Privacy Policy
Last updated: 2026-02-25
This Privacy Policy explains how Readroom ("we", "us", "the Service") collects, uses, and protects your personal data.
1. Data Controller
The data controller for the processing of your personal data is the operator of this Readroom instance. For the managed SaaS service, the data controller is based in Finland.
2. Personal Data We Collect
We collect the following personal data: email address (for account creation and communication), username (optional, for social features), IP address (for security and rate limiting, stored temporarily), saved content metadata (URLs, titles, timestamps), and annotations and notes you create.
3. Legal Basis for Processing (GDPR Art. 6)
We process your data based on: contract performance (providing the Service), consent (optional features like email notifications), and legitimate interest (security, abuse prevention, service improvement).
4. Data Retention
Your account data and saved content are retained for as long as your account is active. If you delete your account, your data is removed from production systems promptly. Backup copies expire on their normal rotation cycle. Security logs containing IP addresses are retained for up to 90 days.
5. Your Rights
Under GDPR, you have the right to: access your personal data, rectify inaccurate data, erase your data ("right to be forgotten"), restrict processing, data portability (export your data), and object to processing. You can exercise most of these rights through your account settings.
6. How to Exercise Your Rights
You can export your data and delete your account through the settings page. For other requests, contact the instance administrator or the data controller.
7. International Data Transfers
Your data may be processed in the European Economic Area (EEA). If data is transferred outside the EEA (e.g., for cloud hosting or email delivery), appropriate safeguards are in place in accordance with GDPR Chapter V.
8. Cookies and Local Storage
Readroom uses only essential cookies (session authentication) and localStorage (theme preference, language setting). We do not use tracking cookies, analytics cookies, or third-party advertising cookies. No cookie consent banner is required as we only use strictly necessary cookies.
9. Subprocessors
We use the following third-party service providers to operate the Service. Self-hosted instances may use different providers as configured by the administrator.
| Provider | Purpose | Data Categories | Location |
|---|---|---|---|
| Hetzner | Cloud hosting | All service data | EU (Finland/Germany) |
| Hetzner | Object storage (S3 API) | Uploaded documents, cached images, backups | EU (Finland) |
| Email provider | Transactional email delivery | Email address, notification content | EU |
| Billing MoR | Payment processing | Email, billing address, payment method | EU/US |
10. Security Measures
We implement appropriate technical and organizational measures to protect your data, including: encryption in transit (TLS), password hashing (Argon2id), access controls, and regular security reviews.
11. Data Breach Notification
In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours (GDPR Art. 33). If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly (GDPR Art. 34).
12. Backup Retention
Database backups are maintained for disaster recovery. Data deleted from production systems will expire from backups on the normal rotation cycle.
13. Supervisory Authority
You have the right to lodge a complaint with a supervisory authority. The Finnish Data Protection Authority is: Tietosuojavaltuutetun toimisto, tietosuoja.fi.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes through the Service.