RootBounty is not a registered company yet. For now it is a website run by its founder as an individual. When the company is incorporated, this document will be updated with its legal name, tax ID and registered office, and you will be asked to accept the new version. Until then, the rights and obligations described here are those of the person who runs RootBounty.
This policy explains what personal data RootBounty processes, why, on what legal basis, who receives it, how long it is kept and how you can exercise your rights. It follows Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).
1. Who is responsible
- Owner: Pau Valls Peleteiro
- Legal form: an individual; RootBounty is not a registered company yet
- Contact: pauvalls@rootbounty.com
RootBounty has not appointed a Data Protection Officer, as it is not required to. Write to pauvalls@rootbounty.com for anything about your data.
2. What we process, why and on what basis
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Email address, username, password (stored only as a hash), two-factor secret and recovery codes (encrypted) | Create your account, sign you in and keep it secure | Contract (6.1.b) |
| Profile: display name, bio, links, picture, country if you add it | Show your public profile (you can make it private) | Contract (6.1.b) |
| Company details: legal name, website, country, contact person | Verify the company and publish its programs | Contract (6.1.b) |
| Reports, comments, attachments and messages | Deliver them to the company running the program and to the RootBounty team | Contract (6.1.b) |
| Your signature on the agreements: full name, the signature image or the document you upload, date, IP address and browser | Prove that you accepted the agreement, and which version | Contract (6.1.b) and legitimate interest in being able to prove it (6.1.f) |
| Payout details: PayPal email or bank account (encrypted) | Pay the bounties you are awarded | Contract (6.1.b); legal obligation for accounting and tax records (6.1.c) |
| Your bank account shared with a company, only if you allow direct payments | Let a company that owes you a bounty transfer it to you directly | Your consent (6.1.a), which you can withdraw at any time in Settings → Payouts |
| Amounts paid and the tax details the law requires | Accounting, tax obligations and, where applicable, reporting to the tax authorities | Legal obligation (6.1.c) |
| IP address, browser and time of sign-ins and requests; audit log of sensitive actions | Security: detecting abuse, limiting requests, investigating incidents | Legitimate interest in protecting the platform and its users (6.1.f) |
| Anonymous error reports, only if you accept them | Fixing bugs | Consent (6.1.a) |
| Notifications and emails we send you | Tell you about your account, reports and payments | Contract (6.1.b) |
We do not sell personal data, show advertising, use third-party analytics or make decisions about you based solely on automated processing.
3. Who receives your data
- The company behind a program receives the reports sent to that program, the username of the people who signed them and, for bounty payments, what section 4 describes.
- Other users see what you make public: your public profile, and disclosed reports when both sides agreed to publish them.
- Service providers that process data on our behalf (GDPR art. 28), under contracts that oblige them to protect it:
- OVH SAS (France): the server where the platform and its data run, in a data centre in Strasbourg (EU).
- Cloudflare, Inc. (United States): carries the traffic between you and our server (network, DDoS protection, DNS). Transfers are covered by the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.
- IONOS Cloud S.L.U. (Spain): sends the emails we send you.
- An AI assistant, only if you connect one. If you link an assistant with an API key, what it reads — your reports included — goes to the company that runs that AI model, under its own terms.
- Authorities, including the tax authorities, when the law obliges us.
4. Bounty payments
RootBounty pays bounties on behalf of the company to the payout details you give us, unless you allow direct payments. If you do, a company that owes you a bounty in euros sees your full name, IBAN and BIC, only to transfer that bounty to you; every time it sees them is recorded. The company must not use them for anything else. You can withdraw this consent at any time, which does not affect transfers already made.
5. International transfers
Your data is stored in the European Union. The only transfer outside the European Economic Area is the traffic that Cloudflare carries, covered by the safeguards in section 3.
6. How long we keep it
- Account data: while the account exists. Ask us to delete it and it is erased within 30 days, except what the law obliges us to keep.
- Reports: while the program exists, because they are part of the company's security record. If you delete your account they stay with the program without pointing to you.
- Signed agreements and their evidence: while the agreement is in force and then for six years, the period that commercial law requires for business records and that covers the time to bring claims.
- Payment and tax records: six years (Spanish Commercial Code art. 30) or longer if tax law requires it.
- Security logs: up to one year. Backups: 14 days, encrypted.
7. Your rights
You can ask for access, rectification, erasure, restriction, portability or object to a processing, and withdraw any consent at any time without affecting what was done before. Write to pauvalls@rootbounty.com from the address of your account; we answer within one month. Many of these you can do yourself in Settings.
If you think we have not handled your request properly you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).
8. Security
Connections are encrypted, two-factor authentication is mandatory, passwords are stored as hashes, payout details and backups are encrypted, staff access is limited by role and audited. If a breach puts your rights at risk we will tell you and the authority as the law requires.
9. Minors
RootBounty is not meant for people under 16. Bounties are paid only to adults, and only adults can sign the agreements.
10. Changes
We will announce relevant changes on the site before they apply. The date at the top shows the current version.