Privacy Notice

Roam Rule is operated by Handlr Ventures Ltd, trading as Handlr Ai. We are registered in England under company number 12786304. Our ICO reference is ZB451786.

If you need help with privacy questions, account rights, or support, you can contact us at support@roamrule.com or write to 82 Wandsworth Bridge Road, London, SW6 2TF, United Kingdom.

Roam Rule is a travel-record and residency-support product. We use personal data to run the service, improve reliability, understand how people use the app, and help when travel-day outcomes or paid access need investigation.

This notice covers data collected through the mobile app, the public website, support channels, linked ChatGPT app access and the internal tools used to run Roam Rule.

When you create or use an account, we process data such as your email address, authentication identifiers, display name, onboarding answers, selected trackers, timezone choices, plan state, route selections, route-review answers, and device/session identifiers needed to keep your account secure and working.

We also store route-review history and acknowledgement timestamps when you confirm or later correct a route so we can show the current route state, support correction history, and the acknowledgement you gave when saving guidance-driven choices.

Authentication and account state are currently handled through Supabase-backed services and Roam Rule server-side session flows.

Roam Rule is built around travel evidence. Depending on your permissions and feature usage, we may process foreground and background location events, timezone data, country inferences, airport and border-crossing evidence, traveller-day summaries and daily rule results.

We also process traveller corrections, unknown-day resolutions, itinerary input, and similar evidence you choose to provide so the service can explain or recalculate your travel record.

• precise and background location where you have granted it
• country and timezone lookups derived from latitude and longitude
• daily stay and rule results derived from the raw travel record
• manual evidence or corrections you submit to resolve unknown days

We collect analytics and service diagnostics to understand activation, permission friction, paywall behaviour and reliability issues.

That currently includes product analytics, masked session replay, error monitoring, app diagnostics, feedback submissions, export and deletion requests, and internal support logs when our team investigates an account.

On the public website, we currently use Google tags for website analytics and advertising-related measurement when your cookie choice allows it.

On mobile, this may include Firebase and Google Analytics for a limited set of production app events, alongside PostHog and Sentry. We use that production-only reporting to understand release performance and key funnel events rather than as a full replay or diagnostic tool.

• Google tags on the public website for analytics and advertising-related measurement when cookie consent allows it
• PostHog for product analytics, feature flags, and masked session replay
• Firebase and Google Analytics for curated production mobile-app analytics
• Sentry for error monitoring and service diagnostics
• support messages, bug reports, and internal support logs linked to the account

Roam Rule includes AI-assisted features such as rules questions, unknown-day triage, itinerary imports and risk summaries. These run on our servers, not directly from the app on your device.

When you use those features, we may process the input you submit, the relevant account or travel details needed to answer the request, and the generated response. We also log the model, latency, token usage, and estimated cost for budgeting, abuse prevention, and service quality.

• OpenAI is the current model provider used for Roam Rule AI features
• AI outputs are informational and may be incomplete or wrong
• usage logs are kept for budgeting, usage limits, and service improvement

If you choose to link Roam Rule inside ChatGPT, ChatGPT sends Roam Rule your request and an account-linking token. We verify the token, check that the email is verified and match it to an existing Roam Rule account. Where the production sign-in provider gives us a durable account identifier, we use that identifier as well as the verified email. We do not create new Roam Rule accounts from ChatGPT.

The ChatGPT app is read-only in this version. It may return minimised summaries of your plan, setup state, trackers, counters, country-level travel days, unknown days, account export state and account-deletion state so ChatGPT can answer your question.

We do not return raw GPS coordinates, raw location events, push tokens, session IDs, trace IDs, internal debug payloads or secrets through the ChatGPT app.

You can disconnect the app through ChatGPT account-linking controls where available. You can also use Roam Rule export and account-deletion tools, or contact support if you need help with access, export or deletion.

We process subscription and access data so we can grant the right plan features, manage paid access, and support restores. The current product contract includes Core and Premium access paths. Trial offers may be tested later as controlled experiments.

Subscription and access checks currently rely on RevenueCat together with app-store purchase systems. We keep the resulting access state, billing events, and support metadata needed to troubleshoot restores, upgrades, downgrades, or access disputes.

We use personal data to provide the service you asked for, keep the product secure, investigate support issues, improve the service, enforce usage limits and paid access, and meet legal or regulatory obligations where they apply.

Where GDPR or UK GDPR applies, our main legal bases are contract, legitimate interests, consent for permission-based or optional features where appropriate, and legal obligation where we must retain or disclose information.

We share data only with providers and processors needed to run Roam Rule, such as hosting, authentication, analytics, subscriptions, customer support, communications, and AI services.

The current operational stack in this repository includes the following categories of provider:

• Supabase for authentication and database infrastructure
• Vercel for hosting and preview deployments
• RevenueCat and the app stores for subscription and access handling
• OpenAI for AI feature processing and the optional ChatGPT app experience
• Google tags for public-website analytics and advertising-related measurement where consent allows it
• PostHog for product analytics and masked session replay
• Firebase and Google Analytics for curated production mobile analytics reporting
• Sentry for error monitoring
• AWS SES for transactional email fallback

Some of our providers operate internationally. Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as contractual protections, provider transfer mechanisms, and access controls proportionate to the service.

We keep personal data only as long as it is needed for the product, support, security, and legal obligations that apply. Some retention windows are already enforced in product code and operations.

For example, account export downloads are time-limited, and account deletion requests use a 7-day grace window before final deletion runs. Raw location evidence is currently retained while we finalise the long-term storage and retention model for Journey Replay and compliance records.

• raw location evidence is currently retained while the long-term retention policy is being finalised
• account export downloads are short-lived and expire automatically
• account deletion requests use a 7-day grace period before the final purge job runs

Depending on your location, you may have rights to access, correct, export, restrict, object to, or delete personal data. Roam Rule already exposes in-app export and account-deletion requests, and you can also contact us if you need help exercising your rights.

If you are in the UK, you can also raise a concern with the Information Commissioner’s Office. Our current ICO reference is ZB451786.