Privacy Policy

Last updated: October 1, 2026

1. Overview

RoomBase (“we”, “us”) operates a room booking and workspace management platform at app.roombase.cloud. This Privacy Policy describes how we collect, use, and protect your personal data when you use our Service.

2. Data We Collect

2.1 Account Data

We collect your name, email address, and profile image through our authentication provider, WorkOS AuthKit. We also store organization membership information.

2.2 Booking Data

We store booking details you create, including room selections, time slots, titles, descriptions, and guest email addresses for invitations.

2.3 Billing Data

Payment processing is handled by Stripe. We store subscription plan information, billing status, and tenant company counts, but do not store credit card numbers.

2.4 Usage Data

We log audit entries for actions taken within hubs (e.g., booking approvals, member invitations, settings changes) for administrative purposes.

3. How We Use Your Data

To provide and maintain the Service
To manage bookings, approvals, and notifications
To process payments and manage subscriptions
To send transactional emails (invitations, booking confirmations)
To provide audit logs for hub administrators
To comply with legal obligations

4. Data Storage

Your data is stored in our backend infrastructure (Convex) hosted in the EU region. Authentication data is managed by WorkOS. Payment data is managed by Stripe. Transactional emails are sent via Resend.

5. Data Sharing

We do not sell your data. We share data only with our service providers (WorkOS, Stripe, Resend) as necessary to operate the Service, and as required by law. Hub administrators can see booking data and audit logs within their hub.

6. Your Rights (GDPR)

Under the GDPR, you have the right to:

Access: Request a copy of your personal data
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data (“right to be forgotten”)
Portability: Receive your data in a machine-readable format
Objection: Object to processing of your data
Withdrawal of consent: Withdraw consent at any time

To exercise these rights, contact us at booking@roombase.cloud. Hub administrators can export hub data from the settings page.

7. Legal bases (GDPR)

We process personal data only where a legal basis under Article 6 GDPR applies, in particular: performance of a contract or steps prior to entering into a contract (Art. 6(1)(b)); compliance with legal obligations (Art. 6(1)(c)); and our legitimate interests in operating, securing, and improving the Service (Art. 6(1)(f)), balanced against your rights. Where we rely on consent (Art. 6(1)(a)), you may withdraw it at any time with effect for the future.

8. Cookies and local storage

Marketing website (https://roombase.cloud): We do not use tracking, analytics, or advertising cookies on the marketing website in the default configuration. We may store a display-theme preference (light/dark) in your browser’s local storage so the site can remember how you prefer it to look. That preference is a functional setting for presenting the website and is not used for advertising. Because non-essential cookies and similar tracking technologies are not used by default, no cookie consent banner is shown unless optional analytics is expressly enabled after updating this Privacy Policy.

App (https://app.roombase.cloud): We use essential cookies for authentication and session management via WorkOS AuthKit. Those cookies are required to provide the logged-in Service.

External links: Links to third-party services (for example Cal.com for booking a demo) leave our website. Those providers may set their own cookies under their own policies.

If we enable optional analytics in the future, we will update this section, obtain consent where required (TTDSG / ePrivacy / GDPR), and only load analytics after you accept.

9. Data Retention

We retain your data for as long as your account is active. Upon account deletion, we remove your personal data within 30 days. Booking and audit data may be retained for longer if required by law or legitimate business interests.

10. Security

We use industry-standard security measures including encrypted data transmission (TLS), secure authentication (WorkOS AuthKit), and isolated backend infrastructure (Convex). However, no method of transmission over the Internet is 100% secure.

11. Contact

Controller for RoomBase: Acta Design Solutions (see Impressum). For privacy questions or data requests, contact us at booking@roombase.cloud.