Privacy Policy
Last updated: 2026-10-26.
Rolebase (the "Platform"), available at rolebase.io, is operated by GDFR, a French SASU with a share capital of 1,000 euros, registered office at 61 rue de Lyon, 75012 Paris, France, registered with the Paris Trade and Companies Register under number 102 951 001 (the "Company").
This policy explains which personal data the Company processes, why, for how long, who it shares them with and how to exercise your rights. For any question, write to [email protected].
1. The Company's two roles
The Company processes personal data in two capacities.
- Controller. The Company alone decides why it processes the data related to your account, billing, support, audience measurement, error tracking and its own communications. It answers to you directly for these, under this policy.
- Processor for your organization. The content an organization enters in the Platform (members, roles, circles, meetings, minutes, decisions, tasks, threads) belongs to the organization, which is its controller. The Company processes this content only to provide the service and on the organization's instructions, under section 4.2 of the Terms of Sale. To exercise your rights over this content, contact the organization first. If the Company receives such a request directly, it forwards it to the organization. When an Owner deletes the organization, its content is no longer accessible and is deleted for good 30 days later.
2. Data processed by the Company
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Create and manage your account, sign you in, handle invitations | First name, last name, email, encrypted password, photo, language, time zone, onboarding answers, sign-in dates, IP address | Performance of the contract | Lifetime of the account. Deletion as soon as you delete your account from the Platform, or within one month of a request by email |
| Bill subscriptions and keep the accounts | Name, email, billing address, VAT number, payment history. Card data stays with the payment provider, so the Company has no access to it | Performance of the contract, then legal obligation | 10 years for accounting records |
| Answer your support requests | Name, email, messages exchanged, account and organization identifiers | Performance of the contract, or legitimate interest for visitors without an account | 3 years after the last exchange |
| Measure website audience and Platform usage to improve it | Pages viewed, actions taken, browser, operating system, country. Inside the Platform, the organization's identifier, plan and size, and the onboarding answers are added. Your name and email are never sent to the measurement tool | Legitimate interest | 25 months |
| Detect and fix technical errors, secure the service | Error traces, account identifier, IP address, browser, server logs | Legitimate interest | 90 days |
| Send service emails, product announcements and the newsletter | Name, email, language, opens and clicks | Performance of the contract for service emails. Legitimate interest for announcements sent to users, consent for other contacts | Until you unsubscribe, and at most 3 years without interaction for a contact who is not a user |
The Company does not sell your data and does not use it for advertising.
3. Recipients
Only the Company and its technical providers access the data, to the extent their task requires. These providers are bound to the Company by a contract imposing the obligations of Article 28 of the GDPR. They fall into the following categories:
- hosting of the Platform and its data, in the European Union
- hosting of the public website
- email delivery
- online payment
- accounting
- email and support chat
- audience measurement and error tracking
- artificial intelligence features
Artificial intelligence features send the provider the content needed for the requested task, for example the notes of a meeting to summarize. This provider is contractually bound not to use these data to train its models.
The Company also discloses data when the law or a court order requires it.
4. Transfers outside the European Union
Some payment, artificial intelligence, email and website hosting providers process data in the United States. These transfers are covered by the EU-US Data Privacy Framework for certified providers, and by the European Commission's Standard Contractual Clauses. You can get a copy of these safeguards by writing to [email protected].
5. Services you connect
If you connect your Google Calendar or Microsoft Outlook calendar, the Platform only stores and transfers the information needed to synchronize your Rolebase meetings. Events that do not come from Rolebase are never retrieved or stored. These synchronizations comply with the Google API Services User Data Policy and the Microsoft APIs Terms of Use.
If you connect an artificial intelligence assistant to the Platform, or join a video call from a meeting link, the data you send to these services fall under their own terms.
6. Cookies and trackers
The Platform only uses trackers needed for it to work: keeping you signed in, remembering your display preferences and running the support chat. These trackers are exempt from consent.
Audience measurement works without cookies. It produces statistics for the Company only, which does not combine them with any other source and does not share them with anyone.
7. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. You can object at any time to audience measurement and to product announcements. Every marketing email contains an unsubscribe link.
To exercise these rights, write to [email protected] from your account's email address. The Company answers within one month.
Organization administrators can export all of the organization's data from the Platform at any time.
You can delete your account at any time from the Platform settings, once you no longer belong to any organization. Your account data are erased right away. The content you contributed to an organization belongs to it and stays there. If you are the Owner of an organization, you can delete it from its settings: its content is deleted for good 30 days later.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL, or with the authority of your country.
8. Security
Platform data are hosted in the European Union and backed up regularly. Connections are encrypted with HTTPS, passwords are stored encrypted, and access to data is restricted by organization and by circle. Only the Company's president has access to production data.
Keep your password confidential and tell the Company immediately if your account is used without your permission.
Avoid entering sensitive data in the Platform (health, political opinions, religious beliefs, trade union membership, ethnic origin, sexual orientation). Users remain responsible for the content they publish.
9. Minors
The Platform is reserved for people aged 18 or over with full legal capacity.
10. Changes to this policy
The Company may change this policy. In case of a significant change, it informs users through a notification in the Platform or by email.