Privacy Policy.

Section 1Scope, and who is responsible for what

This policy explains how Room Two LLC, a Michigan limited liability company ("Room Two", "we", "us"), handles personal information on getroomtwo.com and in the Room Two application.

There are two different relationships here, and the distinction matters:

• For account holders — the professionals who subscribe — we are the controller of the information we hold about you, and this policy describes what we do with it.
• For the people your pages are about — your clients and the family members who open a recap page — you are the controller. You decide what goes on the page and who receives the link. We are your processor, acting on your instructions. If a client wants their information corrected or removed, they should contact the professional who sent the page; we will support that request but we do not act on it independently.

Section 2What we collect

Information you give us

• Account details — name, email, business name, professional license number where you choose to display one, phone number, and your branding settings.
• Content you submit — meeting notes, figures, page text, voice notes, recipient first name and the access detail you set for a page.
• Transcripts and voice notes — only where you record. Meeting audio itself is not stored. See section 5.
• Support correspondence — what you send us when you get in touch.

If you sign in with Google

Choosing “Continue with Google” means Google confirms your identity to us instead of you setting a password here. Google sends us your name, email address, the fact that Google has verified that address, your Google profile picture and your Google account ID. That is all we receive. We never receive your Google password, and we get no access to your Gmail, Drive, Contacts, Calendar or any other Google service.

We use what Google sends only to create and identify your account. Signing in this way tells Google that you use Room Two; what Google does with that is governed by Google’s privacy policy, not this one. You can disconnect Room Two at any time from your Google account’s third-party access settings, and you can avoid Google entirely by creating an account with an email address and password instead.

Information generated by use

• Page events — whether a page was opened, how many times, when it was last viewed, whether the access check passed, and approximately how long each section of a page was visible on screen. Section timings are stored per page, not per person: they carry no IP address, device identifier or session identifier, and cannot distinguish one reader from another.
• Publication records — the time you approved and published each page.
• Service logs — IP address, browser and device type, and timestamps, kept for security, abuse prevention and debugging.

Payment information

Card details are collected and stored by our payment processor, not by us. We receive the last four digits, the card brand, and the billing outcome.

Section 3What we deliberately do not collect

These are product decisions, not gaps we intend to close:

• No heat mapping, cursor tracking, or recording of a recipient's screen or keystrokes.
• No measurement that identifies a reader. We do record roughly how long each section of a page was on screen (Section 2 says so, and Section 11 tells the recipient so), and those timings are stored against the page, never against a person: no IP address, no device identifier, no session identifier, and no way to tell one reader from another or one visit from the next.
• No device fingerprinting.
• No location or IP-derived geography attached to a client page view.
• No visibility into who a recipient forwarded a page to.
• No third-party advertising or analytics scripts on a client page.
• No government identification numbers, full account or card numbers, or medical records. The Service does not ask for them and you should not enter them.

Section 4How we use information

• To run the Service — create your account, generate drafts, publish and serve pages, enforce access checks, count page usage.
• To bill you — process subscription charges and issue receipts. There are no per-page overage charges.
• To support you — answer questions and investigate problems you report.
• To keep the Service secure — detect abuse, fraud and unauthorized access, and enforce our Terms of Use.
• To improve the Service — using aggregated or de-identified usage patterns, never the content of your client pages.
• To communicate — service notices, security alerts and billing messages, which you cannot opt out of while you hold an account, and product email you can unsubscribe from at any time.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. There is no advertising business here to feed.

We do not use your content to train models. Transcription and drafting use OpenAI's API. OpenAI does not use data sent through its API to train its models by default. What OpenAI keeps, and for how long, is in section 6.

Section 5Recordings, transcripts and voice notes

Recording is optional and off until you start it. In the Room Two app you can record the meeting, or record a private voice debrief on your own afterward.

Audio is transcribed in short pieces and immediately discarded

• Your browser records in pieces of about two minutes, or about half a minute during a private voice debrief. Each piece goes to our server, which passes it to OpenAI's transcription service. Only the text comes back.
• We do not store the audio. It is never written to our database, our file storage or our logs. When a piece's text comes back, your browser drops that audio too. Nothing is saved on your phone.
• The optional private note you record after a meeting is handled the same way: transcribed, then discarded. Its text never appears on a client's page.

Transcripts are kept until you delete them

The transcript and your note's text are stored with the draft so you can check the recap against what was said. To build the draft, the transcript text is sent to OpenAI's language model service. During a private voice debrief, the transcript so far is also sent to that service about every half minute, to check which of the five debrief prompts look covered. Only that list comes back, and nothing from the check is stored. The transcript is kept until you delete it: Delete transcript on the draft removes the transcript and your note's text. The recap drafted from it stays.

Voice notes for your client

A voice note you record for a client is audio we do store, in private storage, with its text caption where it has one. A reader can play it only after passing the page's access check, through a link we sign for one hour at a time. It is kept until you delete or replace it. Deleting a voice note removes the audio and its caption, including from a page you already published. Replacing a voice note removes the old one.

Consent

Before you record a meeting, you confirm that you've given any required notice and obtained any required consent. That is your responsibility, not ours. The rules vary by state and some require every participant to agree. The confirmation is a reminder, not a legal determination. A private voice debrief records only you.

Section 6Who we share information with

We share personal information only with service providers who need it to operate the Service, each under a written agreement limiting them to our instructions. The categories are:

• Hosting and infrastructure — to run the application and store content.
• Payment processing — to take subscription payments.
• Transactional email — to send account, billing and page-open notifications.
• Speech-to-text and language model processing — OpenAI, through its API, to turn audio into text, to build drafts from transcript text, and, during a private voice debrief, to check which prompts look covered. OpenAI does not use API data to train its models by default. For its transcription service, OpenAI's published terms list no abuse-monitoring retention. For the language model service, OpenAI keeps abuse-monitoring logs, which can include what we sent and what came back, for up to 30 days.
• Error monitoring and analytics on our own marketing site — never on a client page.
• Google, if you choose to sign in with it — to verify who you are at sign-in. Information flows from Google to us, not the other way: we send Google no account details, no client information, and nothing from any page you build.

We will publish a current list of subprocessors on request; write to hello@getroomtwo.com.

We may also disclose information where legally required — in response to a valid legal process, or to protect the rights, safety or property of Room Two, our users or the public. Where we are permitted to, we will notify you first. If we are acquired or merged, information may transfer as part of that transaction, subject to this policy.

Section 7How long we keep it

• Published pages — until they expire or you revoke them, then retained 90 days so they can be restored on request, then deleted.
• Meeting audio — not stored. Transcribed in short pieces and immediately discarded (section 5).
• Transcripts — until you delete them.
• Drafts — a page you type on getroomtwo.com stays in your browser until you publish it. A recap drafted in the Room Two app is stored with your account. Drafts are never published until you approve them.
• Voice notes — until you delete or replace them. Delete or replace one and the old recording is removed right away.
• Publication and approval records — for the life of your account.
• Account and billing records — for as long as required by tax and accounting law, typically seven years.
• Service logs — 90 days, then deleted or de-identified.

When you close your account, we delete your content apart from records we are legally required to keep. Deleted items can remain in our database provider's backups until those backups expire.

Section 8Security

We use TLS on every request, encrypt stored content at rest, restrict internal access to what a role requires, and log administrative access. Recap pages are served with no-index directives, use unguessable links, and carry an access check. Pages built on getroomtwo.com can expire on a date you set, and any page can be revoked instantly.

No system is perfectly secure. If a breach affects your information, we will notify you and any required regulator within the timeframes the law sets. Report a suspected vulnerability to hello@getroomtwo.com.

More detail is on the Security page.

Section 9Cookies and similar technologies

Room Two's own code sets no cookies. To keep you signed in, the application keeps your sign-in session in your browser's local storage. It works like a strictly necessary cookie: clear it and you are signed out.

We run no third-party script on a client-facing recap page, and a recap page sets no cookie. After a reader passes the access check on a recap sent from the app, a pass is kept in that browser's local storage for up to 30 days, so they are not asked for the digits again on that device. Pages built by hand keep the pass only for that visit.

On our marketing pages (the pages that describe Room Two, not client pages and not the signed-in application) we use Microsoft Clarity to understand how visitors use the site. Clarity sets its own cookies. We do not run advertising or retargeting cookies anywhere.

Most browsers let you block or delete cookies and site data in their settings. Clearing site data for the application signs you out.

Section 10Your rights

Room Two is offered in the United States and is not directed to users in the European Economic Area, the United Kingdom or Switzerland. If that changes, this policy changes with it.

If you are in California or another US state with a privacy law

You have the right to know what personal information we collect and how we use it, to request deletion or correction, to receive a copy, and not to be discriminated against for exercising these rights. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front. You may use an authorized agent.

How to exercise them

Email hello@getroomtwo.com. We will verify your identity through your account and respond within the period the applicable law requires — generally 30 days, extendable where the law allows.

If your request concerns information on a recap page that a professional sent you, contact that professional. They control the page; we act on their instructions.

Section 11If you received a recap page

A recap page is a private summary that a licensed professional prepared for you. We host it for them.

• The page is not indexed by search engines and is reachable only by someone holding the link and passing the access check.
• The professional who sent it can see that it was opened, how many times, when it was last viewed, and roughly how long each section of the page was on your screen. They cannot see where you were, what device you used, who you forwarded it to, or anything you did outside the page itself.
• We do not add you to any marketing list, and we do not contact you.
• To correct, remove or ask questions about the page, contact the professional named on it. To reach us instead, email hello@getroomtwo.com and we will pass it on and support their response.

Section 12International transfers

We operate from the United States and our infrastructure is located there. If you access Room Two from outside the US, your information is transferred to and processed in the US, where privacy law differs from your own.

Section 13Children

The Service is for professional use and is not directed to anyone under 18. We do not knowingly collect information from children. If you believe a child's information has been submitted, email hello@getroomtwo.com and we will delete it.

Section 14Changes to this policy

We may update this policy. If a change is material, we will notify account holders by email or in the application at least 30 days before it takes effect. The current version and its effective date are always at the top of this page.

Section 15Contact

• Privacy questions, rights requests and security reports — hello@getroomtwo.com
• Legal and privacy notices — sent by email to hello@getroomtwo.com, which is our address for notice. If a request you are making requires correspondence by post, write to Room Two LLC, 28475 Greenfield Road, Suite 113 #7877, Southfield, MI 48076.

We aim to answer within five business days, and always within the period the law requires.