Privacy Policy

Account information: your email address and, if you sign in with a provider such as Google, the basic profile information they share (for example your name).

Content you create: trips, itineraries, saved places, packing and task lists, expenses, notes, and messages you send to our AI assistant.

Usage information: how you interact with the Service, device and browser information, and approximate location derived from your IP address, used to operate, secure, and improve the Service.

Payment information: if you subscribe, our payment provider (Stripe) processes your payment details. We receive limited information such as your subscription status and the last four digits of your card — we do not store full card numbers.

Cookies and similar technologies: see our Cookie Policy. Non-essential cookies (analytics and marketing/affiliate) are only used with your consent.

To provide and operate the Service (including saving your trips and running the features you request); to provide AI-assisted planning; to process subscriptions and payments; to secure the Service and prevent abuse; to communicate with you about your account; to comply with legal obligations; and, where you have consented, to measure and improve the product.

Marketing communications: we do not send marketing email. Any email you receive from us is transactional (authentication, account, or service notices). If we ever introduce marketing email, it will be strictly opt-in.

When you use an AI feature (for example asking our assistant a question or generating an itinerary), the relevant inputs — such as your prompt and the trip context needed to answer — are sent to our AI provider, Google (Gemini API), which generates the response. We send only what is needed for the feature you requested.

We use AI providers to process these requests on our behalf as a processor; we do not permit them to use your content to train their general models, and we do not sell your content. We may store your AI conversations and generated content in your account so you can return to them, and we use aggregate, non-identifying signals to improve the feature.

As described in the Terms, AI output can be inaccurate — please verify important details (hours, prices, visas, safety, official requirements) before relying on them.

No automated decision-making with legal effect: our AI features generate travel suggestions and content only. We do not use automated processing, including profiling, to make decisions that produce legal effects concerning you or similarly significantly affect you (GDPR Art. 22). Your stored AI conversations are deleted with your account.

Where the GDPR or UK GDPR applies, each purpose maps to a legal basis: providing and operating the Service, including AI-assisted planning and payments — performance of our contract with you; non-essential cookies, analytics, and the optional hotel map — your consent; securing the Service, preventing abuse, and improving the product — our legitimate interests (balanced against your rights); tax, accounting, and responses to lawful requests — compliance with legal obligations.

You can withdraw consent at any time (for cookies, via “Cookie settings” in the footer) without affecting the lawfulness of processing before withdrawal.

We share personal data only with service providers (processors) that help us run Roamo, under contracts requiring them to protect it. Our current sub-processors are: Supabase (database, authentication, and file storage); Vercel (hosting and content delivery); Stripe (payment processing — sees your payment and billing details); Google (Gemini API — processes the trip parameters, itinerary content, and assistant messages needed to generate AI output); Inngest (background-job orchestration — processes job payloads such as trip and catalog identifiers); Upstash (rate limiting — transiently processes your IP address or user identifier as a request counter).

Consent-gated: Stay22, our accommodation partner, powers the optional hotel map. It loads only with your marketing-cookie consent and is subject to its own privacy practices. Catalog enrichment providers (Google Places, Outscraper, SearchAPI) process place and destination data only — no personal data.

We update this list when we add or replace sub-processors, by revising this Policy. We do not sell your personal data. We may disclose data if required by law, to protect our rights or users' safety, or in connection with a business transfer.

Our providers operate in the United States and the European Union, so your data may be processed outside your country. Where required, transfers rely on the European Commission's Standard Contractual Clauses and, where available, adequacy decisions, supplemented by technical measures including encryption in transit and at rest and strict access controls.

Retention by category: account data and the content you create (trips, itineraries, lists, expenses) — for the life of your account, plus the 7-day deletion grace window described below; AI conversations — for the life of your account; feature-usage records — up to 12 months (a weekly automated sweep removes older records; aggregate billing counters are retained); payment records — held by Stripe for as long as tax and accounting law requires; rate-limiting counters (IP address / user identifier) — seconds to minutes; encrypted backups — age out automatically on a rolling window of days; a minimal audit of deletion requests — kept without any directly identifying data for up to 24 months.

When you delete your account, it is deactivated immediately and permanently deleted after a 7-day grace window (during which you can cancel by logging back in). Content in trips you share with others is transferred to those collaborators or anonymized so their records stay intact; everything else is deleted, except where the law requires retention.

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing. You can change cookie choices anytime via “Cookie settings” in the footer.

Exporting your data is self-serve: Profile → “Download my data” gives you a machine-readable JSON copy of your account data (trips, itineraries, expenses, AI conversations, and more). Deleting your account is also self-serve: Profile → “Delete my account”. Your account is deactivated immediately and permanently deleted after 7 days; you can cancel within that window by logging back in. You can also email support@roamo.ai from the address associated with your account for any access, correction, export, or deletion request. We respond within one month (GDPR/UK GDPR and Israeli law) or 45 days (CCPA/CPRA), as applicable.

You also have the right to lodge a complaint with a supervisory authority: your local EU/EEA data-protection authority, the UK Information Commissioner's Office (ICO), or the Israeli Privacy Protection Authority (הרשות להגנת הפרטיות).

We use technical and organizational measures to protect your data, including encryption in transit, access controls, and row-level security on user data. No system is perfectly secure, but we work to protect your information and to respond to incidents appropriately.

Roamo is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

If you are a California resident, this section is our notice at collection. In the last 12 months we have collected these statutory categories of personal information: identifiers (email address, name from your sign-in provider, account identifiers); commercial information (subscription status and transaction records via Stripe); internet or network activity (usage of the Service, device and browser information); approximate geolocation (only when you invoke a location-based feature, and coarse location derived from your IP address); and inferences (your trip preferences, drawn from the content you create). Sources: you, your sign-in provider, and your use of the Service. Purposes and retention: as described in sections 2 and 7.

We do not sell personal information, and we have not sold it in the preceding 12 months. The only activity that could constitute “sharing” for cross-context behavioral advertising is the optional hotel map (Stay22), which sets third-party cookies — and it loads only if you opt in to marketing cookies, which are off by default. You can opt out at any time via “Cookie settings” in the footer or the “Do Not Sell or Share My Personal Information” link. Because marketing cookies are opt-in and off by default, browsers sending a Global Privacy Control (GPC) signal receive the opted-out experience automatically.

We do not use or disclose sensitive personal information for purposes other than providing the Service you request. You have the rights to know, delete, correct, and port your personal information, and the right to non-discrimination for exercising them. Submit requests self-serve (deletion: Profile → “Delete my account”) or by emailing support@roamo.ai. We verify requests via your account login or a confirmation from the email address on the account. You may use an authorized agent; we will ask the agent for proof of your written permission and may still verify your identity directly.

If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority and, where required, affected users without undue delay, in accordance with GDPR Articles 33–34, Israeli law, and applicable US state breach-notification laws. Notices will describe the nature of the breach, the likely consequences, and the measures taken.

If you are in Israel, we process your personal data in accordance with the Protection of Privacy Law, 5741-1981, its regulations, and Amendment 13 (in force since August 2025), including its updated definitions of personal data and the enforcement powers of the Privacy Protection Authority. You may contact us at support@roamo.ai to access, correct, or delete your data — we respond within the statutory timeframe — and you may lodge a complaint with the Privacy Protection Authority (הרשות להגנת הפרטיות).

We may update this Policy from time to time and will update the date above. For privacy questions or requests, contact us at support@roamo.ai.