How ROAMVUE handles your data.

ROAMVUE is the brand that operates www.roamvue.com. The site is hosted and served by Vercel Inc. For the purposes of this policy, ROAMVUE is the data controller for the data described here.

Correspondence: ROAMVUE, via support@roamvue.com
Enquiries and rights requests: support@roamvue.com. It is the only mailbox we monitor, for every kind of request.

The brand ROAMVUE is operated by ROAMVUE. Our contact address is ROAMVUE, via support@roamvue.com.

We have not appointed a representative in the European Union. If you are in the EU and want to make a request under section 9, email us at the address above and we will deal with it directly.

Where the GDPR or the UK GDPR applies, we rely on these legal bases:

• Consent (Art. 6(1)(a)) — for the newsletter, and analytics if you accept them.
• Contract (Art. 6(1)(b)) — for your account and your wishlist.
• Legitimate interests (Art. 6(1)(f)) — for answering your support messages and keeping the site secure.
• Legal obligation (Art. 6(1)(c)) — for tax, accounting and consumer-protection records for orders you place.

We collect the following, and nothing else:

• Your email address, and optionally your first name — only if you subscribe to the newsletter. It is used to send the newsletter. We do not sell or rent it, and it is not passed to anyone for advertising.
• A one-way hash of your password — only if you sign up with an email address and a password. We never see or store the password itself, only a hash that cannot be reversed back into it.
• The sign-in tokens Google issues — only if you sign in with Google. They are used to keep you signed in.
• Your name and email address — only if you create an ROAMVUE account. Your name comes from the sign-in provider you chose, or from what you type at signup. You can change it on your profile page.
• Your profile preferences — if you fill them in, we store your riding level, your bike type and a free-text location. These are optional and you can leave them blank.
• A list of product slugs — the items you add to your wishlist.
• What you type into the support form — your name, email, any order number you choose to include, and the message. It is emailed to our support mailbox so we can reply to you. It is not written to the database.
• Order details, if you buy something — see section 3.
• Aggregate page-view counts — if you accept analytics, described in section 5.
• Technical information in our server logs — such as an IP address and a browser identifier, kept by our hosting provider for security and to keep the site running. This is not used to identify you.

We never see or store your payment card number. Card details are handled entirely by Amazon and never reach us.

ROAMVUE is the brand that makes these products, and ROAMVUE is the seller named on the Amazon listings for them. Amazon provides the storefront, takes the payment and, for these items, ships them from its own fulfilment network. When you buy one of these products, your contract is with ROAMVUE, and Amazon operates the shop you buy it in.

Because we are the seller on those listings, Amazon shares the order details with us in order to run the order - the buyer name, the delivery address, the items, and the order status. We receive them in our Amazon seller account. We use them to fulfil, to handle a return or a warranty claim, and to meet our legal obligations as the seller. We do not use them for advertising, and we do not pass them to anyone else.

Those order records live in Amazon's systems and in the reports Amazon gives us, not in this site's database.

Account records and wishlists are stored in a PostgreSQL database provided by Neon, operating in the AWS us-east-1 region. Newsletter contacts are stored with Resend. Support messages arrive in our support mailbox.

• Newsletter email — used to send the newsletter and nothing else. Every email contains an unsubscribe link.
• Account data — used to keep you signed in and to show your wishlist and profile.
• Support messages — used to reply to you and to keep a record of the exchange.
• Order details — used to fulfil, to handle returns and warranty claims, and to meet our tax and accounting obligations.
• Aggregate counts — used to see which pages people read and which links get clicked, so we can fix what is broken.

We share only what is needed, with these providers:

• Vercel Inc. — hosting, edge network and serverless runtime.
• Neon — the PostgreSQL database holding accounts and wishlists.
• Resend — newsletter delivery, unsubscribe handling, and delivering your support message to us.
• Amazon.com, Inc. — the storefront where purchases happen, the payment processing, and, for the products we sell, the order and delivery information described in section 3.
• Google — sign-in, when you choose Google as your sign-in provider. Google receives the request and returns the profile information you consent to share.
• Plausible Analytics — cookieless aggregate page-view counts.

We do not sell, rent or trade personal data, and we do not share it for advertising purposes.

The database and the hosting are in the United States. The newsletter provider processes email in the United States as well. Amazon processes orders under its own data policy, which is published on amazon.com.

If you use the site from elsewhere, your data is transferred to the United States in order to be processed. Those transfers are made under the transfer mechanisms each provider operates under, which they publish in their own terms and data policies. If you want the specific mechanism that covers your data, ask us and we will point you at the right document.

If you are in the EU, the UK, Switzerland or California, the following apply to you. Where they apply, we will act on a request without asking you for unnecessary proof, and we will not charge you for it.

• Access — ask us what personal data we hold about you, and for a copy of it.
• Rectification — ask us to correct anything that is wrong. You can do most of this yourself on your profile page.
• Erasure — ask us to delete your data. Write to us and we will confirm which account it belongs to, then delete it. If you have a newsletter subscription, we remove that too.
• Restriction and portability — ask us to pause the use of your data, or to hand it to you in a machine-readable format.
• Objection — ask us to stop using your data for a particular purpose, including profiling.
• Withdraw consent — you can withdraw analytics consent at any time. Use the Cookie settings link in the footer, which brings the banner back so you can switch to "Essential only", or clear your browser storage for this site. Either way the analytics request stops.
• Complain — you can complain to your local data protection authority. In the EU that is the authority in the country where you live or work; in the UK it is the Information Commissioner's Office.

We answer requests within 30 days. If a request is complex or there are many of them we may need a little longer, and we will tell you if that happens.

California specifically. If you are a California resident you can ask us for the categories of personal information we hold about you, the sources it came from, the purposes we use it for, and the categories of third parties we have disclosed it to. You can ask us to delete it or to correct it. You can ask us to stop selling or sharing your personal information, and to limit the use of sensitive personal information, where those rights apply to you.

We do not sell your personal information and we do not share it for cross-context behavioural advertising, so there is nothing for a "Do Not Sell or Share My Personal Information" link to switch off. We have not used or disclosed sensitive personal information for any purpose that needs your right to limit. We do not recognise opt-out preference signals, because there is nothing for them to switch off.

Make any of these requests by emailing support@roamvue.com. California law allows us 45 days to answer a request, and the 30 days we commit to above is the deadline we set for ourselves under the GDPR and the UK GDPR - it is the shorter of the two. You can also complain to the California Privacy Protection Agency at cppa.ca.gov.

This site is a cycling hardware brand and is not directed at children. We do not knowingly collect data from anyone under 16, and you must be at least 16 to create an account or subscribe. The site does not ask for your date of birth, so this age requirement is a condition of use that you confirm when you create an account or subscribe, not something we are able to check for you. If you believe a child has sent us data, write to us and we will remove it.

Account data and wishlists are kept while your account exists and are deleted when you ask us to delete it. Newsletter subscriptions are kept until you unsubscribe. Support messages are kept for as long as we need the history to resolve the matter and to handle any follow-up. Order records are kept for as long as our tax and accounting obligations require.

We may update this page as the site changes. The effective date at the top always reflects the current version, and continuing to use the site after an update means you accept the version then in effect. If a change is material, we will email newsletter subscribers before it takes effect.

Email support@roamvue.com with questions about this policy or to make a request under section 9. It is the only mailbox we monitor.