Privacy Policy

Summary of Key Points

Table of Contents

1. 1.What Information Do We Collect?
2. 2.How Do We Process Your Information?
3. 3.What Legal Bases Do We Rely On?
4. 4.When and With Whom Do We Share Your Information?
5. 5.Do We Use Cookies and Tracking Technologies?
6. 6.Do We Offer AI-Based Products?
7. 7.Is Your Information Transferred Internationally?
8. 8.How Long Do We Keep Your Information?
9. 9.How Do We Keep Your Information Safe?
10. 10.Do We Collect Information From Minors?
11. 11.What Are Your Privacy Rights?
12. 12.Controls for Do-Not-Track Features
13. 13.Do United States Residents Have Specific Privacy Rights?
14. 14.Do Other Regions Have Specific Privacy Rights?
15. 15.Nature of Service
16. 16.Do We Make Updates to This Notice?
17. 17.How Can You Contact Us About This Notice?
18. 18.How Can You Review, Update, or Delete Your Data?

Personal information you provide

We collect personal information you voluntarily provide when you register, use the service, or contact us. This includes:

• Names (you may use a nickname — you do not need to use your real name)
• Email addresses (used for magic link authentication)
• Contact or authentication data (magic link tokens)
• Onboarding responses: gender, cultural and religious background, location, generation, family traditionalism, and relationship situation

Sensitive information

With your consent, and as necessary to provide the service, we process:

• Information revealing racial or ethnic origin (from background and generation questions)
• Information revealing religious or philosophical beliefs (from background question)

Information collected automatically

When you use the service, we automatically collect certain technical information. This does not identify you personally but includes:

• Log and usage data — IP address, browser type, device settings, pages viewed, and timestamps
• Device data — device type, operating system, browser model, and internet service provider
• Location data — approximate location based on your IP address, used for displaying relevant crisis support resources

We also collect information through cookies and similar technologies — see Section 5 for details.

We process your information for the following purposes:

• To create and manage your account — so you can sign in and keep your account in working order
• To deliver the coaching service — to provide you with AI coaching conversations and remember context across sessions
• To respond to inquiries — to reply to support requests via hello@ or privacy@roohraah.com
• To send administrative information — magic link emails, terms or policy updates
• To protect our services — fraud monitoring and security
• To identify usage trends — to understand how the service is used and improve it
• User safety monitoring — to detect crisis situations within coaching conversations and provide appropriate emergency resources
• To protect vital interests — when necessary to prevent harm to you or others

If you are in the EU or UK

The GDPR and UK GDPR require us to explain our legal bases for processing your information:

• Consent — where you have given us permission to process your information for a specific purpose. You may withdraw consent at any time by contacting privacy@roohraah.com.
• Performance of a contract — to provide you with the coaching service you have signed up for
• Legitimate interests — to analyse service usage, prevent fraud, and protect the safety and wellbeing of users who may be in distress
• Legal obligations — to comply with applicable laws
• Vital interests — to protect your safety or the safety of others in urgent situations

Because we process special category data (religious beliefs, racial/ethnic origin), consent is the legal basis for that specific processing. You provide this consent by accepting our terms at onboarding.

If you are in Canada

We process your information with your express or implied consent, which you may withdraw at any time. In some limited cases, applicable law may permit processing without consent (such as fraud investigation or legal compliance).

We share your data only with third-party service providers who perform services on our behalf. We disclose information only — we never sell it.

We may also share your information in connection with a merger, sale, or acquisition of our business, or when required by law.

We have not sold or shared any personal information to third parties for commercial purposes in the preceding 12 months.

We use cookies and similar tracking technologies to maintain the security and operation of our services. Supabase uses cookies for session management (to keep you signed in), and Vercel sets cookies as part of normal web infrastructure operation.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. You can set your browser to reject cookies, though this may affect your ability to sign in to the service.

For full details, see our Cookie Policy.

Yes. Rooh Raah's coaching conversations are powered by artificial intelligence. We provide this through Anthropic's Claude API.

When you send a message to a coach, your input is transmitted to Anthropic for processing and a response is returned. Your coaching conversations, onboarding context, and session memory are used to personalise your experience.

Our AI products are designed for:

• Conversational AI coaching (AI bots)
• Natural language processing of your messages

All personal information processed through our AI products is handled in accordance with this policy and our agreement with Anthropic. You must not use the service in any way that violates Anthropic's usage policies.

To opt out of AI processing, you may request account deletion by emailing privacy@roohraah.com.

Our servers are located in the United Kingdom (Supabase) and the United States (Vercel, Anthropic, Resend). When you use Rooh Raah, your data may be transferred to and processed in the United States.

If you are located in the EEA or UK, these countries may not have data protection laws as comprehensive as your own. However, we have implemented appropriate safeguards. Where we transfer personal data internationally, we rely on the European Commission's Standard Contractual Clauses (SCCs). Our third-party service providers (Anthropic, Vercel, Supabase, Resend) each operate under their own SCCs or equivalent mechanisms for international transfers. Details of these safeguards are available upon request at privacy@roohraah.com.

We keep your personal information for as long as you have an account with us. Your coaching memory, journal summaries, and onboarding data are retained to provide continuity across sessions — this is core to the service.

When you request account deletion, we will delete or anonymise your personal information from our active databases. We may retain some information in our files to prevent fraud, troubleshoot problems, enforce our terms, or comply with legal requirements.

To request deletion, email privacy@roohraah.com.

We have implemented appropriate technical and organisational security measures, including:

• Row Level Security (RLS) enabled on all database tables in Supabase
• Server-side API keys — all sensitive credentials are never exposed to the client
• Data stored in Supabase's UK (London) region
• Magic link authentication — no passwords stored

No electronic transmission over the internet or storage technology can be guaranteed to be 100% secure. While we do our best to protect your information, transmission to and from our services is at your own risk.

In the event of a data breach affecting EU or UK users, we are obligated to notify the relevant data protection authority within 72 hours.

Rooh Raah is intended for users who are 18 years of age or older. We do not knowingly collect personal information from users under the age of 18. If you are under 18, please do not use this service.

If you believe we have inadvertently collected information from a user under 18, please contact us at privacy@roohraah.com and we will delete it promptly.

Depending on where you are located, you may have the following rights regarding your personal information:

• Right to access — request a copy of the personal information we hold about you
• Right to rectification — request correction of inaccurate information
• Right to erasure — request deletion of your personal information
• Right to restrict processing — request that we limit how we use your information
• Right to data portability — receive your data in a structured, machine-readable format
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, email privacy@roohraah.com. We will respond in accordance with applicable data protection law.

If you are in the UK and believe we are unlawfully processing your information, you may complain to the Information Commissioner's Office (ICO).

If you are in the EEA, you may contact your local data protection authority.

Most web browsers include a Do-Not-Track (DNT) feature. There is currently no uniform technology standard for recognising and implementing DNT signals. We do not currently respond to DNT browser signals. If a standard is adopted in the future, we will update this policy accordingly.

California law requires us to disclose how we respond to DNT signals. As no industry standard exists, we do not respond to them at this time.

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to, correct, or delete the personal information we hold about you, and to withdraw your consent to our processing. These rights may be limited by applicable law.

Categories of personal information collected

Your rights

• Right to know whether we process your personal data
• Right to access your personal data
• Right to correct inaccuracies
• Right to request deletion
• Right to obtain a copy of data previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of targeted advertising, sale of data, or profiling (we do not engage in any of these)

How to exercise your rights

Email privacy@roohraah.com. We will verify your identity before processing requests. You may designate an authorised agent to act on your behalf.

If we decline your request, you may appeal by emailing privacy@roohraah.com. We will respond in writing. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine the Light" Law

California residents may request information about categories of personal information disclosed to third parties for direct marketing purposes. We do not share personal information for direct marketing purposes.

Australia

We collect and process your personal information under the obligations set by Australia's Privacy Act 1988. This Privacy Policy satisfies the notice requirements of the Privacy Act.

You have the right to request access to or correction of your personal information by contacting privacy@roohraah.com. If you believe we are unlawfully processing your personal information, you may submit a complaint to the Office of the Australian Information Commissioner.

Canada

We process your information under PIPEDA and, where applicable, Quebec's Law 25. You have the right to access, correct, and request deletion of your personal information. Contact privacy@roohraah.com to exercise these rights.

If you are experiencing a mental health crisis or emergency, please contact your local emergency services or a qualified mental health professional immediately.

In the UK, you can call Samaritans on 116 123. In the US, call 988. In Canada, call 1-833-456-4566.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated date at the top of this page. If we make material changes, we may notify you by posting a notice prominently or sending you a direct notification. We encourage you to review this policy periodically.

If you have questions or comments about this policy, contact us at:

Based on applicable laws in your country or state, you may have the right to request access to, correction of, or deletion of your personal information, and to withdraw your consent to our processing.

To make a request, email privacy@roohraah.com. We will verify your identity and respond in accordance with applicable data protection law.