Last updated: 7 November 2026
Short version: we collect what we need to run your account, arrange your bookings, and meet the law. We do not sell your data. You can ask to see, correct, or delete it.
1. Who is responsible for your data
ROAM is the data controller for the personal data described in this policy. You can contact us through the contact form on the site. We do not publish an email address on the site; the form routes your message to the right person server-side.
2. What we collect
- Account data: name, email address, and authentication identifiers. Passwords are handled by our authentication provider and are never stored by ROAM in plain text.
- Profile and Club data: first name, surname, document number (passport or ID), date of birth, nationality, phone number, countries you travel to, and how often you rent.
- Booking data: pickup country and city, dates, car type, passenger count, driver details, licence issue date, flight details for airport pickups, and notes you provide.
- Payment data: plan purchased, amount, bonus, Stripe session identifier, and payment status. Card details are handled by Stripe and never touch ROAM's servers.
- Usage data: basic technical information needed to keep the site secure and working, such as your language preference stored in your browser.
3. Why we use it
- To create and secure your account, confirm your email, and let you sign in.
- To provide ROAM Credit, ROAM Club, balances, and the ledger.
- To arrange bookings with suppliers and let your account manager act on your instructions.
- To process payments and send confirmations.
- To meet legal, tax, and accounting obligations.
- To prevent fraud and misuse of the service.
4. Legal bases
We rely on contract performance for account and booking data, legal obligation for records we must keep, legitimate interests for security and fraud prevention, and consent where we ask for it (for example, the Club application checkbox).
5. Who we share it with
- Rental suppliers — the details needed to make and manage your booking.
- Stripe — to process payments and handle refunds.
- Our authentication provider — to create and secure your account.
- Our email provider — to send confirmations, payment links, and booking updates.
- Authorities — where the law requires it.
We do not sell your personal data.
6. How long we keep it
We keep account and booking data for as long as your account is active and for the period needed to meet legal and accounting obligations afterwards. Document numbers are kept only as long as needed for the booking and any legal requirement. You can ask us to delete data we are not required to keep.
7. Security
Access to member data is restricted. Our database uses row-level security so members can only read their own records, and administrative access is limited to authorised admins. Payments are handled by Stripe. We use HTTPS across the site.
8. Your rights
- Access a copy of your personal data.
- Correct inaccurate data.
- Ask us to delete data we are not legally required to keep.
- Object to or restrict certain processing.
- Receive your data in a portable format.
- Withdraw consent where processing is based on consent.
- Complain to your local data protection authority.
To exercise any of these rights, contact us through the contact form on the site.
9. Cookies and local storage
We use browser storage to remember your language choice and to keep you signed in. We do not use advertising cookies. Third-party booking widgets may set their own cookies under their own policies.
10. Changes
We may update this policy from time to time. The date at the top shows the latest version. Material changes will be communicated through the site or by email.