Privacy Policy

TECHPSILON S.R.L., Șoseaua Linia de Centură nr. 50, bl. Q11, sc. 1, et. 2, ap. 205, Ștefăneștii de Jos, județul Ilfov, Romania, trade register number J2022004638236, tax ID (CUI) 46470930, is the controller of your personal data. We haven’t appointed a data protection officer, as the law doesn’t require one for a company like ours; write to privacy@roola.app instead.

Roola has two kinds of users. People use the mobile app to check in at the places they visit and collect rewards. Businesses use the business web app, run by their owners and admins, to set up their places and rewards. One Roola login can do both, so parts of this policy apply to you only if you run a business.

• Your account: your email address, first and last name, and the identifiers Firebase Authentication uses to sign you in. If you sign in with Google, Apple or Microsoft, that service tells us an identifier for your account there, and usually your name and email address. Your password is kept only as a hash, by our sign-in provider; we never see it.
• Your choices: when you accepted our terms and this policy, and whether you said yes or no to marketing by email and by push notification, each with the version and the time.
• Check-ins: each time you scan a code, who scanned it, which code, at which place or for which reward, and when.
• Progress and rewards: how far along you are with each reward, and the rewards you’ve unlocked and claimed, with their dates.
• If you run a business: its profile (name, type, description, contact details and website), the addresses of its locations, who belongs to it and in what role, and the rewards it offers.
• Our staff’s actions: when someone at Roola reviews, approves, rejects or suspends a business, we record who did it, what they did and when.
• Technical data: IP addresses, device and app details, and the times of requests, in our application logs.
• Emails: the emails we send you from noreply@roola.app, such as the one confirming your address.

• To run Roola for you: your account, check-ins, progress and rewards, and listing a business. This is needed to perform our contract with you (GDPR Art. 6(1)(b)). The emails about your account and a business’s review fall under this too.
• To keep Roola fair and safe: reviewing businesses before they go live, catching fraudulent scans, protecting accounts, keeping logs and a record of what our staff do. This is our legitimate interest in a trustworthy service (Art. 6(1)(f)).
• To show that you agreed: we keep a record of your consents because the law asks us to be able to prove them (Art. 6(1)(c) and Art. 7(1)).
• Marketing: only if you said yes (Art. 6(1)(a)). We don’t send any marketing yet, and you can change your mind in the app at any time.
• Legal obligations: when the law requires us to keep or hand over data (Art. 6(1)(c)).

What a business publishes on Roola, such as its name, locations and rewards, is shown to people using the app. When you claim a reward, the staff at the counter see it on your screen, so they can give it to you.

The companies in the next section process data for us, only to run Roola. We hand data to authorities only when the law obliges us to. We never sell your data, we don’t show ads, and we don’t share anything with advertisers.

Each of them is bound by a data processing agreement and may use your data only to provide its service to us.

• Google Cloud (Google Cloud EMEA Limited, Ireland)

  What for

  Runs the Roola service (Cloud Run), its database (Cloud SQL for PostgreSQL) and a short-lived cache (Memorystore for Redis).

  Data

  Everything Roola stores and processes.

  Where

  Belgium (europe-west1)

• Firebase Authentication (Google LLC, United States, through Google Cloud EMEA Limited)

  What for

  Sign-in: your login, your password (kept only as a hash), and sign-in with Google, Apple or Microsoft if you use it.

  Data

  Your email address, password hash, name, sign-in times and IP addresses, and the account identifier Google, Apple or Microsoft sends if you sign in with them.

  Where

  European Union and United States

  Safeguard

  The EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses

• Better Stack

  What for

  Keeps our application logs, which we use to spot and fix problems.

  Data

  Technical records of requests to Roola, which can include your account ID and IP address.

  Where

  European Union and United States

  Safeguard

  The European Commission's Standard Contractual Clauses, wherever data leaves the EEA

• Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg)

  What for

  Sends the emails Roola sends from noreply@roola.app: confirming your email address, resetting your password, and letting a business know whether it was approved, turned down or suspended.

  Data

  Your email address and what the email says.

  Where

  Ireland (eu-west-1)

• ImprovMX

  What for

  Receives the emails you send to our @roola.app addresses and passes them on to our inbox.

  Data

  Your email address and what you write to us.

  Safeguard

  The European Commission's Standard Contractual Clauses, wherever data leaves the EEA

Roola runs on Google Cloud in Belgium (europe-west1): the service, its database and its cache are all there. Sign-in is handled by Firebase Authentication, which Google runs in the EU and the United States. Where a provider processes data outside the European Economic Area, the transfer is protected by the safeguards listed in the table above.

• Your account and everything tied to it, including your consents, check-ins, progress and rewards: until you delete your account. Then we erase it, along with your sign-in at Firebase Authentication.
• A business you own on your own is deleted together with your account, with its locations, rewards and codes. A business you share with other owners carries on without you.
• Application logs are deleted automatically after a limited time.
• Records of our staff’s actions are kept for as long as we need them to account for those decisions.

• Get a copy of your data: use “Download your data” in the app, whenever you want.
• Delete your data: delete your account in the app, at any time. For your safety, we may ask you to sign in again first.
• Correct it: change your details in the app, or ask us.
• Change your marketing choices: in the app, whenever you like.
• Object, restrict, or ask what we hold: write to privacy@roola.app. We answer within a month.

You can also complain to the Romanian data protection authority, ANSPDCP, or to the authority where you live or work.

This website sets no cookies, loads nothing from other companies, and uses no analytics or tracking, so there’s no cookie banner to click through.

The Roola apps keep you signed in with a cookie or your device’s own storage. That’s strictly necessary for the service to work, so it doesn’t need your consent, and it’s never used to track you. We use no advertising, no tracking pixels and no analytics. If we ever add analytics, we’ll ask you first where the law requires it, and update this policy.

Your data travels encrypted and is encrypted where it’s stored. Only the people who need it can reach our systems, and what our staff do to businesses is logged. If a breach puts your data at risk, we’ll tell you and the authority, as the law requires.

Roola isn’t meant for anyone under 16, and we don’t knowingly keep their data. If you think a child has signed up, tell us at privacy@roola.app and we’ll delete the account.

When we change this policy, we update the date at the top. If the change matters, we tell you in advance, in the app or by email, and ask you to read and accept the new version.