In short: we collect what we need to run Roundable, we don't sell it, we don't track you around the web, and you can ask us to delete it at any time.
Who we are
Roundable is operated by CV LAIN GROUP, Eastern Park B1, Indonesia ("we", "us"). We run roundable.app and the Roundable studio at studio.roundable.app, a tool for leaving and managing feedback on live websites. For anything in this policy, write to hello@roundable.app.
What we collect
- Account details for agency users: your name, email address, a securely hashed password or your Google sign-in, and an optional profile photo.
- Workspace and project content: project names, the page addresses you add, pins, their position on the page, comments and replies, statuses, and any images you attach.
- Client reviewers who open a share link: the name they type in, plus a random identifier stored in their browser so they can edit their own comments. Clients don't need an account.
- Billing: your plan, billing period and status, and the customer and subscription IDs from our reseller. Payments are taken by Paddle.com, our Merchant of Record, under Paddle's privacy policy; we never see or store your card details.
- Technical data: IP address, browser type and request logs, used to keep the service secure, prevent abuse (for example, rate limiting) and fix problems.
The websites you review
To show a page inside Roundable, our servers fetch it from its public address when you or your client open it. We use it to display the page and place pins; we don't publish it or use it for anything else. Only add sites you're allowed to review.
If a site is behind a password (a staging site, say) and you save that password in Roundable, we store it encrypted and use it only to open that site for you and your clients. You can remove it at any time.
Project pictures: for a project on a public live site, your dashboard asks a public screenshot service (WordPress mShots, run by Automattic) for a picture, so that service receives the site's address. We never ask it for uploaded HTML files or for sites behind a saved password, and you can upload your own picture instead.
How we use it
- To run the service: sign you in, show your projects, and deliver feedback to the right people.
- To send service emails: invitations, sign-in and password notices, notifications about feedback and due dates that you can switch off in Settings, billing notices, and a welcome email when you sign up.
- To keep Roundable secure and reliable, and to improve it.
We don't sell personal data, and we don't use advertising or cross-site tracking.
Cookies and local storage
We use only what the service needs: a sign-in cookie, the client identifier described above, and small preferences stored in your browser (such as light or dark mode). There are no advertising or analytics cookies.
Who we share it with
Service providers that help us run Roundable (hosting, database, email delivery, Google if you choose Google sign-in, and Paddle for payments), under agreements that limit their use to providing that service. We may also disclose data if the law requires it. Everyone in a workspace can see its projects, and anyone with a project's share link can see that project's feedback.
AI tools
"Copy for AI" puts your feedback on your clipboard or saves it as a file on your device. Roundable doesn't send it to any AI service; where you paste it, and that service's terms, is up to you.
If you connect an AI tool (such as Claude, ChatGPT, Cursor or VS Code) to your workspace, that tool can read your projects' feedback and write notes and status changes as you allowed, until you remove the connection in Settings. What the tool does with that data is covered by its own terms and privacy policy.
Slack, webhooks and client reports
If you connect Slack or add a webhook, we send notifications about feedback (its text, who wrote it and a link) to the address you set. We store those addresses and signing secrets encrypted. A client report is a web page that anyone with its link can read until you turn it off.
Where your data is stored
Roundable runs on a server in France, and its database is hosted in Frankfurt, Germany, so your content is stored in the European Union. Because we operate from Indonesia, and some of our providers (for payments, email and sign-in) work globally, your data can also be accessed or processed outside the EU. Where that happens, we rely on the safeguards our providers offer and limit access to what is needed to run the service.
How long we keep it
We keep your content while your account is active. When you delete a project, workspace or account, the related content is deleted from the live service; copies in backups are removed as those backups expire.
Your rights
You can delete your account yourself in Settings › Account, and change your sign-in email there too. You can also ask to access, correct, export or delete your personal data, or object to how we use it. Email hello@roundable.app and we'll reply within 30 days. Depending on where you live, you may also be able to complain to your local data protection authority.
Security
We use encryption in transit, hashed passwords and access controls, and we render the websites you review on a separate domain from your account. No system is perfectly secure, so please tell us straight away if you notice anything wrong.
Children
Roundable is a business tool and isn't meant for anyone under 16.
Changes
If we change this policy in a meaningful way, we'll update the date above and tell account holders by email or in the app.