Privacy policy.

How Boring Software Ltd collects, uses and protects your personal data and the data you process through Rowstorm.

Last updated: 14 October 2026

1. Information we collect

Boring Software Ltd, company number 16328193 ("we", "us", "Rowstorm"), collects information in two main categories.

1.1 Account information

Your name, email address, company name and billing details, which you provide when you request access, sign a contract, sign in or correspond with our team.

1.2 Platform data

The contact and lead records, campaign configurations, routing rules, email templates and campaigns, validation results and analytics that you create or process through the Rowstorm platform.

1.3 Technical data

Limited technical data such as IP addresses, browser type and access timestamps when you sign in to the app or call our API.

2. How we use your information

We use account information to provide and maintain your account, respond to support requests, send service-critical communications (such as maintenance notices and security alerts) and process billing.

Platform data is used solely to operate the features you have chosen to use, including record import, phone validation, routing, email campaigns, reporting and, where your organisation switches them on, AI features.

We do not sell, rent or trade your personal data or your platform data to any third party.

Aggregated, fully anonymised usage statistics (for example, total API call volumes across the platform) may be used internally to plan infrastructure capacity.

3. Data storage and infrastructure

Rowstorm runs on shared, managed infrastructure. Your data is logically separated from every other customer's: every request and query is scoped to your account, and no other customer can access your data. Customers on Enterprise plans can request dedicated infrastructure.

All data is stored in data centres in London, United Kingdom, operated by established cloud providers. Data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher.

We do not transfer personal data outside the UK or EEA unless required to do so under a lawful transfer mechanism (such as UK International Data Transfer Agreements), and we will inform you before any such transfer takes place.

4. Data retention

We retain your platform data for the duration of your service agreement. When your contract ends, we keep your account data available for thirty (30) days so that you can export your records, campaign history and reporting data via the API or CSV download from the app.

After this export window, all of your account data, including backups, is securely destroyed within sixty (60) days.

Account information (name, email, billing records) may be retained for up to six (6) years after termination to comply with UK financial record-keeping obligations, after which it is also deleted.

Addresses on your organisation's never-email list (people who unsubscribed, bounced or marked an email as spam) are kept in a scrambled (hashed) form for as long as your account exists, so that they are never emailed again.

5. Third-party services

We work with a small number of third-party processors:

• our cloud hosting providers, which run our servers and databases in London;
• an HLR provider, which checks phone numbers when you switch on phone checks, and receives only the number being checked;
• an email delivery provider, which sends the emails you create in Rowstorm, and receives the recipient's address and the email's content;
• an AI provider, used only when your organisation switches on AI features (such as editing an email with AI or the assistant), which receives the content needed to answer each request;
• Google, if you choose to sign in with your Google account;
• Apple Push Notification service, which delivers alerts to the iOS app;
• a payment provider for billing.

Each processor is bound by a Data Processing Agreement and has been assessed for compliance with UK GDPR requirements. We only share the minimum data necessary for each provider to deliver its service. Records you route to your own endpoints or partners are delivered on your instructions.

6. Your rights

Under the UK GDPR and the Data Protection Act 2018, you have the right to access, rectify, erase, restrict processing of and port your personal data. You also have the right to object to processing based on legitimate interests and the right to withdraw consent where consent is the legal basis.

To exercise any of these rights, email privacy@rowstorm.com. We aim to respond to all data rights requests within thirty (30) days.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

7. Cookies and tracking

The Rowstorm website (rowstorm.com) does not set cookies and does not use analytics. It loads fonts from Google Fonts, which receives your IP address to deliver them.

The Rowstorm app keeps you signed in and remembers your display preferences using your browser's local storage. We do not use any third-party advertising or remarketing cookies anywhere on our sites.

8. Security

8.1 Encryption

Data at rest is encrypted with AES-256. Data in transit is protected by TLS 1.2 or higher.

8.2 Separation between customers

Each customer's data is logically separated: every request and query is scoped to that customer's account and checked against its access controls, so no other customer can access your data. Dedicated infrastructure is available on Enterprise plans.

8.3 Access controls and testing

Access to production systems is limited to authorised personnel via multi-factor authentication and audited access controls. We test our systems for vulnerabilities and treat critical findings as a priority. Sign-in to Rowstorm supports two-factor authentication, and every change to your setup is recorded in an audit log.

9. Mobile application

The Rowstorm iOS application collects and processes the following additional data specific to mobile use.

9.1 Biometric authentication (Face ID / Touch ID)

If you enable biometric lock, the app uses Apple's Local Authentication framework to verify your identity. Rowstorm never receives, stores or transmits your biometric data. The biometric check runs entirely on your device using Apple's Secure Enclave. We only store a preference indicating whether you have enabled biometric lock.

9.2 Push notifications

If you grant notification permission, Apple assigns a device token that allows us to send alerts about activity, caps and other events you have configured. This device token is stored on our servers and associated with your user account. You can revoke notification permission at any time in your device's Settings app, and we will stop sending push notifications. Device tokens are deleted when you log out or delete your account.

9.3 On-device storage and Keychain

The app stores your sign-in token in the iOS Keychain, which is protected by the operating system's hardware-backed encryption and scoped to the Rowstorm app, so other applications cannot access it. All locally stored data is deleted when you log out.

10. Account deletion

You can ask your organisation's admin to remove your account at any time, or email privacy@rowstorm.com. When an account is deleted, we immediately and permanently delete your user record, all active sessions and your device tokens. Locally stored data on your device (your sign-in token and cached profile data) is also cleared.

If you are the sole administrator of an organisation, please contact us before deleting your account so that we can help with data export or ownership transfer. Data associated with your organisation is retained in accordance with your service agreement and section 4 (Data retention) of this policy.

11. Data Protection Officer

Boring Software Ltd has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this policy and applicable data protection legislation.

You can contact the DPO at dpo@rowstorm.com or by writing to: Data Protection Officer, Boring Software Ltd, 128 City Road, London, EC1V 2NX, United Kingdom.

12. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements or platform capabilities. Where we make material changes, we will notify the primary account contact by email at least thirty (30) days before the revised policy takes effect and will display a notice in the app.

The "Last updated" date at the top of this page shows when the policy was most recently revised. Previous versions are available on request.

13. Governing law

This Privacy Policy, and any dispute or claim arising out of or in connection with it, shall be governed by and construed in accordance with the laws of England and Wales.

14. Contact

For any privacy questions, data rights requests or concerns about how we handle your information, email privacy@rowstorm.com.