RootViel Legal

GDPR Privacy Policy

Last updated · September 20, 2026

• Controller: Stitch Labs SL (Tax ID B19887744)
• Purpose: Managing business inquiries, contractual relationships, legal compliance and service improvement.
• Legal basis: Consent of the data subject (forms), contract performance and legal obligation compliance (GDPR, LOPDGDD, DORA, NIS2).
• Recipients: No disclosure to third parties except legal obligation or service providers under a DPA (email, hosting, GRC providers). International transfers use EU standard contractual clauses where applicable.
• Rights: Access, rectification, erasure, objection, restriction, portability and decisions per LOPDGDD. Contact services@stitchlabs.es with a copy of your ID. Response time: 30 business days.
• Retention: 24 months from last contact for commercial prospects; contract duration + 5 tax years for customers.
• Security: TLS 1.3 encryption, AES-256 encryption at rest, encrypted backups, RBAC access control, Ed25519 access audit trail.
• GDPR contact: Data Protection Officer · services@stitchlabs.es

Terms and Conditions of Service

Version 2.3 · September 20, 2026

1. 1. Purpose. These Terms govern access to and use of the RootViel platform marketed by Stitch Labs SL (the "Provider").
2. 2. Acceptance. Use of the platform implies full, unreserved acceptance of the current version of these Terms, permanently available on this page.
3. 3. License to use. The Provider grants the Client a non-exclusive, non-transferable, revocable license to use the platform for the contract term, solely for its own internal business purposes.
4. 4. Client obligations. Provide truthful information, keep credentials secure, refrain from reverse engineering, respect the limits of the contracted plan, and obtain explicit grants before RV-04 (controlled pentesting) on assets it owns.
5. 5. Intellectual property. All intellectual and industrial property rights over the platform belong to the Provider. Findings generated are the exclusive property of the Client.
6. 6. SLA. Starter plan: support Mon–Fri 9–18 CET, 48h response. PRO+: P1 24×7, <24h resolution. Enterprise: dedicated CSM, quarterly QBRs and 99.9% monthly uptime SLA measured by Pingdom / StatusCake.
7. 7. Limitation of liability. The Provider is not liable for indirect damages, loss of profit or data loss arising from misuse by the Client. Maximum aggregate annual liability equals the plan's annual billing.
8. 8. Term and termination. Annual term, tacit renewal unless 60 calendar days' notice is given beforehand. Uncured material breach within 20 days authorizes immediate termination.
9. 9. Governing law and jurisdiction. Spanish law. Courts of Madrid, except where mandatory rules provide otherwise. Consumers: consumer protection rules apply directly.

Cookie Policy

GDPR + LSSI compliance · September 20, 2026

• Types of cookies used on rootviel.io:
• · Strictly necessary technical cookies: remember session preferences, light/dark theme and language selection.
• · Preference cookies: store accepted privacy consents and policies.
• · Anonymized analytics cookies: aggregated with no public IP, only with explicit consent.
• We do NOT use behavioral advertising cookies, social media pixels or third-party tracking without explicit consent.
• You can manage or withdraw consent at any time from our cookie banner or by clicking "Manage cookies" in the footer.
• Cookie identity: __rv_consent, __rv_theme, __rv_session, __rv_analytics_opt_out.

Data Processing Addendum (DPA) · GDPR Art. 28

Contractual annex · v1.4 · September 20, 2026

• Data Processing Addendum (Annex to the General Terms) under GDPR (EU) 2016/679 and Spanish LOPDGDD 3/2018.
• Parties: Data exporter (Client) / Data importer (Provider: Stitch Labs SL, Tax ID B19887744).
• Subject matter and duration of processing: for the term of the RootViel services agreement. Purpose: providing offensive intelligence, threat correlation, reporting and cryptographic report signing services.
• Nature and purpose of processing: the data processed is user contact data and asset metadata. No special categories of data are processed by default. If the Client provides personal data within the analyzed assets (logs, emails, SIEM), the Client is the sole Controller.
• Types of personal data: name, corporate email, organization, country, contracted plan; asset metadata (IPs, domains, hashes, banners); platform access logs.
• Categories of data subjects: the Client's employees, suppliers and business contacts; end users of the RootViel platform.
• Technical and organizational security measures: GDPR Art. 32 – TLS 1.3 encryption in transit and AES-256 at rest, RBAC + mandatory MFA on Enterprise, encrypted offsite backups, immutable Ed25519 access log, business continuity and recovery plans, annual staff training.
• International transfers: only to countries with an adequacy decision (EU/EEA) or under the EU standard contractual clauses for data protection (2021/914).
• Data subject rights and breach notification: the Provider will notify any personal data breach to the Client within 48 business hours and will cooperate to support the Client's Record of Processing Activities (RoPA).

For the formal execution of the DPA signed by both parties, send an email to services@stitchlabs.es indicating your organization and the contracted plan. We'll send you the document as an Ed25519-signed PDF ready to seal in your document management system.

Accessibility Statement · WCAG 2.2 Level AA

Royal Decree 1112/2018 · Law 11/2023 · September 20, 2026

• Accessibility statement compliant with EN 301 549 v3.2.1 and WCAG 2.2 Level AA, meeting Spanish Royal Decree 1112/2018 (transposing EU Directive 2016/2102) and Law 11/2023 on universal accessibility of digital products.
• Measures adopted by Stitch Labs SL to ensure the accessibility of the rootviel.io website and the RootViel SaaS platform:
• · Perceivable: text alternatives for all non-decorative images (descriptive alt attributes), transcripts for all audio content, video content with no mandatory audio, minimum contrast of 4.5:1 for text and icons and 3:1 for large text, resizable up to 400% without loss of functionality.
• · Operable: all interactive controls are keyboard-operable (logical tab order), minimum 40×40 pixel touch targets, adjustable time limits, no flashes above 3 flashes/second, skip-to-main-content mechanisms, sitemap, multiple navigation paths.
• · Understandable: consistent navigation mechanisms, language identification on every page (lang="es" / en), links visually distinguishable from surrounding text, identifiable error messages with correction suggestions, forms with semantically associated label elements.
• · Robust: HTML and CSS validated against W3C standards with no errors, correct use of ARIA attributes where semantic HTML5 falls short (aria-expanded, aria-controls, aria-live in forms and FAQ), compatible with screen readers (NVDA, VoiceOver macOS/iOS, latest 2 JAWS versions).
• · Motion: the system `prefers-reduced-motion: reduce` preference is respected, removing all automatic animations and allowing manual playback if the user requires it.
• Conformance level achieved: WCAG 2.2 Level Double-A (AA) on the public rootviel.io site. RootViel SaaS platform: WCAG 2.2 Level A with a roadmap to Level AA in Q4 2026.
• Non-accessible content: some embedded 3D roadmap graphics do not yet have a long description (equivalent data table). Remediation commitment: December 31, 2026. Legacy downloadable PDFs prior to 2026 do not meet PDF/UA-1: progressive remediation during 2026 through resampling.