Who operates Rosfish
Rosfish is operated by Rosfish Inc. For privacy questions, contact support@rosfish.com.
Information we collect
Public marketing pages use Cloudflare Web Analytics for page-load and performance measurements. Rosfish prevents that automatic analytics script from being injected into account and client request pages.
When a business creates an account, Rosfish stores its email address, sign-in token hashes, business name, settings, and session records. Business owners add client names, email addresses, request descriptions, and item instructions. Clients provide answers and uploaded files through request links.
Rosfish also records basic product events, such as account creation, request creation, item completion, and subscription changes. Rate limiting uses hashed identifiers derived from connection and account information. We do not add advertising trackers to request pages.
How information is used
We use this information to operate accounts, organize client requests, store responses and files, display completion, send requested invitations and service notifications, manage subscriptions, and protect the service against misuse. Uploaded files are stored to complete and review the requesting business’s work.
Who can access a request
The business owner can access its workspace. A client request link also grants access to that request without a login. Anyone who receives or obtains the link may view and update it. The business is responsible for sharing the link appropriately and choosing suitable content for this workflow.
Service providers
Rosfish uses Cloudflare to host application services, database records, and uploaded files. Stripe processes subscriptions and payment information; Rosfish stores subscription identifiers and status, not full card numbers. Resend delivers transactional emails when configured. These providers process information needed for their respective services under their own applicable terms and policies.
Retention and deletion
The platform administrator can review account, subscription, usage, and email-delivery metadata to provide support and operate the service. Administrative changes and their stated reasons are logged. Minimal administrative audit records remain after workspace deletion; client responses and uploaded file contents are not included in that log.
Account records, requests, and files remain available until the owner deletes them or the account is closed. Deleting a request removes its responses and associated active files. Deleting an account removes its workspace data. Transactional email delivery records and billing records held independently by providers may remain subject to their retention practices and legal obligations.
Expired application sessions, password reset tokens, and rate-limit records are removed by scheduled maintenance. If you submitted information as a client, contact the business that requested it about review, correction, or deletion. The business determines the purpose of collecting that information.
Cookies and security
Rosfish uses an essential session cookie to keep account owners signed in. Public request pages do not require an account cookie. The application checks authorization on private resources, uses unpredictable client links, and validates upload formats and size limits. No system can guarantee that information will never be lost or accessed improperly.
Your choices
You can update your business settings, replace responses where supported, delete requests, or delete your account. Contact the operator about account information you cannot change directly or privacy rights applicable to your circumstances. Rosfish does not sell personal information or use it for targeted advertising.
Changes to this policy
The policy may change as the service changes. The date above identifies the current version. Material changes affecting existing accounts will be communicated through an appropriate service channel.