Privacy Policy
Last updated: October 13, 2026
Summary
Roger returns the data you ask for to the AI assistant you connected (Claude, ChatGPT or another MCP client), where that assistant’s terms and your plan settings apply, and shares it only with the sub-processors listed on /privacy/ (for example Anthropic when you use Ask Roger). Roger never trains models on it.
Who we are
Bromance Software SRL (“we”, “Roger”), registered in Belgium (VAT BE1040.904.426), runs heyroger.ai, the app at app.heyroger.ai and the Roger MCP server at mcp.heyroger.ai (the “Service”). We are the data controller. Contact: hello@heyroger.ai.
How Roger works
Your team connects its tools (Google Ads, Meta Ads, Google Analytics, Search Console, Tag Manager, Merchant Center) to Roger once. Each teammate then adds Roger to their AI assistant and signs in. When they ask a question, the AI assistant calls Roger; Roger checks their role and your guardrails, reads or changes the connected account, and returns the result to that AI assistant.
You choose the AI assistant (for example Claude, ChatGPT, Cursor or VS Code). What it does with the data, including retention and model training, is governed by its terms and your settings there. AI assistants are not Roger’s sub-processors.
Data we collect
- Account and team: name, email, language, your workspace, websites and role on each, and the email addresses members enter to invite colleagues.
- Connected tools: OAuth tokens (encrypted at rest) and the ids and names of linked accounts.
- AI connections: which AI assistant each member connected, and when. Each connection can be revoked in Roger.
- Website profile and brand kit: website, description, targets, logo, colors, fonts. Roger reads your public website to prefill them.
- Files you upload or import from a public URL.
- Activity and Ask Roger data (below).
- Billing: plan, number of websites, invoices. Stripe handles card details.
- Technical data: IP address, browser, request logs, error reports.
- Product analytics: sign-up and activation events, used for onboarding emails.
Google and Meta access
Sign in with Google asks only for your name and email (openid, email, profile).
Connect Google asks for:
| Scope | Use |
|---|---|
adwords | Read Google Ads, and make the changes your team asks for. By default changes are drafts the requester confirms, and new campaigns start paused. |
analytics.readonly | Read Google Analytics 4 reports. |
webmasters.readonly | Read Search Console data. |
tagmanager.edit.containers | Read Tag Manager and draft changes in a workspace. Roger never publishes a container; changes take effect only when you publish them. |
content | Read Merchant Center status, product issues and feed health. |
Connect Meta asks for ads_read, ads_management and business_management, used to read Meta ad accounts and make the changes your team asks for, with the same drafts, guardrails and Activity.
You can revoke access at any time in Roger, at myaccount.google.com/permissions or in your Meta Business settings.
Google API Services User Data Policy
Roger’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Roger uses Google user data only to provide the features you use, including returning results to the AI assistant you chose. Roger does not use it for advertising, does not sell it, does not let humans read it except with your consent, for security or to comply with the law, and does not use it to develop or train generalized AI or machine learning models.
No model training
Roger does not use your data to train or fine-tune AI models, and our AI sub-processors do not train on the data we send them.
Activity
Activity records who acted, through which AI assistant, on which website, what changed (before and after), the reason the AI gave, and the outcome. For each tool call it also keeps the time, tool, member, AI assistant, status and request shape (field names, ids, date ranges). It never stores prompts, chat transcripts, AI replies or tool results. Every member with a role on a website sees its Activity. Entries cannot be edited.
Ask Roger
Ask Roger is Roger’s own expert agent for multi-step jobs. Your AI assistant’s request, the website context and the account data it reads are processed with Anthropic’s models, and the reply goes back to your AI assistant. Changes it proposes are drafts you confirm. The request and reply are kept 30 days and never shown in Activity. Ask Roger may record short operational notes; Roger sends them to OpenAI to group similar notes, and our team reviews them to improve Roger’s playbooks.
Sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Anthropic | Ask Roger models | US |
| OpenAI | Embeddings of Ask Roger’s operational notes | US |
| Letter | Transactional and onboarding email, product analytics | EU / US |
| Amazon Web Services (SES) | Email delivery for Letter | US |
| Stripe | Payments and invoices | US / EU |
| Railway | App hosting, database, job queue | EU |
| Cloudflare | R2 file storage (EU), DNS | EU / global |
| Sentry | Error tracking | EU (Germany) |
| Firecrawl | Reads your public website for the website profile | US |
| Sign-in and Google APIs; analytics on our site and app after consent | US / EU | |
| Meta | Marketing API | US / Ireland |
We update this list before adding a sub-processor that handles customer data.
Retention
| Data | Kept |
|---|---|
| Activity events | 25 months |
| Tool call records | 90 days |
| Ask Roger request and reply | 30 days |
| Account and workspace | While active; deleted within 30 days of closure or workspace deletion |
| OAuth tokens | Until you disconnect, revoke or close your account |
| Reminders of never-accepted invitations | Deleted 90 days after reminders stop |
| Unsubscribe list | Kept, to honor your choice |
| Technical logs | 30 days |
| Backups | Up to 90 days |
| Invoices | As Belgian accounting law requires |
When you delete your account, your name on past Activity becomes “Former member”.
Website cookies
Our website asks for consent. Until you click Accept, Google Tag Manager does not load and no analytics or ad tags run. Your choice is stored in roger_consent for 12 months; change it any time with “Cookie settings” in the footer. Details on our GDPR page.
Your rights and contact
You can access, correct, export or delete your data, object to or restrict processing, and withdraw consent. Email hello@heyroger.ai; see the GDPR page. Roger is a professional tool, not intended for people under 16. We email workspace owners at least 30 days before a material change to this policy.
Bromance Software SRL (VAT BE1040.904.426) · hello@heyroger.ai
