Privacy Policy

1. Introduction

Welcome to Roam ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our car rental management platform and services.

Roam provides a multi-tenant SaaS platform that enables car rental businesses to manage their fleet, bookings, payments, and customer relationships. This policy applies to all users of our platform, including rental business owners, their staff, and end customers making reservations.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when using our services:

• Account Information: Name, email address, phone number, business name, and password when you create an account
• Business Information: Company details, tax identification numbers, business addresses, and payment processing information
• Booking Information: Customer names, contact details, driver's license information, rental dates, vehicle preferences, and payment information
• Vehicle Data: Fleet information including vehicle specifications, registration details, maintenance records, and availability
• Payment Information: Credit card details, billing addresses, and transaction history (processed securely through our payment partners)
• Communications: Messages, support tickets, and feedback you send to us

2.2 Automatically Collected Information

When you use our platform, we automatically collect:

• Usage Data: Pages viewed, features used, time spent on the platform, and interaction patterns
• Device Information: IP address, browser type, operating system, device identifiers, and mobile network information
• Location Data: General geographic location based on IP address (not precise GPS location)
• Cookies and Tracking: Session data, preferences, and analytics information through cookies and similar technologies

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To provide, maintain, and improve our car rental management platform
• Booking Management: To process reservations, manage vehicle availability, and facilitate rental transactions
• Payment Processing: To process payments, prevent fraud, and maintain financial records
• Customer Support: To respond to inquiries, resolve issues, and provide technical assistance
• Analytics and Improvement: To analyze usage patterns, optimize features, and enhance user experience
• Communications: To send service updates, booking confirmations, payment receipts, and important notifications
• Security: To detect, prevent, and address fraud, security issues, and technical problems
• Legal Compliance: To comply with legal obligations, enforce our terms, and protect our rights
• Marketing: To send promotional materials about new features and services (with your consent)

4. Data Sharing and Disclosure

4.1 Multi-Tenant Architecture

Our platform uses a multi-tenant architecture with complete data isolation. Each rental business's data is logically separated and cannot be accessed by other tenants. Customer booking information is only shared with the specific rental business they are transacting with.

4.2 Service Providers

We share information with trusted third-party service providers who assist us in operating our platform:

• Payment Processors: To handle secure payment transactions
• Cloud Hosting: To store and process data securely
• Email Services: To send transactional and marketing emails
• Analytics Providers: To understand platform usage and improve services
• Customer Support Tools: To provide efficient support services

4.3 Legal Requirements

We may disclose your information when required by law, legal process, litigation, or governmental requests, or to protect our rights, property, or safety.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: Data is encrypted in transit using TLS/SSL and at rest using AES-256 encryption
• Access Controls: Role-based access control (RBAC) ensures only authorized users can access specific data
• Authentication: Secure password requirements and JWT token-based authentication
• Monitoring: Continuous security monitoring and audit logging of all system activities
• Data Isolation: Complete tenant data separation in our multi-tenant architecture
• Regular Audits: Periodic security assessments and vulnerability testing

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations:

• Account Data: Retained while your account is active and for a reasonable period after closure
• Booking Records: Retained for 7 years to comply with tax and financial regulations
• Payment Information: Retained according to payment card industry standards and legal requirements
• Audit Logs: Retained for security and compliance purposes for up to 2 years

7. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Portability: Request a copy of your data in a machine-readable format
• Objection: Object to processing of your information for certain purposes
• Restriction: Request restriction of processing in certain circumstances
• Withdraw Consent: Withdraw consent for marketing communications at any time

To exercise these rights, please contact us at privacy@roam.com. We will respond to your request within 30 days.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for platform functionality and security
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Help us understand how you use our platform
• Marketing Cookies: Used to deliver relevant advertisements (with your consent)

You can control cookies through your browser settings, but disabling certain cookies may limit platform functionality.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable data protection laws.

10. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. Third-Party Links

Our platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a prominent notice on our platform. Your continued use of our services after changes become effective constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

14. Specific Regional Provisions

14.1 GDPR (European Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local data protection authority.

14.2 CCPA (California Users)

California residents have specific rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt-out of the sale of personal information. We do not sell your personal information.