Privacy

Short version: we hold your email, your uploads, and the tours made from them. We do not sell anything, we do not track you across the web, and you can have all of it deleted by sending one email.

What we collect

• Your email address. It is how you sign in — there is no password. We use it to send you a sign-in link and to tell you when a tour is ready.
• What you upload. Photographs or video of the spaces you want turned into tours.
• What you type in. The name and location of a space, your business name, logo, phone number and website, if you choose to add them. Anything you put in your branding settings appears publicly on the tours you share.
• Generated tours and their assets.
• Delivery and viewing records. We record when a signed-in owner first loads a finished tour, which generation loaded, and email-provider receipt IDs so we can check delivery and help with problems. We also keep a public tour view count. These records do not prove that someone read an email or approved a tour. Infrastructure providers may retain technical request logs, including IP addresses, for operation and security.
• Billing records. Which plan you are on and what you have bought. Card details go directly to Stripe; we never receive them.

There is no analytics script, no advertising pixel, and no third-party tracker on this site. We do not build a profile of you.

Who else touches it

Running this requires a few companies. Each one gets only what it needs:

• World Labs — receives the photographs you upload, in order to generate the tour. It also receives uploaded video when you choose that input.
• Supabase — the database and file storage. Holds your account, uploads and tours.
• Vercel — hosts and serves the site, and renders social videos from generated tour assets in isolated compute jobs.
• Stripe — takes payments. Receives your email and card details directly; we get back only a customer reference and what you paid.
• Resend — delivers tour-ready notifications when configured. Sign-in links are sent through Supabase Auth and its configured email provider.

Nobody else. We do not sell or share your data for advertising, ever.

Who can see your tours

A tour is unlisted, not secret. It is not indexed and not listed anywhere public, but anyone with the link can open it while sharing is enabled. The share page may include source photos and the details you add. Turning sharing off disables the share page and embed; it does not revoke downloaded files or previously shared direct asset URLs. Contact support to request asset deletion.

The photo strip on a share page uses temporary signed links that expire, so your original uploads are not permanently public.

Cookies

Essential authentication cookies keep you signed in. It is necessary for the service to work and is not used for tracking or advertising. They support account access.

How long we keep it

Your uploads and tours stay until you delete them or close your account. Billing records are kept as long as tax law requires. Deleting a database record does not immediately remove cached copies or backups. Contact support for an asset deletion request.

Your rights

You can ask for a copy of everything we hold about you, ask us to correct it, or ask us to delete all of it. Email micky@strikingventures.com and we will do it within 30 days. You do not need to give a reason.

If you are in the UK or EU, you also have the right to complain to your data protection authority — in the UK, the ICO. We would rather you told us first so we can fix it.

Security

Everything travels over HTTPS. Your uploads sit in a private storage bucket that only your own account and the service can access. Published share pages can provide temporary access to source photos. Generated assets are served from public storage so tours can load on your website. Database access is restricted per-account at the database itself, not merely in application code, alongside application access checks.

No system is perfect. If you find a security problem, please tell us at micky@strikingventures.com before telling anyone else, and we will fix it and credit you.

Contact

Roam is operated by Striking Ventures LLC.

micky@strikingventures.com — for any question about this page, or any request under it.