RMB

Privacy Policy

Version 1 · Effective July 1, 2026

Last updated: August 2026

1. Introduction

ROMB ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at romb.app (the "Service").

By accessing or using ROMB, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the Service.

This Privacy Policy is designed to be compliant with the EU General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA"), regardless of where you are located.

2. Information We Collect

We collect the following categories of information to provide and improve the Service:

Account Data

  • Name and email address provided at registration
  • Password (stored as a cryptographic hash — we never store plain-text passwords)
  • Account preferences, plan tier, and billing status

Business & Content Data

  • URLs, business descriptions, target audience information, and other content you submit so that the Service can identify relevant opportunities and generate draft content
  • Subreddits, threads, and pages you track, and drafts you review, edit, or dismiss

Usage Data

  • Feature usage patterns, click events, and session metadata
  • Session recordings and heatmap-style interaction data collected via Microsoft Clarity (see Section 7 — Cookies and Tracking)
  • IP address, browser type, and operating system (collected automatically)

Payment Information

  • All payment processing is handled by Stripe. We do not store full credit card numbers or CVV codes on our servers. We retain only limited billing metadata (such as your Stripe customer ID and subscription status) needed to manage your account.

What We Do Not Collect

  • We do not connect to, request access to, or store login credentials, OAuth tokens, or passwords for your Reddit, Medium, Facebook, or any other Third-Party Platform account. Because the Service does not post on your behalf (see our Terms of Service), we have no need for — and do not request — access to those accounts.

3. How We Use Your Information

  • To create and maintain your account and authenticate your sessions
  • To provide the core Service: identifying relevant opportunities and generating AI draft content for your review
  • To process payments and manage your subscription
  • To send transactional emails (welcome, billing receipts, account notifications)
  • To monitor service health, diagnose errors, understand product usage, and prevent abuse
  • To improve the platform through aggregated, anonymised analytics
  • To comply with legal obligations and enforce our Terms of Service

4. Data Sharing

We do not sell, rent, or trade your personal data. We share information only with the third-party service providers necessary to operate the Service:

  • OpenAI — business/content data you submit (e.g., URLs, descriptions) is sent to OpenAI to generate AI-powered opportunity detection and draft content
  • Stripe — payment processing and subscription management
  • MongoDB — database hosting for account and application data
  • Amazon Web Services (AWS) — application and infrastructure hosting
  • Microsoft Clarity — anonymised session-behaviour analytics (clicks, scrolling, heatmaps) to help us improve the Service

We may also disclose information if required by law, in connection with a merger, acquisition, or sale of assets, or to protect the rights, property, or safety of ROMB, our users, or the public.

5. Data Security

We implement industry-standard security measures, including:

  • Encryption of data in transit using TLS/HTTPS
  • Access controls so users can only access their own account data
  • Restricted database and infrastructure permissions
  • Regular dependency audits and security patches

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Your Rights

Regardless of your location, we extend the following rights to all users, in line with GDPR and CCPA:

  • Access — request a copy of the personal data we hold about you
  • Correction — request correction of inaccurate or incomplete data
  • Deletion — request deletion of your account and associated personal data
  • Export / Portability — request a machine-readable export of your data
  • Objection / Opt-out — object to certain processing activities, including analytics tracking
  • Non-discrimination — you will not receive a lesser level of service for exercising your rights

Legal basis for processing (GDPR): we process your data on the basis of (a) performance of our contract with you (providing the Service), (b) our legitimate interests (improving and securing the Service), and (c) your consent, where required (e.g., certain cookies).

International transfers: where your data is transferred outside your home jurisdiction (for example, to our providers' servers in the United States), we rely on the relevant providers' own compliance mechanisms (such as Standard Contractual Clauses) to safeguard the transfer.

To exercise any of these rights, contact us at [contact email]. We will respond within 30 days.

7. Cookies and Tracking

ROMB uses cookies and similar technologies for:

  • Authentication — session cookies to keep you logged in
  • Preferences — remembering your account settings
  • Analytics — Microsoft Clarity uses cookies and similar technologies to record anonymised session behaviour (clicks, scrolling, page navigation) so we can understand how the Service is used and improve it

We do not use third-party advertising cookies. You can disable cookies in your browser settings or opt out of Clarity tracking, though this may impair your ability to use parts of the Service.

8. Third-Party Services

Our Service integrates with the following third parties, each governed by their own privacy policies:

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account:

  • Personal data and account information are deleted within 30 days
  • Anonymised usage data may be retained for up to 24 months for aggregate analytics purposes
  • Billing records may be retained as required by applicable tax and financial regulations

10. Children's Privacy

The Service is not directed to individuals under the age of 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, notify you by email or via an in-app notice. Continued use of the Service after changes become effective constitutes acceptance of the revised policy.

12. Contact

If you have questions or concerns about this Privacy Policy or your personal data, please contact us:

Company: Mocca AI, LLC Email: [contact email]

Contact

Questions about this document? Email [email protected].