Legal

Privacy Policy

Last updated August 16, 2026

ROAI ("we," "us") is an AI ROI advisory firm. This policy explains what data we collect through roai.us, why, how long we keep it, and how to exercise your rights over it.

What we collect and why

Form submissions. When you fill out a contact, consultation, or newsletter form, we collect what you enter: name, email, company, job title, and the message content. We use it to respond to your request and, if you sign up, to send the newsletter you asked for.

Analytics. We use Google Analytics 4 to understand which pages get read and which paths lead to a conversation. Analytics cookies are set only after you accept them in the consent banner. See our Cookie Policy for the full list of cookies and their lifetimes.

Tool inputs. The ROI calculator, maturity assessment, and model selector on this site run entirely from what you type in. You can use every one of them anonymously, without signing in. If you choose to email yourself a copy of your results, we store the inputs you provided, tied to the email address you gave us for that purpose.

Google sign-in. If you create an account, sign-in is handled by Google. We receive your name, email address, profile picture, and a stable account identifier from Google. We request nothing else, and we never post on your behalf or access any other Google data.

Purchases. If you buy a research paper or subscribe, Stripe handles your payment details directly. We never see or store your card number. We store the purchase or subscription record itself: what was bought, when, and its status.

Processing activity	Legal basis
Responding to a contact or consultation request	Legitimate interest in answering your inquiry
Site analytics	Consent (Consent Mode v2, denied by default)
Sending the newsletter	Consent (you opt in and can unsubscribe from every issue)
Fulfilling a purchase or subscription	Contract
Financial record-keeping after a purchase	Legal obligation

How long we keep data

Data	Retention
Leads (form submissions)	Until you unsubscribe, plus 30 days, or on request
Consultation requests	7 years (business record)
Account (Google sign-in)	Until account deletion, plus 30 days
Sessions	Until they expire; purged daily
Purchases and subscriptions	7 years, for financial record-keeping obligations. Pseudonymized on account deletion rather than deleted outright
Paper download log	24 months, then reduced to a hashed identifier only
Anonymous tool inputs (ROI calculator, assessment)	12 months
Form submission audit log	90 days, then hard-deleted
Hashed IP addresses	90 days
Analytics data (Google Analytics 4)	14 months

The 7-year retention on purchases and subscriptions is an exception to the right to erasure under GDPR Article 17(3)(b): compliance with a legal obligation. We flag this again in the account-deletion confirmation, so it is never a surprise at the moment you ask us to delete your data.

Who processes your data

We work with the following processors, each bound by a data processing agreement where required:

Processor	Role
Vercel	Hosting, and private storage for research paper files
Neon	Database
Google	Sign-in (OAuth) and Analytics
Stripe	Payment processing
Resend	Transactional and newsletter email
Cloudflare	Bot mitigation on our forms
Upstash	Rate limiting

International transfers

We and our processors operate primarily in the United States and the European Union. Where personal data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses or an equivalent adequacy mechanism with each processor.

Downloaded research papers

If you download a research paper, the PDF is watermarked with your name, email address, and the download date on every page, and the download itself is logged. This is how we protect the work our team produces while still making it easy to read on your own devices. It is not used to track you elsewhere.

Your rights

Under GDPR, UK GDPR, and comparable laws, you can ask us to:

Access the data we hold about you
Correct it, if it's wrong
Erase it, subject to the financial-record exception above
Export it in a portable format
Object to processing based on legitimate interest

To exercise any of these, email privacy@roai.us. We respond within 30 days.