Company details have been checked and approved. The production service’s data handling and legal terms still need review. This page is not the final published policy.
Who is responsible
rootscan is a product of Shiprocket Limited, registered in India under CIN U72900DL2011PLC225614. Its registered office is Plot No. B, Khasra No. 360, M.G. Road, Sultanpur, Gadaipur, Mehrauli, South Delhi 110030, India.
For personal data it determines how and why to process, Shiprocket Limited is the data controller where the EU or UK GDPR applies, and the data fiduciary under India’s Digital Personal Data Protection Act, 2023, to the extent its relevant provisions have commenced and apply. The law that applies depends on the processing and the people involved.
When testing a customer’s application on that customer’s instructions, the parties’ respective roles, permitted purposes, and safeguards must be set out in the service agreement and applicable data processing terms.
What this preview does
Fonts and images are served from the website’s own files. The website remembers your theme and privacy preference in your browser. Early-access forms can save a preview request locally. The contact form can prepare a downloadable message. In the supplied preview, neither sends your details to rootscan.
Clearing preview data removes those local requests and preferences. It also withdraws optional analytics consent and removes accessible Google Analytics cookies. This does not delete an account or records held by a connected production service.
When you contact us or create an account
A production service may need your name, work email, account details, messages, and billing information to provide the service or respond to a request. The final policy must identify the actual providers, purposes, lawful bases where required, recipients, and retention periods. Optional marketing consent must be separate from signing up for the product.
When GDPR applies, processing needs an appropriate legal basis, such as steps you request before a contract, performance of a contract, a legal obligation, a properly assessed legitimate interest, or consent. This review copy does not select a blanket basis for every future use.
Security testing data
Depending on the connection, an application test can involve URLs, dedicated test credentials, source code, API definitions, and request-and-response evidence. Customer evidence may include personal data and secrets. Use test identities and synthetic records, and keep the testing scope narrow.
Before accepting that data, the service must publish its access controls, storage locations, retention and deletion rules, subprocessors, model-provider handling, and applicable cross-border transfer safeguards. Do not infer a training restriction, data residency guarantee, or fixed deletion period from this website mockup.
Access, correction, deletion, and complaints
Depending on the law that applies, you may have rights to access, correct, erase, restrict or object to processing, receive data in a portable form, or withdraw consent. Indian DPDP rights and grievance mechanisms apply as their relevant provisions take effect. Withdrawing consent does not undo processing that was lawful before withdrawal.
Where GDPR applies, you may also complain to the competent supervisory authority. Any verification needed to handle a request should be proportionate and should not ask for passwords or live application credentials.
A dedicated privacy contact and grievance process must be published in the final service policy before live collection begins.
Company correspondence can be addressed to Shiprocket Limited at its registered office above. The published company contact page provides current general contact routes. It is not presented as a dedicated rootscan privacy mailbox.
Changes to this notice
The final policy will carry an effective date and explain material changes. This review copy was prepared on 25 October 2026. It remains excluded from search indexing until the operating team approves it.