Privacy policy

1Who is responsible for your data

The controller is HYGEA CONSULT SRL, Rue des Beaux Prés 136, 1370 Jodoigne (Belgium), Crossroads Bank for Enterprises (CBE) no. 0772.910.351 (“we”), which publishes Rosko. For any question about your data or to exercise your rights: contact@hygea-consult.be.

This policy applies to the rosko.ai website, its subdomains and the installable app. Capitalised terms have the meaning given to them in the Terms of Use.

2The data we process

What you provide to us

• Account: name, email address, password (stored hashed, never in plain text), interface and response languages, revision and reminder preferences; if you enable them, two-factor authentication secret (encrypted) and passkeys (public key only).
• Study content: uploaded documents and their extracted text, concepts, questions, answers, exams, notes and their versions, study sheets, assignments, presentations, sources and bibliographies, conversations with the assistant.
• Interactions with other students: Class Groups joined and role, posts, comments, reactions, messages, documents, shared courses, events and attendance, votes; contacts, invitations, private messages and shared notes; blocked people.
• Reports: what you report, the reason, and where applicable the excerpt of the message or response concerned.
• Integrations: if you connect Zotero, your API key (encrypted) and the references exchanged.
• Support: the content of your exchanges with us.

What is generated by your use

• Generated Content produced by the Service for you.
• Usage log: the actions carried out in Rosko (for example “question answered”, “exam generated”), with their date and the course concerned, and the cost of each action in Credits and in AI.
• Credits and subscription: balance, top-ups, plan subscribed to, payment history and invoices.

Technical data

• IP address and browser (user agent) of your sessions and of your last login, login and activity dates.
• Server technical logs (requests, errors), necessary for security and troubleshooting.
• Cookieless audience measurement (article 10).

What we receive from third parties

From Stripe: the status of your payments and your subscription, and your customer ID. We never receive your card number.

Sensitive data

We do not ask you for any sensitive data (health, opinions, origin, etc.). If your documents or messages contain any, for example a clinical case in a nursing course, it is processed as your content, solely to provide you with the Service. Avoid leaving in them any data that could identify a patient or another person.

3Why we process it, and on what basis

We do not sell your data, do not use it for advertising purposes and do not take any decision producing legal effects concerning you based solely on automated processing. AI corrections and assessments are educational guidance for you, not decisions.

4Artificial intelligence and your content

To produce Generated Content, we send the provider of the relevant AI Model what is necessary for the task: excerpts from your documents, your answers, your instructions, and useful context (for example the desired language). We do not add your email address or your account data; only what appears in your content itself (for example your name on the cover page of an assignment) may be included.

• We use these providers through their business offerings (API), whose terms prohibit them from using your content to train their models.
• They may temporarily retain requests, for a limited period set out in their terms, in particular to detect abuse.
• We do not use your content to train AI models.

Depending on the feature, we use Anthropic (main model), Google (Gemini, in particular to identify figures in your documents) and OpenAI (in particular for the audio version of study sheets). The choice of model for each feature may change; the up-to-date list is set out in article 5.

5Who we share your data with

The people you choose to share with

Your name and what you post in a Class Group are visible to its active members; what you pass on to later class groups of a programme remains visible to them. Your private messages and the notes you share are visible only to their recipients.

Our processors

They act on our instructions, under a data processing agreement (GDPR, Art. 28).

The writing workshop’s document editor (ONLYOFFICE) and the audience measurement tool (Umami) are installed on our own servers: your data is not transmitted to their publishers.

Third-party services you call on

• Bibliographic search: your keywords and DOIs are sent from our servers, without any information about you, to OpenAlex, Crossref and Europe PMC.
• Zotero: only if you connect your library; exchanges take place with your key and under your control, in accordance with Zotero’s privacy policy.
• Resources loaded by your browser: some pages load fonts (Google Fonts) or display libraries (jsDelivr, unpkg) from third-party servers, which then receive your IP address and your browser’s technical information.

Other cases

We disclose data where the law requires us to (a request from an authority or a court, within the limits of the request), to protect the rights, safety or property of our users, of third parties or of ourselves, or if the Service is taken over by another company, which would be bound by this policy; you would be informed in advance.

6Transfers outside the European Union

Some providers are based in the United States or may process data there. These transfers are based on an adequacy decision of the European Commission (in particular the EU–US Data Privacy Framework for certified companies) or, failing that, on the standard contractual clauses adopted by the Commission, supplemented where necessary by technical measures (encryption in transit and at rest). You can obtain a copy of these safeguards by writing to us.

7How long we keep it

8Your rights

In accordance with Articles 15 to 22 of the GDPR, you can:

• access your data and take it with you: full export in JSON format from Account settings → Data and account → GDPR export;
• rectify it: Account settings → Profile;
• erase it: deletion of content item by item, or of the entire account from Data and account (step-by-step instructions);
• object to processing based on our legitimate interest, in particular the usage log for improvement purposes and audience measurement, and request the restriction of processing;
• turn off reminders at any time: Account settings → Reminders;
• withdraw your consent to news and offers emails, as easily as you gave it: link in each of those emails, or Account settings → Reminders.

For any other right, write to contact@hygea-consult.be. We respond within one month, which may be extended by two months for a complex request; we may ask you to confirm your identity.

You can also lodge a complaint with the Data Protection Authority (Rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be) or with the authority of your country of residence.

9Minors

Rosko is reserved for persons aged 16 or over. We do not knowingly collect data from younger persons. If you believe that an account has been created by a person under 16, write to us: we will delete it.

10Cookies and audience measurement

Rosko only uses the cookies and local storage necessary for it to function or for the preferences you choose. To find out which pages are viewed, we use Umami, installed on our servers: it sets no cookies, does not retain your IP address and only produces non-identifying statistics (pages viewed, referrer, device type, country). There are no advertising trackers. Details are set out in the Cookie Policy.

11Security

Encrypted connections (HTTPS), hashed passwords, encrypted two-factor authentication secrets and integration keys, access to servers restricted to authorised persons bound by confidentiality, regular backups, verification of the signature of payment notifications. Our teams only access your content when necessary: support at your request, handling a report, security or a legal obligation. In the event of a data breach presenting a high risk to you, we will inform you without undue delay.

12Changes to this policy

We update this policy when our processing, our providers or the law change. The current version is always published at rosko.ai/confidentialite, with its number and date.

For any significant change (new purpose, new category of data, new recipient of a different nature, change in retention period to your detriment), we notify you by email and in the Service before it applies, summarising what is changing. If a change requires your consent, we will ask you for it. We never use data already collected for a purpose incompatible with the one announced when it was collected.

13Contact