Road map ROI
Sign inRun your numbers

Legal

Privacy Policy

Last updated: November 1, 2026

This Privacy Policy explains how Cookie Tech (legal entity PANCHENKOV & LAHAV Ο.Ε.) handles personal data on Road map ROI (roadmap-roi.com). It follows the EU General Data Protection Regulation (Regulation 2016/679, "GDPR"), Greek Law 4624/2019, and the ePrivacy rules in Greek Law 3471/2006.

1. Data Controller

  • Trading name: Cookie Tech
  • Legal entity: PANCHENKOV & LAHAV Ο.Ε. (general partnership), trading as Cookie Tech
  • Address: Promitheos 2, 166 73 Voula, Attica, Greece
  • VAT: EL802636558 (registered for intra-EU transactions, VIES)
  • General Commercial Registry (ΓΕΜΗ): 179986658000
  • Tax office: ΚΕΦΟΔΕ Αττικής
  • Contact for legal and privacy matters: hello@cookie-tech.com

2. Scope

This policy covers visitors to our website, people who use the public calculators, people who create a free account, and anyone who contacts us. Road map ROI is free and is partly funded by ads on our public pages. We take no payments and hold no payment details. The service does not use artificial intelligence: results come from fixed formulas and template text.

3. Data we collect

  • Public calculators: the calculations run in your browser. The numbers you type there are not sent to our server. We only record that a calculator was completed, without the numbers.
  • Account data (optional account): email address, a password hash (or your Google account identifier and email if you sign in with Google), and the name and organization name you enter.
  • Workspace content you save: scenarios, projects, features, sub-features, scores (NPV, RICE, ICE, MoSCoW, Kano, FVI), notes, comments, activity logs, and the email addresses of workspace members you invite.
  • Product analytics: first-party events stored in our own database, such as page views, scroll depth, calculator completed and sign-up. Each event has the page path, a random identifier that lasts only while the page is open and, if you are signed in, your account ID. We also note how you arrived on that visit: campaign tags in the link (UTM), the referring website's domain and the first page. None of this is stored on your device, and it is not shared with Google or any ad network.
  • Advertising (public pages only): our landing page and guides show ads served by Google AdSense. Ads never appear inside the signed-in app, on the sign-in page or on legal pages. When an ad loads, Google receives your IP address, browser and device information and the page you are on, and may read or set ad cookies. In the EEA, the UK and Switzerland, Google's certified consent tool asks you first before personalised ads or ad cookies. If you do not consent, Google may still show non-personalised or limited ads. See section 7b.
  • Contact consent: your optional yes or no answer to product emails, see section 7a.
  • Optional role: the job function you choose at sign-up, if any.
  • Technical data: IP address, browser type and timestamps in server logs, for security and abuse prevention.

4. Legal bases (GDPR Art. 6)

  • Contract: to run the free account you asked for, sign you in and send account emails such as sign-in links and password resets.
  • Legitimate interest: security, abuse prevention and first-party product analytics to improve the service.
  • Legitimate interest: showing ads on public pages to keep the service free.
  • Consent: product emails you opt in to, and personalised ads and ad cookies where the law requires consent, and loading a YouTube video when you press play. You may withdraw at any time.

5. Your rights

Under the GDPR and Law 4624/2019 you have the right to:

  • access, correct or erase your personal data,
  • restrict or object to processing,
  • data portability (a machine-readable export),
  • withdraw consent at any time,
  • lodge a complaint with the Hellenic Data Protection Authority (HDPA, dpa.gr, Kifissias 1-3, 115 23 Athens, Greece).

You can delete your account from Settings. For anything else, email hello@cookie-tech.com and we will reply within one month.

6. Retention

  • Account and workspace data are kept while your account exists.
  • When you delete your account, or after a verified deletion request, we erase account and workspace data within 30 days.
  • Server logs and analytics events are kept for up to 12 months.

7. Sub-processors

These providers process personal data for us:

  • Lovable Cloud: database, authentication and file storage (on Supabase), and hosting (on Cloudflare).
  • Lovable Emails: the platform's email service. It sends sign-in, password reset and other account emails from notify.roadmap-roi.com (email address and message content only).
  • Google: sign in with Google, if you choose it, and Google Fonts (fonts.googleapis.com), which receives your IP address when fonts load.

Google AdSense and YouTube are not our sub-processors. Google decides for itself how it uses ad data and YouTube data, and acts as an independent controller for its own processing (see sections 7b and 7c). We may share responsibility for sending your data to YouTube when you press play. We do not use payment providers or AI providers. If we add a new provider that receives personal data, we will update this policy first.

7a. Contact consent

Cookie Tech (PANCHENKOV & LAHAV Ο.Ε.), Promitheos 2, 166 73 Voula, Attica, Greece, is the controller of this data. Contact: hello@cookie-tech.com.

If you tick the optional box, we email you to ask about your experience and to send occasional product updates. Legal basis: your consent (GDPR Art. 6(1)(a)).

The box is unticked by default. You do not need to tick it to use Road map ROI, and not ticking it does not limit any feature.

Withdraw at any time with the Product emails switch in your profile, the unsubscribe link in any email, or by replying to an email. Withdrawal does not affect emails already sent.

We store your answer (yes or no), the date and time, the wording you saw and its version, and your email address.

Emails are sent through Lovable Emails, the platform's email service. Contacts who agreed are also kept in Cookie Tech's contact system.

We keep the record while your account exists. When you delete your account the record is deleted too.

You can complain to the Hellenic Data Protection Authority (dpa.gr) or to your local authority. Users in Israel can contact the Privacy Protection Authority.

If you answer an optional in-app question, we link your answer to your account to decide what to build. Legal basis: our legitimate interest in improving the product (Art. 6(1)(f)). You can skip it, and you can ask us to delete your answer.

7b. Advertising by Google

Ads on our landing page and guides are served by Google AdSense, using ad units we place by hand. Google Ireland Limited and Google LLC act as independent controllers for their own ad processing, under Google's own privacy policy. We do not receive the data Google collects through ads, and we do not share your account or workspace data with Google for advertising.

In the EEA, the UK and Switzerland, Google's certified consent tool (part of the IAB Transparency and Consent Framework) asks you before personalised ads or ad cookies are used. If you say no, Google may show non-personalised or limited ads, which rely on the page content and on general information such as your approximate location.

You can change your choice at any time with the "Privacy and cookie settings" link in the footer. You can also manage how Google personalises ads in Google's ad settings, and read How Google uses information from sites or apps that use our services.

7c. Video from YouTube

Our cost comparison page shows a video hosted on YouTube, using YouTube's privacy-enhanced mode (youtube-nocookie.com). Nothing loads from YouTube until you press play. When you do, YouTube (Google Ireland Limited and Google LLC) receives your IP address and details of your browser, may store information on your device, and may record that you watched the video, under Google's privacy policy. If you do not press play, none of this happens.

8. International transfers

Some of our providers may process data outside the European Economic Area. Where they do, transfers rely on a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified companies) or on Standard Contractual Clauses. Google may process AdSense and YouTube data in the United States.

9. Security

  • All traffic uses HTTPS.
  • Data is encrypted at rest by our hosting provider.
  • Database row-level security keeps each workspace separate.
  • Secrets are kept on the server, never in the code sent to your browser.
  • The code is checked by automated security reviews.

10. Children

Road map ROI is not intended for users under 16. We do not knowingly collect data from children.

11. Breach notification

If a personal-data breach happens, we will notify the HDPA within 72 hours of becoming aware of it, where the GDPR requires this. If the breach is likely to put your rights at high risk, we will also tell you without undue delay.

12. Cookies

See our Cookie Policy for the full list of cookies and similar browser storage used on this site, including Google's advertising cookies.

13. Changes to this policy

We will tell account holders by email or in the app at least 30 days before any material change. The date at the top shows the current version.

14. Contact

PANCHENKOV & LAHAV Ο.Ε. (general partnership), trading as Cookie Tech. Promitheos 2, 166 73 Voula, Attica, Greece. VAT EL802636558 (registered for intra-EU transactions, VIES). General Commercial Registry (ΓΕΜΗ) 179986658000. Tax office: ΚΕΦΟΔΕ Αττικής. Contact for legal and privacy matters: hello@cookie-tech.com

A Greek-language translation of this policy is available on request.

← Back to home