Privacy Policy

Last updated: October 23, 2026

RomAIx BV respects your privacy. This page says what personal data we handle, why, for how long, and what you can ask of us. The first part is about this website. The second part is about the RomAIx GEO platform, for people who have an account there.

Who we are

RomAIx BV is responsible for the data described here (the “controller”). It is a Dutch private limited company, registered with the Chamber of Commerce under KvK 94705771, VAT NL866865676B01.

General contact: info@romaix.ai

Privacy questions and requests: privacy@romaix.ai

Part 1: this website

The forms

When you fill in a form on this site (the idea form, the scan request, the contact page) you give us what you type: what you would like fixed, your name, your phone number if you add it, your website and your email address. We save your message in our database in Frankfurt (Supabase) and email it to our mailbox, info@romaix.ai, through Resend (resend.com), the service that also sends you our confirmation. If Resend cannot be reached, your message goes through FormSubmit (formsubmit.co) instead, a form service that passes it on to the same mailbox.

We use it to answer you and, if you asked for one, to carry out the free scan or audit. The legal basis is that we take steps at your request before a possible contract (GDPR article 6(1)(b)), and for later contact about the same request our legitimate interest in following it up (article 6(1)(f)). We keep this correspondence for 2 years after the last contact.

When you send a form, it also carries a short record of your visit: how long you have been on the site, which pages you opened and which of our free tools you used. Your browser keeps this record while you browse (the tools you used are remembered on your device so we can suggest the others), and it reaches us only together with a form you choose to send. We use it to understand your question better before we answer. Without a form, it never leaves your device.

Booking a call (Calendly)

The booking calendar is provided by Calendly LLC, a company in the United States. It is only fetched from Calendly when you press “Show the calendar” or “Book a call”, or, once you have pressed Accept in the cookie bar, when you scroll to the calendar. When you pick a time, your name, email address and anything you add go to Calendly, which handles the booking for us and uses its own cookies.

In the calendar that is set into our pages we have switched off Calendly’s cookie notice, because it covered the calendar. Calendly’s privacy notice applies to what Calendly does with your data and names the safeguards it uses for transfers outside the EU. We keep bookings for 2 years after the last contact.

The content calendar tool

You type a web address. We read the public pages of that website and send their text to Anthropic, an AI provider in the United States, which writes the content plan. You give your name and email address: we email you your first week of posts, may follow up once, and keep them the way we keep a form you send us.

• The finished plan is kept for that web address for 30 days, so a second request is answered from the saved copy.
• To stop abuse we count requests per IP address. That count is kept for one hour.
• When the human check is switched on, Cloudflare Turnstile checks that a person is making the request. It uses your IP address to do so.

The legal basis is our legitimate interest in offering the tool and protecting it against abuse (article 6(1)(f)).

The website assistant

The chat window on this site is an AI assistant. When you type a question, the conversation so far and the page you are reading are sent to Anthropic, an AI provider in the United States, which writes the answer. Please do not type sensitive personal information into it.

• We store the conversation in a database in Frankfurt (Supabase), with a few facts about the visit: the page you started on, where you came from, your language, type of device, country, and whether you visited before. We use it to read chats back, improve the assistant, and pick up when you ask for a person. It is deleted after 12 months, or sooner if you ask. A copy is also kept in your own browser (local storage), so the chat carries on when you open another page.
• If you ask to talk to a person, someone from our team can join the chat and write to you. The alert on our phone (Pushover) shows your last few questions and which page you are on, with any email address or phone number taken out. If you choose a call, it runs directly between your browser and ours and is not recorded; to connect, your browser contacts a Cloudflare or Google server that only sees your IP address. If you leave before a reply from the team reaches you and you gave us your email address, we email you that reply.
• If you give us your email address in a chat or a form, we link your chats to it, so our team sees your earlier conversations together, including those from another device. Chats from the same browser are linked through a random ID kept in its local storage. For the team, Anthropic (see above) writes an AI summary of those chats; it is stored with the chats and deleted with them.
• To stop abuse we count questions per IP address. That count is kept for one hour.
• If you send the contact or call-back form inside the chat, what you fill in and the conversation are emailed to us, like the other forms.

The legal basis is our legitimate interest in answering visitors’ questions and protecting the service against abuse (article 6(1)(f)).

Hosting and logs

The site is hosted by Vercel Inc., a company in the United States; the parts that answer forms, run the free tools and the assistant run on its servers in Frankfurt, Germany. Like any web server it uses your IP address and browser type to deliver the pages, and keeps short-lived logs for security and fault-finding.

To stop the free tools and forms being misused, we count how often one connection uses them within an hour. The count is kept in a database in Frankfurt (Upstash); your IP address is stored only as a scrambled code that cannot be turned back into the address, and the count is deleted after an hour. Before the content calendar tool writes a plan, Cloudflare Turnstile checks that a person pressed the button: your browser loads a small script from Cloudflare and shares technical details of the visit with it, such as your IP address. The legal basis is our legitimate interest in protecting the service against abuse (article 6(1)(f)).

The animated demo

The animated demo of the content engine loads its typeface from Google Fonts. When it plays, your browser contacts Google and passes your IP address.

Cookies and your browser

We set no advertising cookies on this website. The site keeps a few preferences in your browser’s local storage, such as light or dark colours, whether you closed the pop-up and your answer in the cookie bar. They stay on your device and are not sent to us.

We count visits with Google Analytics, a service of Google, but only after you press Accept in the cookie bar. It tells us which pages and posts bring people here. Google Analytics does not store your IP address, and we do not use it for advertising. The legal basis is your consent (GDPR, article 6.1.a), which you can withdraw at any time under “Cookie settings” at the bottom of every page. The cookies it sets are listed in the cookie policy.

Who receives your data

Only the companies that help us run the site, each for its own part: Calendly (bookings), Vercel (hosting), Anthropic (the website assistant and the content calendar tool), Supabase (the assistant’s conversations and the messages you send through a form, stored in Frankfurt), Pushover (the alert on our phone), Resend (our emails to you: the confirmation of a form, a guide you asked for, a reply you missed; and your form message to our mailbox), FormSubmit (form messages, only when Resend cannot be reached), Cloudflare (the human check), Upstash (the short-lived usage counts, in Frankfurt) and Google (our email, the demo’s typeface, and Google Analytics if you accept). We do not sell personal data.

Your rights

You can ask us to show, correct or delete your data, to limit or stop its use, or to hand it to you in a usable file. You can withdraw a consent you gave. Email privacy@romaix.ai. We answer within four weeks. The steps for deletion are on the data deletion page.

You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Part 2: the RomAIx GEO platform

At RomAIx BV, we value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you interact with our website and services. Please read it carefully to understand your rights and how we handle your data.

1. Personal Data We Process

RomAIx BV processes your personal data because you use our services and/or because you provide this data to us. Below is an overview of the personal data we process:

• First and last name
• Address details
• Phone number
• Email address
• IP address
• Other personal data that you actively provide, for example, by creating a profile on this website, through correspondence, and by telephone
• Location data
• Data about your activities on our website
• List of customer contact details via an app
• Internet browser and device type
• Bank account number

OAuth access tokens and refresh tokens for third-party platforms you connect (Google, LinkedIn, Meta, your CMS)

• Search analytics data (clicks, impressions, queries, pages) from Google Search Console properties you authorize
• Website analytics from Google Analytics 4 properties you authorize

Content you create in RomAIx GEO (article drafts, social posts, scheduled publishes)

• Engagement metrics on your published posts (likes, comments, shares) returned by connected platforms

2. Special and/or Sensitive Personal Data We Process

Our website and/or service does not intend to collect data about website visitors who are under 16 years of age, unless they have parental or guardian consent. However, we cannot verify the age of a visitor. We encourage parents to be involved in the online activities of their children to prevent the collection of data about children without parental consent. If you believe that we have collected personal data about a minor without such consent, please contact us at privacy@romaix.ai, and we will delete that information.

3. Purpose and Legal Basis for Processing Personal Data

RomAIx BV processes your personal data for the following purposes:

• To process your payment
• To send our newsletter and/or advertising materials
• To contact you by phone or email if necessary to perform our services
• To inform you about changes to our services and products
• To offer you the possibility to create an account
• To deliver goods and services to you
• RomAIx BV analyzes your behavior on the website to improve the website and tailor the offerings of products and services to your preferences

RomAIx BV also processes personal data if we are legally obliged to do so, such as data required for our tax filings.

• To publish content to third-party platforms (your CMS, LinkedIn, Meta) on your explicit instruction
• To fetch and display search and traffic analytics from Google Search Console and Google Analytics 4 properties you have authorized
• To use third-party AI providers (Anthropic, OpenAI, Replicate, Perplexity) to generate article drafts and analytical reports

4. Automated Decision-Making

RomAIx BV does not make decisions that have significant consequences for individuals solely based on automated processing. While we use automation to streamline certain processes, all final decisions involving your personal data are made by humans. Automation assists in processing data, but a RomAIx BV employee always reviews and makes the definitive decision.

5. Data Retention Periods

RomAIx BV will not retain your personal data longer than strictly necessary to achieve the purposes for which it was collected. We apply the following retention periods by category:

Account data (name, email, login credentials): for the duration of your active subscription, plus 30 days after account closure.

Billing and invoice data: 7 years, as required by Dutch tax law (Algemene wet inzake rijksbelastingen, art. 52).

Content you create in RomAIx GEO (articles, posts, scheduled publishes): for the duration of your active subscription. Deleted on account closure.

OAuth credentials for connected third-party platforms: until you disconnect the integration or close your account. Deleted immediately upon disconnect.

Analytics data (Google Search Console snapshots, post engagement metrics): up to 24 months rolling, then auto-pruned. LinkedIn Company Page analytics are retained within LinkedIn’s stricter limits: up to 12 months for page reporting and up to 6 months for organization social activity.

Marketing communication data (newsletter signups, ad analytics): until you unsubscribe or 24 months of inactivity, whichever is sooner.

Support correspondence: 2 years after the last interaction.

6. Sharing Personal Data with Third Parties

RomAIx BV only provides data to third parties if this is necessary for the execution of our agreement with you or to comply with a legal obligation.

7. Third-Party Platform Integrations

RomAIx GEO, operated by RomAIx BV (KvK 94705771, VAT NL866865676B01), integrates with the following third-party platforms when you explicitly connect them. We act as data controller for the data you provide directly to us; the third parties below act as data controllers for data you provide to them, and as data processors when handling data on your behalf via API calls we make on your instruction.

Search analytics and publishing:

• Google Search Console: to read your search performance data
• Google Analytics 4: to read your website analytics
• WordPress (.org and .com): to publish blog articles you author
• Webflow: to publish blog articles you author
• Shopify: to publish blog articles you author
• Wix: to publish blog articles you author
• Framer: to publish blog articles you author

Social publishing and engagement:

• LinkedIn: to publish posts to your personal profile and (with separate authorization) to LinkedIn Company Pages
• Meta (Facebook, Instagram, Threads): to publish posts to your connected Facebook Pages, Instagram Business accounts, and Threads accounts

Content generation and analysis:

• Anthropic (Claude): to generate article drafts and analytical reports
• OpenAI: for selected text and image generation tasks
• Replicate: for image generation tasks
• Perplexity: for AI search citation tracking

Payments:

• Stripe: for subscription billing and payment processing

We do not sell your data. We do not share your data with third parties beyond what is necessary to deliver the service you have explicitly connected. You can disconnect any integration at any time from your RomAIx GEO settings; doing so revokes our access immediately.

7.1 Scope of Access: what we will and will not do

When you connect a third-party platform to RomAIx GEO, we request the narrowest set of permissions (OAuth scopes) needed for the specific feature you use. We do not request, store, or use any access beyond what you explicitly authorize. Specifically:

Google Search Console and Google Analytics 4: read-only access. We cannot submit sitemaps, modify properties, change settings, or write anything back to your Google account.

RomAIx GEO’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Your CMS (WordPress, Webflow, Shopify, Wix, Framer): permission to read your site metadata and to create, update, or unpublish blog articles you have authored inside RomAIx GEO. We never delete content we did not create, modify unrelated pages or templates, or access customer, order, payment, or admin data outside the blog feature.

Social platforms (LinkedIn, Meta): permission to publish posts you have explicitly approved in RomAIx GEO, and to read engagement metrics on those specific posts. We do not read your direct messages, your contacts list, other Pages you manage outside the ones you connected, your followers’ personal data, or any content you did not create through RomAIx GEO.

No automated publishing. Every article and post that RomAIx GEO publishes has been explicitly reviewed and approved by you in our editor. We do not auto-publish, auto-comment, or auto-engage without your direct click.

Each integration is isolated. Your Google data is not shared with Meta, your Meta data is not shared with LinkedIn, and so on. We never grant a third party access to your data on another platform.

You can revoke any integration at any time from your RomAIx GEO Settings or directly via the platform’s own security page (see Section 12). Revocation is immediate and stops all future API calls.

7.2 Data of people who engage with your connected LinkedIn Company Pages

When you connect a LinkedIn Company Page, RomAIx GEO may display comments and reactions that LinkedIn members leave on the posts you publish through us, so that you can moderate them. We handle this member data as follows:

Comments are fetched live from LinkedIn for moderation and are never stored in our systems.

We display the comment text with a generic “LinkedIn member” label only. We do not display or store the commenter’s name, photo, or profile.

Post analytics (impressions, reach, reactions, and comments) are shown as aggregate counts only. We do not store the identities of the members who engaged.

We never use this data for advertising, sales, or CRM.

8. Cookies or Similar Technologies We Use

RomAIx GEO, operated by RomAIx BV, only uses technical and functional cookies and analytical cookies that do not infringe on your privacy.

A cookie is a small text file stored on your computer, tablet, or smartphone when you first visit this website. The cookies we use are necessary for the technical operation of the website and for your ease of use. They ensure the website functions properly and, for example, remember your preferred settings. We may also use cookies to optimize our website.

You can opt out of cookies by configuring your internet browser to stop storing them. You can also delete all previously stored cookies via your browser settings.

9. Accessing, Modifying, or Deleting Data

You have the right to access, correct, or delete your personal data. Additionally, you have the right to withdraw your consent for data processing or to object to the processing of your personal data by RomAIx BV, and you have the right to data portability. This means that you can submit a request to us to send the personal data we hold about you in a computer file to you or another organization specified by you. You can send a request for access, correction, deletion, data transfer, withdrawal of consent, or objection to the processing of your personal data to privacy@romaix.ai. To ensure that the request for access was made by you, we ask that you include a copy of your identity document with the request. Make sure to black out your photo, MRZ (machine-readable zone, the strip with numbers at the bottom of the passport), passport number, and Citizen Service Number (BSN) to protect your privacy. We will respond to your request as quickly as possible, but within four weeks. RomAIx BV also wishes to inform you that you have the right to file a complaint with the national supervisory authority, the Dutch Data Protection Authority. You can do so here.

10. How We Secure Personal Data

RomAIx BV takes the protection of your data seriously and takes appropriate measures to prevent misuse, loss, unauthorized access, unwanted disclosure, and unauthorized modification. If you believe that your data is not properly secured or there are indications of misuse, please contact our customer service or via privacy@romaix.ai.

11. Contact Information

• If you have any questions or concerns regarding this Privacy Policy, please contact us at privacy@romaix.ai

Data Controller: RomAIx BV (Dutch BV, KvK 94705771, VAT NL866865676B01). Operator of the RomAIx GEO platform.

12. Data Deletion

To request deletion of your personal data, you have three options:

Self-service: disconnect any integration immediately. RomAIx GEO’s Settings page lets you disconnect any connected third-party platform (LinkedIn, Google, Meta, your CMS) with a single click. This revokes our access token and stops new data being collected from that platform immediately. Historical data already stored in RomAIx GEO remains until you delete your account.

Full account deletion. Email privacy@romaix.ai with the subject line “Data Deletion Request” and include the email address you signed up with. We process deletion requests within 30 days as required by GDPR Article 17.

Platform-side revocation. If you connected via Facebook or Instagram, you can also revoke our access from Facebook: Settings > Privacy > Apps and Websites > remove RomAIx GEO. For Google: myaccount.google.com > Security > Third-party apps with account access. For LinkedIn: account Settings > Data privacy > Permitted services.

For the full process of data access, correction, transfer, and the right to object, see Section 9 above.