What we hold, what we refuse to hold, and what you can ask us to do about it.
This is a template, not legal advice. It reflects how the product is described on this site; if the build differs, the policy has to change with it. Have a lawyer review it before you publish, and complete the fields shown in [brackets].
This policy explains how [Legal entity name, e.g. Room Two LLC] ("Room Two", "we", "us") handles personal information on roomtwo.co and in the Room Two application.
There are two different relationships here, and the distinction matters:
Card details are collected and stored by our payment processor, not by us. We receive the last four digits, the card brand, and the billing outcome.
These are product decisions, not gaps we intend to close:
We do not sell personal information, and we do not share it for cross-context behavioral advertising. There is no advertising business here to feed.
We do not use your content to train models — not ours, and not a vendor's. Where a third-party model produces a draft, it runs under an agreement that prohibits training on submitted content and prohibits retention beyond the request.
The recorder is optional and off unless you start it. When you use it, we process the audio to produce a transcript and a draft page, and we store both against your account until you delete them or your account closes.
Obtaining consent to record is your responsibility, not ours — the rules vary by state and some require every participant to agree. Our consent prompt is a reminder, not a legal determination.
You can delete any recording, transcript or voice note from your library at any time. Deletion removes it from the live service immediately and from backups within 30 days.
We share personal information only with service providers who need it to operate the Service, each under a written agreement limiting them to our instructions. The categories are:
We will publish a current list of subprocessors on request; write to privacy@roomtwo.co.
We may also disclose information where legally required — in response to a valid legal process, or to protect the rights, safety or property of Room Two, our users or the public. Where we are permitted to, we will notify you first. If we are acquired or merged, information may transfer as part of that transaction, subject to this policy.
When you close your account, we delete your content within 30 days apart from records we are legally required to keep. We will send you an export first if you ask.
We use TLS on every request, encrypt stored content at rest, restrict internal access to what a role requires, and log administrative access. Recap pages are served with no-index directives, use unguessable links, carry an access check, expire on a date you set, and can be revoked instantly.
No system is perfectly secure. If a breach affects your information, we will notify you and any required regulator within the timeframes the law sets. Report a suspected vulnerability to security@roomtwo.co.
More detail is on the Security page.
On the application we use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. These cannot be turned off without breaking sign-in.
On our marketing site we may use limited analytics to understand which pages are read. We do not run advertising cookies, and we do not run any third-party script on a client-facing recap page.
If you add advertising, retargeting or non-essential analytics to this site, you will need a consent banner and this section will need to be rewritten. Most browsers let you block or delete cookies in their settings.
You have the right to access, correct, delete, restrict and object to processing of your personal information, and the right to data portability. Where we rely on consent, you may withdraw it at any time. You may also complain to your local supervisory authority.
Our legal bases are: performance of our contract with you (running the Service and billing), legitimate interests (security, abuse prevention, improving the Service), legal obligation (tax and accounting records), and consent where we ask for it.
You have the right to know what personal information we collect and how we use it, to request deletion or correction, to receive a copy, and not to be discriminated against for exercising these rights. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front. You may use an authorized agent.
Email privacy@roomtwo.co. We will verify your identity through your account and respond within the period the applicable law requires — generally 30 days, extendable where the law allows.
If your request concerns information on a recap page that a professional sent you, contact that professional. They control the page; we act on their instructions.
A recap page is a private summary that a licensed professional prepared for you. We host it for them.
We operate from the United States and our infrastructure is located there. If you use the Service from outside the US, your information will be transferred to and processed in the US, where privacy law differs from your own. Where required, we rely on Standard Contractual Clauses or another approved transfer mechanism.
The Service is for professional use and is not directed to anyone under 18. We do not knowingly collect information from children. If you believe a child's information has been submitted, email privacy@roomtwo.co and we will delete it.
We may update this policy. If a change is material, we will notify account holders by email or in the application at least 30 days before it takes effect. The current version and its effective date are always at the top of this page.
We aim to answer within five business days, and always within the period the law requires.