Privacy Policy

1. Data Controller Identity

Data Controller:
Digitala Idéfabriken Malmö AB
Malmö, Sweden

Privacy Contact: hello@roadmapper.io

2. Data We Collect

We collect the following categories of personal data:

Account Information

• Name, email address, and profile picture, received from Google when you sign in
• We do not collect or store passwords — authentication is handled entirely by Google

Payment Information

• Transaction records for credit purchases
• Collected via Lemon Squeezy (we receive only confirmation of payment, not full payment credentials)

Service Content

• Projects, roadmaps, and messages you exchange with the AI assistant
• Collected directly from your use of the Service

Technical Data

• IP address, device type, browser information, access logs
• Collected automatically

Analytics Data

• Usage patterns, feature engagement, session information
• Collected via Mixpanel

3. Google Sign-In and Google User Data

Roadmapper uses Google OAuth as its only sign-in method. When you sign in, we request access to your basic Google profile: your name, email address, and profile picture.

How we use this data:

• To create and identify your Roadmapper account
• To display your name and picture inside the app
• To contact you about your account and the Service

We do not request access to your Gmail, Google Drive, Google Calendar, contacts, or any other Google data beyond the basic profile. We do not share Google user data with third parties except as needed to operate the Service (hosting), and we never sell it or use it for advertising.

Roadmapper's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Roadmapper's access to your Google account at any time via your Google Account permissions.

4. How We Use Your Data

We process your personal data for the following purposes and legal bases under GDPR Article 6:

• Providing and operating the Service — Contract performance (Art. 6(1)(b))
• Processing payments — Contract performance + Legal obligation (Art. 6(1)(b), (c))
• Customer support — Contract performance (Art. 6(1)(b))
• AI-powered roadmap generation — Contract performance (Art. 6(1)(b))
• Service analytics and improvement — Legitimate interests (Art. 6(1)(f))
• Security and fraud prevention — Legitimate interests (Art. 6(1)(f))
• Legal compliance and record-keeping — Legal obligation (Art. 6(1)(c))
• Marketing communications (with consent) — Consent (Art. 6(1)(a))

Legitimate Interests: Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights. You may object to processing based on legitimate interests by contacting us.

5. AI Features and Data Processing

Roadmapper uses artificial intelligence, including Anthropic's Claude, to power the roadmap assistant. When you use AI features:

Data Transmitted to AI Providers

• Your chat messages to the assistant
• The content of the roadmap being edited, as context

Data NOT Transmitted

• Your name, email address, or profile picture
• Payment information

AI Provider Practices (Anthropic)

• API data is not used for model training
• Anthropic acts as our data processor under a Data Processing Agreement
• Standard Contractual Clauses govern EU-US data transfers

Future AI Providers: We may integrate additional AI providers. This policy will be updated to reflect any material changes to AI data processing.

6. Third-Party Data Sharing

We share personal data with the following categories of recipients:

• Anthropic (AI provider) — AI-powered features. Safeguards: DPA, SCCs
• Lemon Squeezy (Merchant of Record) — Payment processing. Safeguards: DPA, PCI-DSS compliance
• Mixpanel (analytics) — Service analytics, using EU data residency. Safeguards: DPA
• Google — Sign-in and cloud infrastructure (Google Cloud, EU region). Safeguards: DPA, SCCs where applicable
• Neon (database hosting) — Data storage. Safeguards: DPA, SCCs where applicable
• Professional advisors — Legal, tax, audit services. Safeguards: confidentiality obligations
• Law enforcement — Where legally required, only pursuant to valid legal process

We do not sell your personal data. We do not share personal data for third-party advertising.

7. International Data Transfers

As a Swedish company, your data is primarily processed within the EU/EEA. However, some processors (including Anthropic) are based in the United States.

Transfer Mechanisms:

• EU-US Data Privacy Framework: Where recipients are DPF-certified
• Standard Contractual Clauses (SCCs): EU Commission-approved clauses for non-DPF recipients
• Transfer Impact Assessments: Conducted for transfers to jurisdictions without adequacy decisions

You may request information about specific safeguards for international transfers by contacting hello@roadmapper.io.

8. Shared Roadmap Links

Roadmaps are private to your account until you create a share link. A shared roadmap is readable by anyone who has the link, without an account, until you disable sharing. Viewers see the roadmap content only — not your name, email address, or chat history. Consider what a roadmap contains before sharing it.

9. Cookies and Tracking Technologies

We use a small number of cookies:

• Session cookie (strictly necessary): Keeps you signed in to the app. No consent required.
• Analytics (Mixpanel): First-party cookies used to understand how the Service is used. Mixpanel is configured with EU data residency.
• Analytics (Google Analytics): Used on this marketing site to measure visits.

We do not use advertising cookies or third-party tracking for advertising purposes.

10. Data Retention

• Account information: Duration of account + 30 days
• Transaction records: 7 years (Swedish tax and accounting requirements)
• Roadmaps and chat messages: Duration of account; deleted with your account (+ 30 days)
• Analytics data: 2 years
• Support communications: 3 years

After retention periods expire, data is securely deleted or anonymized.

11. Your Rights (GDPR Articles 12-22)

You have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time (without affecting prior lawful processing)
• Automated Decision-Making: Not be subject to solely automated decisions with legal effects (we do not make such decisions)

How to Exercise Rights: Submit requests to hello@roadmapper.io. We respond within 30 days, with possible extension to 60 days for complex requests (with notification). We may request identity verification for security.

Right to Complain: You may lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se or your local supervisory authority.

12. Data Security

We implement technical and organizational measures to protect personal data:

• Encryption in transit (TLS 1.2+) and at rest
• Access controls and authentication requirements
• Regular security assessments
• Incident response procedures

No system is 100% secure. We will notify you and relevant authorities of data breaches as required by GDPR Articles 33 and 34.

13. Children's Privacy

Roadmapper is not intended for individuals under 18. We do not knowingly collect personal data from children. If we learn we have collected data from a child, we will delete it promptly.

14. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA/CPRA):

• Right to know what personal information is collected and disclosed
• Right to delete personal information
• Right to opt-out of sales (we do not sell personal information)
• Right to non-discrimination for exercising rights

Contact hello@roadmapper.io to exercise California rights.

15. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification at least 30 days before they take effect. The "Last Updated" date reflects the current version.

16. Contact Us

Contact: hello@roadmapper.io

Postal Address:
Digitala Idéfabriken Malmö AB
Malmö, Sweden