Privacy Policy

Our Commitment to Your Privacy

At rumi.coach, privacy is not a legal checkbox — it is the foundation the entire product is built on. You are asked to speak honestly about your inner life, your goals, your fears, and your struggles. That requires an environment of complete trust. This Privacy Policy explains exactly what we collect, why we collect it, what we do not collect, and how you remain in control at all times.

This Policy applies to your use of the rumi.coach website, web application, iOS application, and Android application (collectively, the "Service"), operated by Rumi Labs, Lda, a private limited company incorporated in Portugal with registered office at Travessa Velha do Picoto 125, 3700-638 Cesar ("rumi.coach", "we", "us", or "our").

rumi.coach is the data controller for the personal data described in this Policy, as defined under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

1. What Data We Collect and Why

1.1 Data You Provide at Account Registration

When you create a rumi.coach account, we ask for the following information:

We do not ask for your full legal name, phone number, or home address at signup. Your preferred name is the only name we hold. (You may optionally add a phone number later — see Section 1.2.)

1.2 Data Collected During Use of the Service

Voice session audio: Your voice is processed in real time during a session to generate coaching responses and structured outputs (habits, priorities, goals, reflections). Voice audio is never stored. It is processed entirely in memory and permanently deleted the moment your session ends. We hold no recordings of any session.

Session outputs (Dashboard data): The structured outputs generated during your sessions — such as habit lists, goal roadmaps, priorities, and reflections — are stored in your account on your chosen Google Cloud region and are visible in your Visual Clarity Dashboard. You control this data and may delete any or all of it at any time.

Session metadata: We store limited technical metadata about sessions, including session date, duration in minutes, and minutes deducted from your balance. This is required to manage your minute allowance and billing accurately. The content of your sessions is never stored.

Phone number (optional): You may choose to add a phone number to your account after registration. If you do, we use it solely to send you SMS messages related to the Service, on the basis of your consent (Art. 6(1)(a)). You can remove your phone number at any time in your account settings, which also withdraws that consent.

Payment information: We do not store your payment card details. All subscription and payment processing is handled by our third-party processors, RevenueCat and Paddle, which process your data under their own privacy policies. We receive only a transaction confirmation and the last four digits of your card for reference.

1.3 Data Collected Automatically

When you visit our website or use the Service, we automatically collect:

Log and device data: IP address, browser type and version, operating system, device type, pages visited, and timestamps. This data is used to maintain service security and diagnose technical issues.

Analytics data (Google Analytics): We use Google Analytics to understand how visitors use our website (not the in-app experience). Google Analytics collects data such as pages visited, time on page, approximate geographic location (derived from IP address), and device/browser information. This data is aggregated and used solely to improve the website. We have enabled IP anonymisation in our Google Analytics configuration.

We do not use analytics inside the coaching application itself. Your in-app behaviour — which sessions you do, what you say, how you use the Dashboard — is not tracked by any analytics tool.

2. Data Storage and Location

At account creation, you choose where your personal account data is stored:

• Europe: Google Cloud europe-west1 (Belgium)
• United States: Google Cloud us-central1 (Iowa)

Your choice determines the primary location of your account data — your Dashboard outputs, session metadata, and account profile — and the region where your voice sessions are processed in real time (our AI provider, Google Gemini, runs in both regions). This is a permanent setting per account. If you wish to change your data region, you must contact us at support@rumi.coach; this will require deletion of your current account and creation of a new one.

Regardless of your chosen region, voice audio is never written to any storage system anywhere. It is processed in memory only.

Google Cloud is certified under ISO 27001 and SOC 2, and processes data under a Data Processing Addendum that complies with GDPR requirements.

3. International Data Transfers

If you choose to store your data in the United States (Iowa), your personal data will be transferred to and processed in the United States, which the European Commission has not determined to provide an equivalent level of data protection to the EU.

To ensure your data remains protected, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the legal transfer mechanism for data processed in the US region. You may request a copy of the applicable SCCs by contacting us at support@rumi.coach.

If you choose the EU (Belgium) region, your data does not leave the European Economic Area.

4. Legal Bases for Processing (GDPR)

We process your personal data only where we have a lawful basis to do so under GDPR. The applicable bases are:

• Performance of contract (Art. 6(1)(b)): Processing necessary to provide the Service to you — account management, session delivery, Dashboard, billing.
• Legal obligation (Art. 6(1)(c)): Processing required by law — age verification, VAT records, consumer rights compliance.
• Legitimate interests (Art. 6(1)(f)): Processing necessary for our legitimate business interests — fraud prevention, security monitoring, service stability — where these interests are not overridden by your rights. We carefully weigh our interests against your privacy in each case.
• Consent (Art. 6(1)(a)): Where we rely on consent (e.g. Google Analytics cookies on the website), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

We deliberately minimise sensitive data: voice audio is never stored, we do not perform biometric identification, and we do not build health profiles or infer health-related characteristics about you. However, what you choose to say in a session — and any reflections you choose to save to your Dashboard — may reveal information about your emotional wellbeing. Where content you provide includes special category data (GDPR Art. 9), we process it solely to provide the Service to you, on the basis of your explicit consent (Art. 9(2)(a)) given when you create your account. You may withdraw that consent at any time by deleting the relevant content or your account.

5. How We Use Your Data

We use the data we collect for the following purposes only:

• Providing and maintaining the Service: Delivering voice coaching sessions, generating Dashboard outputs, managing your account, and processing billing.
• Managing your minute balance: Tracking session duration and deducting minutes from your allowance.
• Customer support: Responding to your questions and resolving issues you raise with us.
• Service security and fraud prevention: Detecting and preventing unauthorised access, abuse, or fraudulent use of the Service.
• Legal compliance: Meeting our obligations under Portuguese, EU, and applicable tax law.
• Website analytics: Understanding how visitors use our public website to improve it (via Google Analytics, with your consent).
• Service communications: Sending you transactional emails such as subscription confirmations, payment receipts, minute-balance warnings, and policy updates.

We do not use your data for:

• Advertising or retargeting
• Sale to any third party
• Training AI models (your sessions are not used to train any model, including the AI that powers rumi.coach)
• Profiling for automated decision-making that produces legal or significant effects

6. Who We Share Your Data With

We do not sell your personal data. We share it only in the following limited circumstances:

Service providers (data processors): We work with a small number of trusted third-party providers who process data on our behalf under strict contractual obligations:

• Google Cloud Platform — cloud infrastructure and data storage
• Google (Gemini, on Google Cloud) — real-time voice transcription and AI response generation during sessions, running in your chosen data region (EU — Belgium, or US — Iowa). Voice content is processed transiently to power your session and is never stored or used to train models.
• RevenueCat — subscription state management
• Google Analytics — website analytics (anonymised, with your cookie consent)
• SMTP2GO and SendGrid — email delivery (one serves as backup for the other)
• Twilio — SMS delivery, only if you add a phone number to your account

All processors are bound by GDPR-compliant data processing agreements and may only process your data for the specific purpose we instruct.

Payment platforms (independent controllers): Purchases are billed by Apple (App Store), Google (Google Play), or Paddle (merchant of record for website purchases). These platforms process your payment and billing data under their own privacy policies, and rumi.coach never receives or stores your full payment card details. Where these platforms process data outside the EEA, they do so under their own GDPR transfer safeguards.

Legal requirements: We may disclose your data if required by law, court order, or other legal process, or where necessary to protect the rights, safety, or property of rumi.coach or others. We will notify you of any such disclosure where legally permitted to do so.

Business transfers: In the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred as part of that transaction. We will notify you in advance and your rights under this Policy will continue to apply.

7. Data Retention

We retain your personal data only for as long as necessary for the purpose for which it was collected, or as required by law.

When you delete your account, all personal data is permanently deleted within 30 days, except where we are required by law to retain it (e.g. payment records for tax purposes).

8. Cookies

We use cookies on our public website only. We do not use cookies inside the coaching application beyond what is strictly necessary for authentication and session security.

Strictly necessary cookies: Required for the website and application to function — authentication, security tokens, session state. These cannot be disabled.

Analytics cookies (Google Analytics): Used to understand how visitors navigate our public website. These are only placed with your consent via our cookie banner. You may withdraw or change your consent at any time via Cookie settings.

We do not use advertising cookies, tracking pixels, or any third-party marketing cookies.

The cookies we use are:

Cookie durations above are the maximum lifetime of the cookie in your browser. The analytics data itself is retained by Google Analytics for up to 14 months (see Section 7).

9. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights, which you may exercise at any time:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten"), subject to our legal retention obligations.
• Right to restriction (Art. 18): Request that we limit processing of your data in certain circumstances.
• Right to data portability (Art. 20): Request your data in a structured, machine-readable format to transfer to another service.
• Right to object (Art. 21): Object to processing based on legitimate interests, including any direct marketing.
• Right to withdraw consent: Where processing is based on consent (e.g. analytics cookies), you may withdraw it at any time.
• Right not to be subject to automated decision-making (Art. 22): We do not make any automated decisions that produce legal or significant effects about you.

How to exercise your rights: You may exercise any of the above rights through your account settings, or by contacting us at support@rumi.coach. We will respond within 30 days. We may ask you to verify your identity before processing your request.

Right to lodge a complaint: If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Portuguese data protection authority:

Comissão Nacional de Proteção de Dados (CNPD)
Rua de São Bento, 148-3º
1200-821 Lisboa, Portugal
www.cnpd.pt

You may also contact the data protection authority in your country of residence if you are located in another EU member state.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or destruction. These include:

• Encryption of data in transit (TLS) and at rest (AES-256) on Google Cloud
• Access controls limiting who within our team can access personal data
• Regular security reviews
• In-memory-only processing of voice audio with no write operations to any storage system

No system is perfectly secure. If we become aware of a data breach that is likely to affect your rights and freedoms, we will notify the CNPD within 72 hours and notify you without undue delay, as required by GDPR Art. 33–34.

11. Children's Privacy

The Service is not directed at anyone under the age of 16. We do not knowingly collect personal data from anyone under 16. If we become aware that we have inadvertently collected data from a user under 16, we will delete that data and close the account promptly. If you believe a child under 16 has created an account, please contact us at support@rumi.coach.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 14 days before the new policy takes effect. The updated policy will always be available at rumi.coach/privacy-policy. Your continued use of the Service after the effective date constitutes acceptance of the updated policy. If you do not agree, you may delete your account before the changes take effect.

13. Contact

For any privacy-related questions, data subject requests, or concerns, please contact us:

Rumi Labs, Lda
Travessa Velha do Picoto 125, 3700-638 Cesar
Cesar, Portugal

Email: support@rumi.coach
Website: rumi.coach/support

We aim to respond to all privacy enquiries within 5 business days.