Privacy Policy

Roumora is an online marketplace for AI skills, operated by Peter Roumeliotis, a sole proprietor based in New York, United States (“we”, “us”). Roumora is a trading name, not a separate company - the data controller is Peter Roumeliotis personally. Our address for legal notices is 20 Garvey Drive, Hauppauge, NY 11788, United States.

This policy covers the Roumora website and services. It does not cover third-party sites you reach through links or through a skill you use.

Information you give us

Account

Display name, username (handle), email address, and password. Optionally a first and last name, avatar image, short bio, and personal website.

Security

If you enable two-factor authentication, a 2FA secret (encrypted at rest) and single-use backup codes. Passwords are stored only as a salted hash, never in readable form.

Payment

Only if you subscribe to Roumora Pro. Card details go directly to Stripe and never touch our servers; we store a Stripe customer identifier and your subscription status. Skills are free, so most members never give us payment information at all.

Content you publish

Skills and their file contents, versions, descriptions, comments, ratings, collections, and profile text. Most of this is public by design.

Private messages

The contents of direct messages you send to other members, so we can deliver them.

Support

Anything you include when you email us.

Information collected automatically

IP address

Recorded when you sign in, sign up, or request a password reset, to rate-limit abuse and protect accounts.

Security events

An audit log of sign-ins, 2FA changes, password changes, and subscription changes on your account.

Usage

Downloads, favorites, follows, assistant conversations, and which skills you open - used to run the marketplace and to rank and recommend skills.

Cookies

A session cookie that keeps you signed in, and a theme cookie that remembers light or dark mode. See section 7.

Information from third parties

Google

If you sign in with Google, we receive your name, email address, and profile picture from your Google account.

Stripe

Subscription status and the last digits and brand of a card, so we can show your billing history. We never receive full card numbers.

Where the GDPR or UK GDPR applies, we rely on the legal bases named below.

Run your account

Create and authenticate your account, deliver messages and notifications, provide support. Basis: performance of a contract.

Bill your subscription

Take payment for Roumora Pro, handle cancellations and chargebacks, keep tax and accounting records. Basis: performance of a contract, and legal obligation for record-keeping.

Operate the marketplace

Display public profiles and skills, rank and recommend, count downloads and ratings. Basis: legitimate interests in running a functioning marketplace.

Security and abuse prevention

Rate limiting, audit logging, fraud detection, scanning skills for malware and prompt injection. Basis: legitimate interests in keeping the service safe.

Service emails

Verification, password resets, and subscription receipts. Basis: performance of a contract.

Legal compliance

Responding to lawful requests, enforcing our Terms, defending claims. Basis: legal obligation and legitimate interests.

Roumora includes a built-in AI assistant. When you chat with a skill, the messages you send, the conversation history, and the contents of the skill you have equipped are transmitted to our AI provider, OpenAI, to generate a response. Do not enter passwords, payment details, government identifiers, health information, or anyone else’s confidential information into a chat.

We use OpenAI’s API. Under its terms, the messages you send and the responses you receive are not used to train any model. OpenAI retains them for a limited period for safety and abuse monitoring, then deletes them. We keep your conversation history on our own servers so you can return to a chat, and you can delete a conversation at any time.

AI output can be wrong. It is generated text, not professional advice, and you are responsible for checking it before you rely on it.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use a small number of service providers who process data on our instructions:

Stripe

Subscription billing for Roumora Pro. United States and Ireland.

Amazon Web Services

Hosting, skill file storage (S3), rate-limit records (DynamoDB), and transactional email (SES). United States.

Resend

Transactional email delivery, where enabled. United States.

OpenAI

AI responses in chat. United States.

Google

Optional sign-in, if you choose it.

We also disclose information when the law requires it, to enforce our Terms of Service, to protect the rights and safety of our members, or to a buyer of the business in a merger or acquisition, in which case this policy continues to apply.

Some information is public by the nature of a marketplace. Your handle, display name, avatar, bio, website, reputation, published skills, comments, ratings, and public collections are visible to anyone, including search engines. Your email address, billing history, private messages, and security settings are not.

We use two cookies, and no advertising, analytics, or tracking cookies:

Session

Set when you sign in, so the site knows it is you. Strictly necessary - the service cannot work without it.

theme

Remembers your light or dark mode choice for one year. Set only when you change the setting.

Because we set no advertising or analytics cookies, we do not show a cookie consent banner. If that ever changes, we will ask for consent first.

We keep your account information for as long as your account is open. When you delete your account we delete or anonymize your personal information within 30 days, except where we must keep it longer:

Billing records

Kept for the period required by tax and accounting law in our jurisdiction, typically seven years.

Security logs

Kept for a limited period to investigate abuse and fraud.

Published skills

Copies of your skills that other members already downloaded remain theirs to use, as their license survives your account.

Passwords are hashed, two-factor secrets are encrypted at rest, traffic is served over TLS, and sensitive account changes are written to an audit log. Every skill uploaded to Roumora is scanned before publication - see our Security page.

No system is perfectly secure. If a breach affects your personal information we will notify you and the relevant regulator where the law requires it.

Everyone

You can view and edit most of your information in your account settings, and you can request deletion of your account at any time.

EEA, UK, and Switzerland

You have the right to access, correct, delete, restrict, or object to our processing of your personal information, the right to receive it in a portable format, and the right to withdraw consent where we rely on it. You may also lodge a complaint with your local supervisory authority.

California

You have the right to know what we collect and why, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal information, and we do not offer financial incentives for it, so there is nothing to opt out of. We will not discriminate against you for exercising any right.

To exercise any of these, email [email protected]. We will verify your identity through the email address on your account and respond within the period the law allows - 30 days under the GDPR, 45 days under the CCPA.

We operate in the United States, and our service providers are listed in section 5. If you use Roumora from outside the United States, your information is transferred there. For transfers out of the EEA or UK we rely on the European Commission’s Standard Contractual Clauses.

Roumora is not intended for children under 13, and we do not knowingly collect their information. If you are under 18 you need a parent or guardian’s consent before subscribing to Roumora Pro. If you believe a child under 13 has given us information, email [email protected] and we will delete it.

We may update this policy. If a change materially affects your rights we will notify you by email or with a notice on the site before it takes effect. The date at the top of this page always reflects the current version.

Privacy questions: [email protected]
Everything else: [email protected]
Post: Peter Roumeliotis, 20 Garvey Drive, Hauppauge, NY 11788, United States