This notice applies only to the Rouxbarb closed beta signup process at rouxbarb.com. It is separate from the Rouxbarb main Privacy Policy, which covers the live app and applies once you become a registered user. If you have questions about either notice, contact us at privacy@rouxbarb.com.
1. Who we are
The data controller for the beta signup process is:
Rouxbarb ApS
Njalsgade 21F, 2300 København S, Denmark
CVR no. 46028244
Email:
privacy@rouxbarb.com
Website: rouxbarb.com
Rouxbarb ApS is registered in Denmark and subject to the EU General Data Protection Regulation (GDPR). Our lead supervisory authority is Datatilsynet, the Danish Data Protection Agency (datatilsynet.dk). Our internal privacy contact is Kathryn Partridge (privacy@rouxbarb.com).
2. What data we collect
When you apply to join the closed beta, we collect the following data about you:
Information you give us directly:
- Email address — used to contact you and issue your TestFlight invitation.
- Device model (e.g. "iPhone 15 Pro") — used to ensure we invite testers whose hardware is compatible with the build we are testing.
- Application answer — a short free-text response (1–2 sentences) explaining why you want to take part. We use this to assess whether you are a good fit for the beta cohort.
Information collected automatically when you submit the form:
- IP address — used for rate-limiting, geographic scoping, and detecting abusive or automated submissions. Not used for marketing or profiling.
- Browser user-agent string — the technical identifier your browser sends (e.g. "Safari 17 on iOS 17.4"). Used to detect bots and automated form submissions.
- Signup source / referral — the URL parameters present when you arrived at the form (e.g. UTM tags from a newsletter link). Used to understand which channels are driving applications.
- Submission timestamp and email verification timestamp — recorded to establish the sequence of your application and to enforce the 30-day verification window.
We do not collect your name, phone number, address, payment information, social media profiles, or any health, biometric, or other special category data at the beta signup stage.
3. Why we collect it and our lawful basis
We process your data for the following purposes, each resting on the lawful basis of your consent under GDPR Article 6(1)(a):
- Running a closed beta: processing your application, verifying your email, placing you in our review queue, and managing the overall beta programme.
- Contacting selected applicants: sending you a verification email, a status update, and — if approved — forwarding your email address to Apple to issue a TestFlight invitation.
- Vetting for bots and abuse: using your IP address, browser user-agent, and submission patterns to identify and reject automated or duplicate submissions so that real applicants are not displaced.
Consent is the appropriate basis because you are applying voluntarily to a programme that is not yet a live service, and there is no contract between us at the point of application. You may withdraw your consent at any time — see Section 7.
We do not use your application data for any purpose other than those described above. We do not use it to train machine-learning models, for advertising, or for any third-party marketing.
4. How long we keep your data
We retain your data for the shortest period necessary, as follows:
- Unverified applications (email not confirmed within 30 days): deleted 30 days after submission.
- Rejected applications: deleted 90 days after the decision is recorded, giving us a window to respond to any queries about the outcome.
- Approved and invited testers: retained for the duration of the closed beta plus 12 months after the beta closes. At that point your data is either deleted or, if you have converted to a full Rouxbarb account, transferred into our standard user retention schedule (described in our main Privacy Policy).
- Revoked or inactive testers (access removed during the beta): personal data deleted 90 days after revocation.
When we delete your data, we delete it from our primary database, and it is purged from automated backups within the standard backup cycle (up to 7 days for GCP Cloud SQL). Admin notes linked to your application are deleted at the same time as your main record.
5. Who we share your data with
We do not sell your data. We share it only with the following parties, each acting as a data processor on our behalf under a Data Processing Agreement:
- Apple Inc. (TestFlight / App Store Connect): if your application is approved, we send your email address to Apple via the App Store Connect API to issue your TestFlight invitation. Apple then sends the invitation email directly. Apple's transfer of data to the United States is covered by Apple's standard contractual clauses. Apple's privacy policy is available at apple.com/legal/privacy.
- Google Cloud Platform (GCP) — Cloud SQL: our PostgreSQL database, where application records are stored, runs on GCP infrastructure. Data will be hosted in the US and EU depending on region configuration. Transfers are covered by Google's standard contractual clauses (SCCs) under Commission Implementing Decision (EU) 2021/914.
- Firebase (Google): used for hosting the signup form backend and for authentication infrastructure. Covered by the same Google SCCs as GCP.
- Resend: our transactional email provider, which delivers the email verification link and any status notifications to you. A Data Processing Agreement is in place with Resend. Data is transferred to the US under SCCs.
- Google reCAPTCHA Enterprise: our bot-protection service, which runs invisibly in the background when you submit the form. reCAPTCHA analyses anonymised signals from your browser (including IP address and interaction patterns) to assess whether the submission is human. This data is sent to Google and processed under Google's reCAPTCHA terms and privacy policy.
All processors are contractually prohibited from using your data for their own purposes or for advertising.
No other third parties receive your application data. Internal access is limited to Rouxbarb engineering and operations staff with admin-portal access, and all admin actions are audit-logged.
6. International data transfers
Rouxbarb ApS is based in Denmark (EU). Some of our processors — Apple, Google (GCP, Firebase, reCAPTCHA Enterprise), and Resend — are headquartered in the United States. All transfers to these processors are made under Standard Contractual Clauses (SCCs) approved by the European Commission, which provide appropriate safeguards for your data. You may request a copy of the applicable SCCs by contacting privacy@rouxbarb.com.
7. Your rights
Under the GDPR, you have the following rights in relation to the data we hold about you through the beta signup process:
- Access: request a copy of the personal data we hold about your application.
- Rectification: ask us to correct inaccurate data — for example, if your email address was submitted incorrectly.
- Erasure: ask us to delete your application and all associated personal data. We will process this within 30 days. If you have been invited to TestFlight, we will also remove you via Apple's API.
- Portability: receive the data you provided to us (your email, device model, and application answer) in a structured, machine-readable format (JSON or CSV).
- Withdraw consent: you can withdraw your consent to the beta signup processing at any time, without affecting the lawfulness of any processing carried out before withdrawal. Withdrawing consent means we will delete your application data and, if applicable, your TestFlight access.
- Restriction: ask us to pause processing of your data while a dispute or query is being resolved.
To exercise any of these rights, email privacy@rouxbarb.com. We will respond within 30 days. We may ask you to verify your identity before acting on a request.
If you are not satisfied with our response, you have the right to lodge a complaint with Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk or by post at Carl Jacobsens Vej 35, 2500 Valby, Denmark.
8. Cookies and the signup form
The beta signup form at rouxbarb.com uses only strictly necessary cookies — those required to operate the form securely (session state and CSRF protection). We do not use analytics or advertising cookies on the form page. Google reCAPTCHA Enterprise may set its own cookies as part of bot-detection; these are third-party cookies governed by Google's cookie policy.
For full details of cookies used on rouxbarb.com, see our Cookie Policy.
9. TestFlight terms
If your application is approved and you accept the TestFlight invitation, your use of the TestFlight platform is governed by Apple's TestFlight terms and conditions, which Apple presents to you at the point of redeeming the invitation. Those terms are separate from and in addition to our Beta Participation Terms.
10. Changes to this notice
If we make material changes to how we process beta applicant data, we will update this notice and change the "Last updated" date above. Where feasible, we will email you to notify you of significant changes. The version of this notice that was in effect at the time you submitted your application is the version that governed the collection of your data; any new version applies only to data collected after its effective date.
11. Contact
For any questions about this notice or your data:
Rouxbarb ApS
privacy@rouxbarb.com ·
rouxbarb.com
Njalsgade 21F, 2300 København S, Denmark
CVR: 46028244