Privacy Policy & Disclaimer

1. Disclaimer — Not Tax Advice

Roam is a financial estimation tool designed to help freelancers and independent workers understand their approximate tax obligations across different countries. The figures presented — including take-home estimates, tax reserve calculations, social security contributions, and deadline alerts — are based on publicly available tax rules and simplified models.

These estimates are provided for informational and planning purposes only. They do not account for all possible deductions, exemptions, credits, allowances, treaty provisions, or individual circumstances that may affect your actual tax liability.

You should always:

• Consult a qualified tax professional or accountant licensed in your jurisdiction before making any financial or tax decisions
• Verify all calculations independently with official sources (tax authority websites, your national revenue service, etc.)
• File your tax returns and make payments based on official guidance, not Roam estimates

Roam, its founders, employees, and partners accept no liability for any financial loss, penalties, fines, or adverse consequences arising from reliance on the estimates or information provided through this platform.

2. Data We Collect

We collect only what is necessary to provide the service. We do not sell your data to third parties, ever.

Account data

• Email address (required for account creation)
• Name (optional, used for personalisation)
• Country of origin and current location
• Tax profile (freelancer / consultant / nomad / employee)
• Language and currency preference

Financial data

• Income entries you manually register (amount, currency, date, country)
• Country stay dates you enter for the 183-day tracker
• Tax snapshots generated by the platform (estimates only)
• Deadline records linked to your account

Technical data

• IP address (for security and rate limiting)
• Browser type and operating system
• Pages visited and features used (anonymised analytics)
• Session cookies required for authentication

What we do NOT collect

• Bank account numbers or credentials
• Actual tax returns or submitted filings
• Payment card details (processed by Stripe — see §7)
• Biometric or sensitive personal data

3. How We Use Your Data

Your data is used exclusively to provide, maintain, and improve the Roam service.

• To deliver the service — calculating estimates, tracking deadlines, personalising the dashboard
• To send service emails — deadline alerts, account notifications, plan updates
• To improve accuracy — understanding how the platform is used to fix bugs and improve tax calculations
• To comply with legal obligations — responding to valid legal requests where required by law

If you are on the Roam Expert plan and choose to share your dashboard with a partner accountant, that accountant will have read-only access to your income summary, country stays, and tax estimates for the duration of your session. This access is governed by the partner's own professional obligations and our partner agreement.

We do not use your financial data for advertising purposes. We do not share your data with advertisers or data brokers.

4. Data Retention

We retain your data for as long as your account is active. If you close your account, your personal data will be deleted within 30 days, except where retention is required by applicable law (e.g., financial record-keeping obligations).

Anonymised, aggregated usage data may be retained indefinitely for platform improvement purposes. This data cannot be used to identify you.

If you submit a partner application that is not accepted, your application data is deleted within 90 days.

5. Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and applicable local law:

• Right of access — you can request a copy of all personal data we hold about you
• Right to rectification — you can correct inaccurate or incomplete data
• Right to erasure — you can request deletion of your data ("right to be forgotten")
• Right to restriction — you can ask us to limit how we process your data
• Right to data portability — you can request your data in a machine-readable format
• Right to object — you can object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, email us at [email protected] with the subject line "GDPR Request". We will respond within 30 days.

You also have the right to lodge a complaint with the supervisory authority in your country. In Portugal, this is the CNPD (Comissão Nacional de Proteção de Dados) at cnpd.pt.

6. Cookies

We use a minimal set of cookies necessary to operate the service:

• Authentication cookies — to keep you logged in (session-based, deleted on logout)
• Preference cookies — to remember your language and currency choice
• Security cookies — to prevent CSRF attacks

We do not use advertising cookies, tracking pixels, or third-party analytics cookies that identify individual users. We use anonymised, self-hosted analytics that do not share data with advertising networks.

By using Roam, you consent to the use of strictly necessary cookies. You can block all cookies in your browser settings, but this will prevent you from logging in.

7. Third-Party Services

Roam uses a small number of trusted third-party services to operate. Each is bound by its own privacy policy and, where applicable, a Data Processing Agreement with us.

• Supabase (supabase.com) — database and authentication. Hosted in the EU. GDPR compliant.
• Stripe (stripe.com) — payment processing. Stripe is PCI DSS Level 1 certified. We never see or store your card details.
• Loops.so (loops.so) — email delivery for account notifications and deadline alerts. We share your email address only.
• Vercel (vercel.com) — hosting and CDN. EU region available.
• Open Exchange Rates — currency conversion. Only public FX data is retrieved; no user data is shared.

We do not use Google Analytics, Facebook Pixel, or any other third-party advertising or tracking service.

8. Security

We take security seriously and apply the following measures to protect your data:

• All data in transit is encrypted via TLS 1.3
• Data at rest is encrypted using AES-256
• Database access is restricted by Row Level Security — users can only access their own data
• Authentication is handled by Supabase Auth with bcrypt password hashing
• We conduct regular security reviews and dependency audits

Despite these measures, no system is completely secure. If you discover a security vulnerability, please report it responsibly to [email protected]. We take all reports seriously and will respond within 48 hours.

9. Contact

For any questions about this policy, your data, or to exercise your rights:

• Email: [email protected]
• Subject line for data requests: "GDPR Request" or "Privacy"
• Response time: within 5 business days for general queries; within 30 days for formal GDPR requests

Roam.tax is operated by HVR Business Consulting, Lda., based in Lisbon, Portugal.

This policy may be updated from time to time. Material changes will be notified by email to registered user