How Rosegold Technologies Limited collects, uses and protects personal data — across our marketing site and the rosegold platform.
This privacy notice describes how Rosegold Technologies Limited ("rosegold", "we", "us") collects, uses and protects personal data. We are a private limited company registered in England and Wales (Companies House number 17181202), with registered office at 38 Charlotte Street, London, England, W1T 2NN.
For any question about this notice or about your personal data, contact support@rosegold.app.
This notice covers personal data we process across two contexts:
Where the two contexts process different data, this notice splits them out. Where they overlap, we say so.
When you choose, inside a participating merchant's Shopify store, to verify your travel history with rosegold, the following happens:
Per verification, rosegold computes and retains the following derived signals, and shares them with the merchant whose store you are verifying within:
| Attestation | What the merchant sees |
|---|---|
| Genius level | 1 · 2 · 3 · none |
| Travel frequency band | A percentile based on activity in your account versus the general population. |
| Recent destination regions | Up to five broad geographic regions or cities. |
| Upcoming trip signal | A broad region or city. Never specific dates or property names. |
| Trip count | A number based on your account activity. |
| Recent search-intent regions | Up to three broad regions you have recently shown interest in. |
We do not retain or share with merchants: hotel-level history, exact travel dates, prices or spend, party size, names of co-travellers, review contents or any contact information beyond what your Shopify account already exposes to the merchant.
| Processing | Lawful basis |
|---|---|
| Adding you to the waitlist and sending you launch updates | Consent — Art. 6(1)(a) UK GDPR / EU GDPR |
| Server logs and cookieless analytics | Legitimate interest — Art. 6(1)(f) — site security and traffic analysis, balanced against your reasonable expectations |
| Booking.com portability request and attestation computation | Consent — Art. 6(1)(a) — captured in-flow before each verification |
| Sharing attestations with the verifying merchant | Consent — Art. 6(1)(a) — captured in the same in-flow consent screen |
| Responding to support requests and rights requests | Legal obligation — Art. 6(1)(c) — and legitimate interest |
You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, email support@rosegold.app.
We have designed the verification flow within the rosegold platform to align with the legislative purpose set out in Recital 59 — enabling contestability and end-user empowerment — and with the draft EC/EDPB joint guidelines on the interplay between the DMA and the GDPR (October 2025):
The table below lists the sub-processors we engage to deliver the marketing site and the rosegold platform, together with the participating merchant who receives attestations as an independent controller under your consent.
All sub-processors are bound by data-processing agreements. Transfers to processors outside the UK and EEA rely on Standard Contractual Clauses and, where the processor is certified, the EU–US Data Privacy Framework.
| Recipient | Role | Location | Transfer mechanism |
|---|---|---|---|
| Vercel Inc. | Website hosting and cookieless analytics | United States; EU edge regions | SCCs + DPF |
| Google LLC | Google Workspace for email and document storage | Global Google infrastructure including EU regions; corporate entity in the United States | SCCs + DPF |
| Resend, Inc. | Transactional email delivery | United States | SCCs + DPF |
| Railway, Inc. | Managed Postgres database for attestations and product records | EU region (eu-west); corporate entity in the United States | SCCs + DPF |
| Shopify International Limited / Shopify Inc. | Hosts the rosegold embedded app and checkout extension; stores attestations as customer metafields on the merchant's behalf | Ireland / Canada | EEA / UK adequacy decision (Canada commercial) |
| Participating merchants (independent controllers, not sub-processors) | Receive attestations under your consent and use them to offer tier-based discounts | Varies by merchant | Each merchant is responsible for its own compliance and discloses its own privacy practices |
We do not sell personal data, and we do not share it with advertising networks or data brokers.
Personal data is processed primarily within the UK and the EEA. Several of the sub-processors listed above are headquartered in the United States; transfers to them are covered by Standard Contractual Clauses and, where the processor is certified under the EU–US Data Privacy Framework, by that framework. We do not transfer personal data to other jurisdictions.
| Data | Retention |
|---|---|
| Waitlist email | Until you unsubscribe, or until we delete the waitlist after launch |
| Server logs | 30 days |
| Raw Booking.com portability dataset | Discarded after attestation computation; not persisted to durable storage |
| Attestations | 12 months from the verification, then automatically deleted |
| Support correspondence | 24 months |
| Records required for legal, tax or accounting compliance | As required by applicable law |
Under UK GDPR and EU GDPR you have the right to:
To exercise any of these rights, email support@rosegold.app. We will respond within 30 days. If we cannot identify you from the contact details we hold, we may ask for additional information to verify the request.
You can also complain to a supervisory authority directly:
We use industry-standard technical and organisational measures: TLS in transit, encryption at rest for the attestation database, least-privilege access controls, isolated processing for portability ingestion, and audit logging. The raw portability dataset never leaves our processing environment in stored form — it is held only in memory long enough to compute attestations, then discarded.
The rosegold platform is not intended for, and is not made available to, anyone under 18. We do not knowingly collect data from minors. If you believe we have processed data relating to someone under 18, contact support@rosegold.app and we will delete it.
We are not required to designate a Data Protection Officer under Art. 37 GDPR. The point of contact for data protection enquiries is support@rosegold.app.
When we change this notice we update the "Last updated" date above. Material changes are notified by email to verified users and to waitlist subscribers.
Rosegold Technologies Limited
support@rosegold.app