What we collect, and what we don't.

1. Who we are

The Room IQ is operated by Francisco Castro, an individual sole operator based in Brazil. We are the data controller responsible for the personal data described in this policy.

If you have any question about your data or this policy, write to us at privacy@theroomiq.app.

2. The short version

In plain terms:

• —We never record or store your spoken audio — only the text transcript of a session is saved.
• —We don't sell your personal data, and we don't share your transcripts with anyone except the providers that make the product work.
• —Your data is isolated from every other account at the database level.
• —You can ask us to access, correct, or delete your data at any time by emailing privacy@theroomiq.app.

3. Information we collect

We collect the following categories of personal data:

• —Account information — your email address, your password (stored only as a secure hash), and optionally your first name, preferred language, and a self-reported role (such as founder, manager, or executive) you may give at sign-up.
• —Sign-in information — if you sign in with Google, we receive your basic Google profile (name and email) to create or match your account.
• —Session content — the text transcripts of your practice sessions, the AI-generated scores, feedback, and reports, the behavioral metrics we derive from your transcript (such as talk ratio, filler-word count, and words per minute), and any case studies you write or paste in.
• —Payment information — when you buy minutes, our payment provider (Stripe) handles your card. We store only billing references (Stripe customer and transaction identifiers), the amount, and what you bought — never your full card number.
• —Technical and usage information — cookies and similar identifiers, campaign-attribution data when you consent, your language and currency preference, the device and audio settings you choose, and internal usage and cost records we keep to run and protect the service.

4. Voice and recordings

This matters, so we state it plainly: we do not record or store your raw audio.

During a live session, your microphone audio is streamed in real time to our voice provider (OpenAI) to power the spoken conversation with the AI. When the conversation ends, only the resulting text transcript is saved to your account. We never keep an audio file of your session.

5. How we use your information

We use your personal data to:

• —create and maintain your account and sign you in;
• —run your practice sessions and generate transcripts, scores, and feedback;
• —process your purchases and manage your minute balance;
• —operate, secure, debug, and improve the service, including monitoring our own usage and costs;
• —measure whether our advertising campaigns lead to website visits and account registrations, when you consent;
• —send you essential service messages, such as sign-in, password-reset, and purchase confirmations.

6. Legal bases for processing

Under Brazil's Lei Geral de Proteção de Dados (LGPD), we rely on the following legal bases:

• —Performance of a contract — to provide the service and process your payments.
• —Legitimate interests — to secure, debug, and improve the service and to prevent abuse.
• —Compliance with legal obligations — for example, keeping tax and accounting records.
• —Consent — where we specifically ask for it.

7. Who we share your data with

We rely on a small set of trusted service providers (sub-processors) to run the service, and we share only the minimum each one needs to do its job. Some providers, including Stripe, Google, and Meta, may also act as independent controllers under their own terms.

We do not sell your personal data, and we do not share your transcripts for advertising. The providers we use are:

• —Supabase — our database and authentication host; stores your account, sessions, transcripts, scores, and billing references.
• —OpenAI — powers the live voice conversation and transcription; receives your streamed audio and words during a session.
• —Anthropic (Claude) — generates your session scoring, feedback, and case studies; receives the relevant transcript or case text.
• —Stripe — processes payments; receives the payment and contact details needed to complete a purchase.
• —Google — if you choose to sign in with Google, it authenticates you and shares your basic profile with us; Google Analytics also measures website usage and campaign results.
• —Meta — the Meta Pixel measures public-page visits and completed registrations from our Facebook and Instagram campaigns after you consent. We do not send session transcripts or spoken content to Meta.
• —Vercel — hosts and serves the application and processes basic technical request data.

8. International data transfers

We operate globally, and the providers above store and process data primarily in the United States. This means your personal data may be transferred to and processed in countries other than your own, including outside Brazil.

When we transfer personal data internationally, we rely on the safeguards permitted by the LGPD and applicable law, and we work only with providers that commit to protecting it.

9. How long we keep your data

We keep personal data only as long as we need it for the purposes described here:

• —Account data — for as long as your account is active.
• —Sessions and transcripts — kept with your account so you can review your history. You can erase the saved transcripts of your past sessions yourself at any time from Settings (your scores and progress stats stay); everything is removed if you close your account.
• —Paused sessions — a session left paused is automatically finalized after 7 days.
• —Payment records — retained as required for tax, accounting, and fraud-prevention purposes.

10. Your rights

Under the LGPD, you — the data subject — have the right to:

• —confirm that we process your data and access it;
• —correct incomplete, inaccurate, or outdated data;
• —request anonymization, blocking, or deletion of unnecessary or excessively processed data;
• —request portability of your data to another provider;
• —request deletion of data processed based on your consent;
• —obtain information about the parties with whom we have shared your data;
• —withdraw your consent at any time.

11. Exercising your rights

To exercise any of these rights — including deleting your account and all data tied to it — email privacy@theroomiq.app. We currently handle account deletion and most other requests by email and respond within the timeframe the law requires.

You can already erase the saved transcripts of your past sessions yourself, at any time, from Settings — no email needed. Full account and data deletion is still handled by email for now, so reach out and we'll take care of it for you.

12. If you are in the United States

If you live in California or another U.S. state with a privacy law, you have the right to know what personal information we collect, to request access to or deletion of it, and not to be treated differently for exercising these rights.

We do not sell your personal information. If you consent to advertising measurement, the Meta Pixel shares limited browser and event data with Meta to measure our Facebook and Instagram campaigns; you can decline or withdraw that consent at any time. To make a request, email privacy@theroomiq.app.

13. Cookies

We use a small number of cookies and similar technologies. Essential cookies work without consent; analytics and advertising-measurement tools are controlled through Cookie preferences.

You can clear or block cookies in your browser settings, but the service can't keep you signed in without the essential authentication cookies. What we use:

• —Authentication cookies — set by our login provider (Supabase) to keep you signed in. These are essential.
• —A language cookie — remembers your preferred language for up to one year.
• —Local browser storage — remembers minor preferences such as your selected microphone and conversation settings, and stays on your device.
• —Analytics and campaign measurement — PostHog, Google Analytics, and the Meta Pixel help us understand public-page usage, registrations, and campaign performance. The Meta Pixel is loaded only after you accept. You can change your choice at any time through Cookie preferences.

14. Data security

We take reasonable measures to protect your data. The application runs on Vercel and Supabase, and every account's data is isolated from all others at the database level using row-level security. Access to production data is restricted.

No method of transmission or storage is ever completely secure, so we can't promise absolute security — but private is our default, not a setting you have to switch on.

15. Children

The Room IQ is a professional product made for adults. It is not directed to children, and we don't knowingly collect personal data from anyone under 18. If you believe a minor has given us their data, email privacy@theroomiq.app and we'll delete it.

16. Changes to this policy

We may update this policy as the product evolves or the law changes. When we make a material change, we'll update the date at the top and, where appropriate, let you know. If you keep using the service after an update, that means you accept the revised policy.

17. Contact

Questions, requests, or concerns about your data or this policy? Email privacy@theroomiq.app.

Data controller: Francisco Castro (individual operator), Brazil.