Rokoko

GDPR overview

Implementation is explicit but partly undocumented. The privacy policy states it was composed pursuant to Regulation (EU) 2016/679, and Rokoko Electronics ApS is established in Denmark, so an Article 27 representative does not apply. Data subject rights are listed: access, rectification, erasure, restriction, objection, portability, withdrawal of consent and complaint to a supervisory authority, with support@rokoko.com as the privacy contact and hi@rokoko.com for the terms. Transfers outside the EEA to staff or suppliers are possible with safeguards that are asserted but not detailed; recruitment processing cites Articles 6(1)(f), 9(2)(f) and 9(2)(a) and standard contractual clauses. Security measures include end-to-end SSL, hashed and salted passwords, role-based access and logged actions. No DPA, no sub-processor list, no named DPO and no SOC 2 or ISO 27001 certification appear on the site. The Terms of Service are governed by Danish law.

Who owns the data?

Rokoko Electronics ApS is the controller of the personal data processed through its services, under Regulation (EU) 2016/679. Users keep the benefit of their own captures: the privacy policy grants portability, letting an end user obtain and reuse personal data across different accounts, and on termination Rokoko states it provides access to all information stored for you before it may delete it, unless retention is legally required. Motion and facial assets produced with Rokoko tools, including Text-to-Motion clips, are cleared for commercial use under the Terms of Use. Rokoko says it does not sell personal data, but reserves the right to share aggregated or anonymised data with third parties.

Reuse rights

Assets generated with Rokoko tools can be reused commercially without asking further permission, subject to the Terms of Use. On Rokoko's side, the declared purposes are providing and managing the account and access to it, personalisation, replying to your communications, sending subscribed emails, market research and usage analysis to improve the services, on the legal bases of contract performance, legitimate interest, legal obligation and consent. The data collected ranges from name, date of birth, age, weight, height and other body characteristics to company name and identification number, contact details, demographics, IP address, device and browser identifiers, browsing behaviour and activity captured by worn sensors or by a video-processing application. It may be shared with other group companies, suppliers and partners, authorities and regulators, a potential acquirer in a merger or acquisition, and third parties with your consent; anonymised usage statistics may also go to investors, affiliates, partners and advertisers. Beyond that, Rokoko maintains a human motion dataset built from a user base of more than 50,000 people, described as fully anonymised, used primarily for its own product development and sub-licensed to selected third parties under strict conditions, while its Text-to-Motion foundation model is trained on millions of motion assets paired with text descriptions. No opt-out from that training or licensing is documented on the site.

Data retention & training

Hosting summary

Rokoko does not name a hosting country or region anywhere on its site. The privacy policy states only that personal data may be accessed by staff or suppliers in, transferred to, or stored at a destination outside the European Economic Area, where data protection standards may be lower, and that safeguards are put in place, without describing them. Recorded assets are kept in what Rokoko calls the Rokoko cloud, retained for one month on the Starter plan and without limit from Basic upward, while the Enterprise tier allows local storage with no cloud synchronisation. Two processing paths are documented more precisely: on iOS, TrueDepth capture stays on the device, the live video feed is never used or stored, and only the 52 ARKit blend shapes are transmitted, whereas video files uploaded to Rokoko Video are stored by Rokoko in order to produce the animation. The online store is hosted by Shopify Inc. DNS resolution sits behind Cloudflare on an anycast address geolocated in the United States, which indicates an infrastructure choice rather than the location of the data. No data processing agreement and no sub-processor list are published.