Privacy Notice. How we protect your information.

• We collect only what we need to provide and improve our services, keep them secure and meet our legal duties.
• ROS, our browser, needs no account and sends no telemetry. Your history, tabs and bookmarks are encrypted on your device and never sent to us.
• We never sell your personal information, and we do not use it for advertising.
• Some agent work happens on your device. When a task needs a cloud AI model, we send only the content that task needs.
• Important actions wait for your approval, and every agent step is recorded in an activity trail you can review.
• Voice AI listens only when you choose to speak to your agents. We keep what you said as text, not as a recording, and we never use your voice to identify you.
• When an agent makes or answers a call for you, it says it is an AI speaking on your behalf. Call transcripts are temporary, and a call is recorded only if you ask for it.
• Our website uses no cookies and no analytics. It only remembers your light or dark theme choice, in your own browser.
• You can ask to access, correct, export or delete your information at any time by writing to privacy@rosanne.ai.

Rosanne AI (“Rosanne”, “we”, “us”) is a company established in the Republic of Ghana. We build ROS, an agentic web browser, and the Rosanne Agentic OS, an agentic operating system in which AI agents work alongside people. For the purposes of Ghana’s Data Protection Act, 2012 (Act 843), the EU and UK General Data Protection Regulation (GDPR) and similar laws, Rosanne is the data controller of the personal information described in this notice, except where section 7 says otherwise.

This notice applies to rosanne.ai and its pages, to the ROS and Agentic OS apps on every platform where they are offered, and to our emails, waitlists, events and support (together, the “Services”).

It does not apply to third-party websites that you visit in ROS or that an agent visits for you, or to third-party apps and services you connect. Those are governed by their own privacy notices, and we encourage you to read them.

Information you give us

• Account details. For the Agentic OS: your name, email address and sign-in credentials when you create an account, and any profile details you choose to add. ROS needs no account.
• Workspace details. In the Agentic OS, the workspace or team you create or join, its members, and the roles and permissions you set for people and agents.
• Communications. What you send when you email us, join a waitlist, register for an event, ask for support or give feedback.

Information created when you use the apps

• Instructions and tasks. What you ask an agent to do, the plans agents make, and the results they return. Agents are coming to ROS; until then, this applies to the Agentic OS.
• Voice. When you speak to your agents with Voice AI in the Agentic OS, the audio of what you say and the text transcribed from it.
• Calls. When an agent makes or answers a call for you: the phone numbers involved, the time and length of the call, a temporary transcript of what was said, the summary the agent gives you, and a recording only if you ask for one.
• Content an agent works with. The pages, tabs, text and files that an agent reads, compares or summarises in order to complete a task you gave it.
• Activity and approvals. The activity trail of each task: the steps taken, the steps that waited for you, and whether you approved or skipped them.
• Shared knowledge. In the Agentic OS, the notes, playbooks and other knowledge your team chooses to keep, so expertise stays with the team.

Information collected automatically

• Device and app information. Device type, operating system and version, app version, language and time zone.
• Diagnostics. Crash reports, error logs and performance data that help us find and fix problems.
• Usage information. Which features are used and how often, so we can understand what works and what needs improving.
• Network information. IP address and the approximate location it implies, used for security, fraud prevention and to route requests.

Information from others

• App stores. Apple and other app stores may tell us about downloads and, where it applies, subscriptions. They do not share your payment card details with us.
• Your team. A teammate or workspace administrator may invite you by email or add you to a workspace in the Agentic OS.
• People on calls. When an agent speaks with someone for you, we process what that person says, and their phone number, to carry out the call and report back to you. If you spoke with an agent and have a question about your information, write to us at the address in section 17.

We do not ask for sensitive personal information, such as health, religious or biometric data, and we do not create voiceprints or use your voice to identify you, and we ask you not to give it to agents unless a task truly needs it. If a task you set involves such information, we process it only to carry out that task for you.

ROS and the Agentic OS are designed so that you stay in control of what agents see and do.

• ROS, the browser. ROS needs no account and sends us no telemetry, and we do not see what you browse. History, open tabs, bookmarks and site settings are sealed with AES-256 on your device, with a key kept in its Keychain. What leaves your device: the pages you open and their icons; ROS checking for updates, from GitHub and rosanne.ai; the Extension Store catalog, which ROS downloads whole and searches on your device; and, if you use it, the password leak check, which sends only the first five characters of a password’s fingerprint to Have I Been Pwned. Passwords sync through iCloud Keychain, encrypted end to end by Apple, if you have it on. When agents arrive in ROS, we will update this notice before they do.
• On your device. Some processing happens locally on your Mac or iPhone, and that information stays there unless a feature needs to send it.
• In the cloud. When a task needs a cloud AI model, we send the content required for that task, such as your instruction and the relevant parts of a page, to our servers and to the AI model provider that processes it. We send only what the task needs.
• Voice. The Agentic OS uses your microphone only after you give permission, and only while you are speaking to your agents. Audio is turned into text on your device or by a speech recognition provider, and the text then works like any typed request. We keep the audio only for as long as it takes to transcribe it.
• Calls. Calls go through your own phone number. At the start of every call, the agent says that it is an AI speaking on your behalf. A transcript is made during the call so the agent can follow it and write your summary. It is temporary and is deleted once it has served that purpose. A recording is made and kept only if you ask for one.
• Your approval. Before an agent submits a form, sends a message or takes another important action, it asks you first. You can approve the step or skip it.
• Your record. Every step appears in the activity trail, so you can see what happened, when, and why.

Please avoid giving agents passwords, payment details or other secrets unless a task requires them, and review what an agent is about to do before you approve it.

We use personal information for these purposes, and only where we have a lawful basis to do so:

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (see section 11).

We do not use the content of your tasks, the pages agents read for you, or your shared knowledge to train AI models without your permission. If we ever offer a way to help improve our models, it will be optional, explained clearly, and off unless you turn it on.

AI model providers that process tasks for us act on our instructions and may use the content only to provide their service to us, as described in section 7.

AI output can be wrong or incomplete. Our Terms of Service explain how to use it responsibly.

We never sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only as follows:

• Service providers (processors). Companies that host our systems, provide AI models and speech recognition, deliver email, handle support and report crashes. They may process personal information only on our instructions and under written contracts that require them to protect it.
• Your workspace. In the Agentic OS, people in your workspace can see what you share there, according to the roles and permissions set by you or your administrator. If your workspace is managed by an organisation, that organisation may control your account and access its content, and its own privacy notice applies to that use.
• Websites, services and people you direct us to. When you ask an agent to act on a website or service, for example to fill in a form, the information needed for that action is sent to that website or service. When an agent calls someone for you, it shares with them what the call needs. What they do with the information is governed by their own terms and privacy notice.
• Phone carriers. Calls are connected through your own number and the telephone networks that carry them.
• Legal and safety reasons. When the law requires it, or when we believe in good faith that disclosure is needed to protect someone’s safety, prevent fraud or abuse, or defend our legal rights.
• Business changes. If Rosanne is involved in a merger, acquisition, financing or sale of assets, information may pass to the new owner, who must keep honouring this notice or tell you about any change.
• With your consent. In any other case, only when you ask us to or agree to it.

We are based in Ghana, and our service providers, including cloud and AI model providers, may process information in other countries. When information leaves the country where you are, we take steps to protect it as the law requires, for example by using contracts that include the European Commission’s standard contractual clauses or the UK’s equivalent, and by choosing providers with appropriate safeguards.

You can ask us for more information about these safeguards at any time.

We keep personal information only for as long as we need it for the purposes in this notice:

• Account information is kept while your account is open, and deleted or anonymised after you close it, unless we must keep it longer.
• Tasks, activity trails and shared knowledge are kept while you or your workspace keep them, and deleted when you delete them or close the account.
• Voice audio is deleted once it has been turned into text. The text is kept with the task it belongs to.
• Calls. Transcripts are temporary and are deleted once the agent has used them to follow the call and write your summary. Summaries are kept with the task they belong to. Recordings exist only when you ask for them, and are kept until you delete them or close the account.
• Diagnostics and security logs are kept for a limited period, long enough to fix problems and investigate incidents.
• Communications are kept for as long as needed to deal with your request and any follow-up.

We may keep some information longer where the law requires it, to resolve disputes or to enforce our agreements. When we no longer need information, we delete it or make it anonymous.

We use technical and organisational measures designed to protect personal information from loss, misuse and unauthorised access, disclosure or change. They include encryption of data in transit, access controls based on need, and regular review of our systems and suppliers.

No service can be completely secure. If a breach affects your personal information, we will tell you and the relevant authorities where the law requires it. You can help by using a strong, unique password and keeping your devices up to date.

If you think you have found a security issue, please write to hello@rosanne.ai. Our security contact is also published at /.well-known/security.txt.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and get a copy of it.
• Correct information that is inaccurate or incomplete.
• Delete your information, or close your account.
• Export information you gave us in a portable format.
• Object to or restrict how we use your information, including for direct marketing.
• Withdraw consent at any time, where we rely on it. This does not affect earlier processing.
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you.
• Complain to a data protection authority (see section 17).

To use any of these rights, write to privacy@rosanne.ai from the email address on your account. We may need to confirm your identity before we act. We answer within the time the law allows, normally within one month, and we do not charge for reasonable requests. You can unsubscribe from news emails at any time using the link in each email.

We will not treat you differently for exercising your rights.

Agents plan and carry out the tasks you give them, and key steps wait for your approval. Rosanne does not make decisions about you that have legal or similarly significant effects based solely on automated processing.

The Services are not meant for children under 13, and we do not knowingly collect personal information from them. Users aged 13 to 17 may use the Services only with the permission of a parent or guardian, and where local law sets a higher age of consent, with the consent that law requires.

If you believe a child under 13 has given us personal information, please write to privacy@rosanne.ai and we will delete it.

Our website does not use cookies, analytics or advertising trackers. It stores a single preference, your choice of light or dark theme, in your browser’s local storage, and that preference never leaves your device. The server that hosts the website keeps standard access logs, such as IP address, time and browser type, for security and to keep the site running.

The apps store information on your device, such as your settings and session, so they work as you expect.

Because we do not sell or share personal information for advertising, there is nothing to opt out of. We honour Global Privacy Control and similar browser signals all the same.

Ghana

We process personal information in line with the Data Protection Act, 2012 (Act 843) and its principles: accountability, lawful processing, specific purpose, compatible further processing, quality of information, openness, security safeguards and data subject participation. You can contact the Data Protection Commission of Ghana with any concern.

European Economic Area, United Kingdom and Switzerland

Section 5 sets out the lawful bases we rely on under the GDPR. You have the rights in section 11 and may complain to the supervisory authority where you live or work. Where the law requires us to appoint a representative in the EU or the UK, we will publish their details here.

United States

If you live in California or another US state with a consumer privacy law, you have the rights in section 11, including the right to know, delete and correct, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information to infer characteristics about you. In the last 12 months we have collected the categories described in section 3 (identifiers, internet or other electronic activity, approximate geolocation derived from IP address, audio information when you use Voice AI, and the content you provide), for the purposes in section 5. You may use an authorised agent to make a request, and we may ask them for proof of authority.

We may update this notice as our products, the law or our practices change. We will change the date at the top when we do. If a change is significant, we will tell you in advance, by email or in the apps, before it takes effect.

For any question about this notice or your personal information, write to privacy@rosanne.ai. For anything else, write to hello@rosanne.ai.

If you are not satisfied with our answer, you can complain to the Data Protection Commission of Ghana or to the data protection authority where you live. We would appreciate the chance to put things right first.