Privacy Policy

1. Introduction

This Privacy Policy explains how ROI House, LLC (“ROI House,” “we,” “us,” or “our”) collects, uses, and shares information about you when you use the ROI House Client Portal at portal.roihouse.com (the “Portal”).

This Policy applies to authorized users of the Portal — typically employees or representatives of agencies and businesses that subscribe to the Portal (“Customers”). It does not cover individuals whose phone calls are handled by AI agents operated by our Customers; the privacy practices for those individuals are the responsibility of the Customer who operates the agent.

ROI House, LLC is the controller of personal data described in this Policy.

2. Information We Collect

We collect the following categories of personal information:

Account Information

When you create an account, we collect your name, email address, organization name, and authentication credentials (password hash, or OAuth identifier if you sign in with Google).

Usage and Service Data

Information about how you use the Portal, including pages visited, actions taken, timestamps, IP addresses, browser type, and device information. We collect this through standard server logs.

Billing Information

If your organization is on a paid plan, our payment processor (Stripe) collects payment details directly. We do not store full credit card numbers — we receive only a tokenized customer reference, subscription status, and billing metadata.

Customer Service Data

Communications you send us by email or other support channels.

Cookies and Similar Technologies

We use essential cookies to maintain your authenticated session. We do not use third-party analytics or advertising cookies.

3. How We Use Information

• Provide the Portal: authenticate you, display your organization's data, process billing, and send transactional emails (account confirmation, invoices, password resets).
• Communicate with you: respond to support requests, send service announcements, and (with separate consent where required) marketing emails about our services.
• Maintain security: detect and prevent fraud, abuse, and unauthorized access.
• Improve the Portal: analyze aggregated usage patterns to improve features and reliability.
• Comply with legal obligations: respond to lawful requests and meet tax, accounting, and regulatory requirements.

4. Legal Bases for Processing (EEA/UK Users)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR:

• Contract: processing necessary to provide the Portal under your subscription.
• Legitimate interests: security, fraud prevention, service improvement, and direct customer communications, balanced against your privacy rights.
• Consent: for optional marketing communications and any other processing where consent is required. You may withdraw consent at any time.
• Legal obligation: retention of billing records and response to lawful requests.

5. How We Share Information

Service Providers (Sub-Processors)

We use the following third-party vendors to operate the Portal:

These providers are contractually bound to use personal information only as needed to provide their services to us.

Within Your Organization

If you are an authorized user of an organization's account, your activity may be visible to your organization's administrators.

Legal Compliance and Safety

We may disclose information when required by law, subpoena, or court order, or to protect the rights, property, or safety of ROI House, our users, or others.

Business Transfers

If ROI House is involved in a merger, acquisition, or sale of assets, personal information may be transferred to the acquiring entity. We will notify you of any change in ownership or use of your personal information.

We do not sell personal information.

6. International Data Transfers

ROI House is based in the United States and our service providers process data in the United States. If you access the Portal from outside the United States, your information will be transferred to, stored in, and processed in the United States.

For transfers from the EEA, UK, or Switzerland, we rely on appropriate safeguards under applicable law, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum where required.

7. Data Retention

We retain personal information for the duration of your subscription. After your subscription is terminated, we delete or anonymize your account information and associated call data within 90 days, except where:

• A longer retention period is required by law (for example, tax records, typically 7 years).
• Information is needed to resolve disputes or enforce our agreements.
• Backups containing your information may persist for up to 30 additional days before being overwritten.

You may request earlier deletion at any time by contacting privacy@roihouse.com (subject to legal retention obligations).

8. Security

We use industry-standard administrative, technical, and physical safeguards to protect personal information, including encryption in transit (TLS), encryption at rest, role-based access controls, and least-privilege secret management. No system is completely secure; we cannot guarantee absolute security and recommend you use a strong, unique password.

9. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal information.

All users

• Access the information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your information (subject to retention obligations described above).
• Export your information in a portable format.

EEA, UK, and Swiss residents (GDPR)

In addition to the above, you have the right to:

• Restrict or object to certain processing.
• Withdraw consent for processing based on consent.
• Lodge a complaint with your local data protection authority.

California residents (CCPA/CPRA)

In addition to the above, you have the right to:

• Know the categories and specific pieces of personal information we have collected about you.
• Delete personal information we hold (with statutory exceptions).
• Correct inaccurate personal information.
• Opt out of “sale” or “sharing” of personal information for cross-context behavioral advertising. We do not sell or share personal information as defined by the CCPA.
• Limit use of sensitive personal information. We do not use sensitive personal information for purposes beyond those permitted by the CCPA.
• Non-discrimination for exercising your rights.

To exercise any of these rights, email privacy@roihouse.com. We will respond within the timeframe required by applicable law (generally 30 days under GDPR, 45 days under CCPA). We may need to verify your identity before responding.

10. Cookies and Tracking

We use a small number of cookies that are strictly necessary to operate the Portal — primarily to maintain your authenticated session. We do not use third-party analytics, advertising, or social-media tracking cookies.

We do not currently respond to “Do Not Track” browser signals.

11. Children's Privacy

The Portal is intended for use by businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact privacy@roihouse.com and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice in the Portal. The “Last Updated” date at the top of this Policy indicates when it was most recently revised. Continued use of the Portal after changes take effect constitutes acceptance of the updated Policy.

13. Contact Us

For questions about this Privacy Policy or to exercise your rights, contact: