Legal

Privacy Policy

Effective date: September 4, 2026 · Last updated: September 4, 2026

This Privacy Policy describes how Roamtime collects, uses, stores and shares personal data when you use our websites, our forecast application, our API and our MCP server, and it explains the choices and rights you have. We are a small business-to-business data company. We do not run advertising, we do not sell personal data, and we collect only what the Service needs to work.

1. Interpretation and definitions

Words whose initial letter is capitalized have the meanings defined below. These definitions have the same meaning whether they appear in the singular or in the plural.

Company: Roamtime, the operator of roamtime.ai (referred to as "the Company", "We", "Us" or "Our" in this Privacy Policy).
Website: The public website at https://roamtime.ai, including the 2026 Forecast preview pages (Sites, regions and individual spot pages).
Application: The full Roamtime forecast product served at https://app.roamtime.ai to customers who sign in.
API: The Roamtime REST API and the Roamtime MCP (Model Context Protocol) server served at https://api.roamtime.ai.
Service: The Website, the Application and the API, together or individually.
Account: A customer record we create so that a named person at a customer organization can sign in to the Application, or an API key we issue to a customer.
Device: Any device that can access the Service, such as a computer, a phone or a tablet.
Personal Data: Any information that relates to an identified or identifiable individual.
Service Provider: Any natural or legal person who processes data on behalf of the Company, such as our hosting provider.
Usage Data: Data collected automatically when the Service is used, such as a page requested, a browser type, a country or an API endpoint called.
You: The individual using the Service, or the company or other legal entity on whose behalf that individual is using the Service.

2. Personal data we collect

2.1 Data you give us through the contact form or by email

When you send an enquiry through the form on the Website, or email us directly, we collect your name, your email address, your company name if you provide it, the topic you chose (sales, API, MCP or partnership) and the message you write. We also record the language the page was displayed in, the country reported by our hosting provider's network edge, and your browser's user-agent string. These help us route the enquiry and reply in the right language.

2.2 Account data for the Application

Accounts for the Application are created by us when a customer is onboarded; there is no self-service sign-up. For each Account we hold the email address used to sign in, the person's name, the customer company, the date the Account was created, the date the subscription ends (if any), an internal note, and a cryptographic hash of the standing access code. When you request a one-time sign-in code we store a hash of that code for fifteen minutes and the number of attempts made with it. When you sign in we store a hash of your session token, its creation and expiry dates and your browser's user-agent string, so that we can end sessions and detect misuse. Sign-in codes are sent to your email address from login@roamtime.ai.

2.3 API and MCP usage

When you call the API with a key we record the key identifier, the endpoint requested, the time of the request and standard request metadata (such as the requesting IP address and user agent) in our hosting provider's request logs. This is used to operate the Service, enforce usage limits, prevent abuse and account for usage under your agreement with us. Anonymous MCP requests on the free tier are logged in the same way without a key identifier. MCP clients may also send a client name and version as part of the protocol handshake.

2.4 Usage Data

Like almost every website, our hosting provider automatically records standard request information when you visit: the IP address, the page or resource requested, the time, the referring page, the browser type and version and the country derived from the IP address. We use these logs for security, capacity planning and aggregate statistics only. We do not use third-party analytics or advertising services on the Website.

2.5 Rate limiting

To protect the contact form and the sign-in endpoints from abuse we keep a counter of submissions per network address for roughly one hour. The counter is keyed by a salted hash of the IP address; the address itself is not stored in that counter.

2.6 Data we do not collect

We do not ask for and do not store payment card numbers, government identifiers, precise geolocation or the contents of your travel plans. Wishlists and language preferences on the Website are saved only in your own browser (see section 3) and are never sent to us.

3. Cookies, local storage and tracking

We use no advertising cookies and no third-party tracking cookies. The only cookie we set ourselves is:

rt_session on app.roamtime.ai — a strictly necessary, HttpOnly, Secure cookie that keeps you signed in to the Application for up to 90 days. Deleting it signs you out.

Our hosting provider, Cloudflare, may set its own strictly necessary cookies (for example for bot protection) on our domains; these are described in Cloudflare's cookie policy. If we enable Cloudflare Turnstile on the contact form to filter spam, Turnstile may process your browser characteristics for that purpose only.

The Website stores a small amount of data in your browser's local storage: the language you selected, and the list of spots you have added to a wishlist on the forecast pages. This data never leaves your browser and you can clear it at any time through your browser settings.

4. How we use personal data

We use Personal Data for the following purposes:

To provide and maintain the Service, including signing you in to the Application, authenticating API requests and monitoring usage.
To manage your Account and your organization's subscription or API agreement.
To respond to you when you send us an enquiry, and to carry on the resulting conversation about a purchase, an integration or a partnership.
To contact you about your Account, security matters, service changes or changes to our terms, by email.
To send business communications about Roamtime products, seasonal forecasts and features to business contacts who have enquired with us or who hold an Account. You can opt out at any time by replying to any such email or by contacting us.
To protect the Service: to detect, prevent and address abuse, fraud, security incidents and technical problems.
To comply with legal obligations and to establish, exercise or defend legal claims.
For business transfers: to evaluate or conduct a merger, financing, reorganization or sale of some or all of our assets, in which Personal Data held about Service users is among the assets transferred.

Where the law of your country requires a legal basis for processing, we rely on the performance of a contract with you or your organization, our legitimate interests in operating, securing and promoting a business-to-business service, your consent where we ask for it, and compliance with legal obligations.

We share Personal Data only in the following situations:

With Service Providers who host and operate our infrastructure and deliver email on our behalf (see section 11).
Within the Company: enquiries are forwarded to the Roamtime team members responsible for sales and support.
With your organization: if your Account was created under a customer agreement, we may share Account status and usage information with the organization that holds the agreement.
In business transfers, as described in section 4.
With your consent, for any other purpose you agree to.

We do not sell Personal Data and we do not share it with advertisers or data brokers.

6. Retention

We keep Personal Data only for as long as it is needed for the purposes set out in this Privacy Policy, and then delete or anonymize it. Our standard periods are:

Contact-form enquiries and email correspondence: for as long as the business conversation is active, and up to 24 months after our last contact with you.
Account records: for the life of the customer agreement, and up to 24 months after the Account is closed, so that we can answer questions about past service and meet accounting obligations.
One-time sign-in codes: 15 minutes, or until used.
Session records: 90 days from sign-in, or until you sign out or the Account is disabled.
Rate-limit counters: roughly one hour.
Request logs held by our hosting provider: a short rolling period determined by the provider, typically days.

Copies may persist for a limited time in backups before being overwritten, and we may retain data longer where the law requires it or where it is needed to resolve a dispute.

7. International transfer

Roamtime serves customers worldwide, and our infrastructure runs on a global edge network operated by Cloudflare, Inc., a United States company. Your Personal Data may therefore be processed in the United States and in other countries whose data-protection laws differ from those of your country. We take reasonable steps to ensure it is treated securely and in accordance with this Privacy Policy, including relying on our providers' contractual data-protection commitments and, for transfers out of the European Economic Area, the United Kingdom and Switzerland, standard contractual clauses or equivalent safeguards.

8. Deleting your personal data

You may ask us at any time to delete the Personal Data we hold about you. If your Account was created under an agreement with your organization, we may need to confirm the request with that organization. Some data may be retained where we are legally required to keep it or where it is needed to enforce our agreements. To make a request, email us at the address in section 16.

9. Disclosure of personal data

We may disclose Personal Data where we believe in good faith that doing so is necessary to comply with a legal obligation, a court order or a request from a public authority; to protect and defend the rights or property of the Company; to prevent or investigate possible wrongdoing in connection with the Service; to protect the personal safety of users of the Service or the public; or to protect against legal liability.

10. Security

We take security seriously. All traffic to the Service is encrypted in transit. Access codes, sign-in codes and session tokens are stored only as cryptographic hashes; IP addresses used for rate limiting are stored only as salted hashes; the Application's session cookie is HttpOnly and Secure; and access to production data is limited to the people who need it to run the Service. No method of transmission over the Internet or method of electronic storage is completely secure, however, and we cannot guarantee absolute security.

11. Service providers

We use the following categories of Service Providers, each of which may process Personal Data on our behalf under its own privacy policy:

Cloudflare, Inc. — hosting of the Website, the Application and the API (Pages and Workers), databases and key storage (D1, KV and R2), transactional email delivery for sign-in codes and enquiry forwarding, and optional spam protection (Turnstile). Privacy policy: cloudflare.com/privacypolicy.
Email providers used by the Roamtime team to read and reply to enquiries.

Our forecasts are built from public meteorological and phenological records and do not use Personal Data.

12. Your rights

Depending on where you live, you may have the right to access the Personal Data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive a copy in a portable format, to withdraw consent where processing is based on consent, and to lodge a complaint with a supervisory authority. Residents of the European Economic Area and the United Kingdom have these rights under the GDPR and UK GDPR; residents of California have rights under the CCPA/CPRA, including the right to know, delete and correct, and the right not to be discriminated against for exercising them. We do not sell or share Personal Data for cross-context behavioral advertising. To exercise any right, contact us at the address in section 16; we will respond within the time the applicable law requires and may need to verify your identity first.

13. Children's privacy

The Service is a business tool and is not directed to anyone under the age of 16. We do not knowingly collect Personal Data from anyone under 16. If you are a parent or guardian and believe your child has provided us with Personal Data, please contact us and we will remove it. Where the law of your country requires parental consent for a higher age, we apply that age.

14. Links to other websites

The Service links to third-party websites, for example official tourism pages for forecast spots, transport operators and the documentation of AI clients that connect to our MCP server. We have no control over, and assume no responsibility for, the content or privacy practices of those sites. We encourage you to review the privacy policy of every site you visit.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date at the top. For material changes we will also notify Account holders by email before the change takes effect. Changes are effective when they are posted on this page.

16. Contact us

If you have questions about this Privacy Policy or want to exercise your rights, contact us:

By email: sara.h@roamtime.site
Through the contact form on roamtime.ai