed for its task, never raw customer rows, and does not train on Customer Data. Bring-your-own model endpoints configured by a customer are not Rahoto sub-processors.
- Retention
- Prompts and generated output are kept in an AI request log for up to 24 months by default, and erased with the account.
- Security measures
- Reversible pseudonymisation of common identifiers with a per-request pseudonym vault and per-tenant key, removal of special-category (Article 9) columns, local-only processing for restricted data, residency-aware routing, transport encryption, role-based access control, and audit logging.
5. Billing & subscriptions
- Purpose
- Take payment for paid plans, manage subscriptions, and issue invoices.
- Categories of data subjects
- Account holders and designated billing contacts.
- Categories of personal data
- Billing contact name, email, organisation, and subscription and payment status. Full card numbers are handled by the payment processor and are not stored by Rahoto.
- Recipients / processors
- Stripe (EU / US under Standard Contractual Clauses) for payment processing.
- Retention
- Invoices and billing records are statutory records retained for the period required by applicable law at the organisation level, separately from erased personal data.
- Security measures
- Payment card data handled by Stripe under PCI scope; transport encryption, role-based access control, and audit logging on Rahoto’s side.
6. Support & staff access
- Purpose
- Respond to support requests and let authorised staff perform back-office account actions under audit.
- Categories of data subjects
- Account holders who contact support or whose account staff act on.
- Categories of personal data
- Account and, where strictly necessary to resolve an issue, report data, accessed under audited controls.
- Recipients / processors
- Authorised Rahoto staff only. No external recipient beyond the operational sub-processors already listed.
- Retention
- Support correspondence is retained while needed to operate the relationship; staff-action audit records are retained per the plan’s compliance settings.
- Security measures
- Role-based, least-privilege staff access, PostgreSQL row-level security, and an append-only, hash-chained audit log of every back-office action.
7. Email delivery
- Purpose
- Send account, verification, and report-delivery notification emails.
- Categories of data subjects
- Account holders and the recipients a user delivers a report to.
- Categories of personal data
- Recipient email addresses and the content of the notification or delivered report.
- Recipients / processors
- Transactional email provider (EU).
- Retention
- Delivery metadata is retained only as long as needed to operate and troubleshoot delivery; message content is not retained beyond delivery.
- Security measures
- Encryption in transit, role-based access control, and audit logging; the marketing site sets no tracking cookies in delivery.
8. Product analytics & diagnostics
- Purpose
- Operate and secure the Service using feature-usage, audit, and error telemetry, and measure consented marketing-page and CTA usage without an analytics cookie or third-party tracker.
- Categories of data subjects
- Account holders, users of the Service, and marketing-site visitors who opt into Analytics.
- Categories of personal data
- Product feature-usage events, audit events, and diagnostic telemetry. Consented marketing events contain only pathname, page type, and a controlled CTA destination; public ingestion removes identity, IP, user agent, and referrer.
- Recipients / processors
- Error & uptime monitoring provider (EU). No advertising or third-party analytics trackers.
- Retention
- Marketing and product analytics events are retained for up to 12 months unless a shorter operational schedule is configured; audit events follow the plan’s compliance settings.
- Security measures
- Encryption in transit and at rest, role-based access control, row-level security, and an append-only, hash-chained audit log.
Contact
Questions about this register or to exercise your rights: [email protected]. See also the Privacy Policy and Trust Center.