Privacy policy

Our Commitment to Your Privacy

At rumi.coach, privacy is not a legal checkbox — it is the foundation the entire product is built on. You are asked to speak honestly about your inner life, your goals, your fears, and your struggles. That requires an environment of complete trust. This Privacy Policy explains exactly what we collect, why we collect it, what we do not collect, and how you remain in control at all times.

This Policy applies to your use of the rumi.coach website, web application, iOS application, and Android application (collectively, the "Service"), operated by RUMI LABS, LDA, a private limited company incorporated in Portugal with registered office at Travessa Velha do Picoto 125, 3700-638 Cesar ("rumi.coach", "we", "us", or "our").

rumi.coach is the data controller for the personal data described in this Policy, as defined under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

1. What Data We Collect and Why

1.1 Data You Provide at Account Registration

When you create a rumi.coach account, we ask for the following information:

We do not ask for your full legal name, phone number, or home address at signup. Your preferred name is the only name we hold. (You may optionally add a phone number later — see Section 1.2.)

How you sign in: You can sign in with your email address or with your phone number, in which case we send you a one-time code — by email or by SMS — and store no password at all, or with Sign in with Apple or Google Sign-In. If you use Apple or Google, we receive the email address and, where you allow it, the name held by that account — nothing else from your Apple or Google profile. Sign in with Apple lets you hide your real address behind Apple's private relay, and if you do, the relay address is the only one we ever hold.

What you agree to at registration: Creating an account requires you to accept our Terms and Conditions and, separately, to confirm that you understand you are talking to an AI — that the audio of your voice is sent to our servers and processed by our services inside Google Cloud so Rumi can reply out loud, and that what you say is saved to your profile as memories. Marketing email is a third, entirely optional checkbox. We record the date and time of each of these three decisions on your account. If you sign in with Apple or Google, which skips the registration form, you are asked for the same three before you can use the Service.

1.2 Data Collected During Use of the Service

Voice session audio: Your voice is processed in real time during a session so that Rumi can understand you and reply out loud. The audio itself is never stored. It is processed in memory and gone the moment your session ends — we hold no recordings of any session. The words are transcribed as you speak, because that is how Rumi understands you, but the transcript is not kept either: it lives only for the duration of the session. What does outlast the session is described in the next paragraph, and you are asked to agree to this in the app before your first session.

Memories: From what you say, we save short written notes to your profile — the things worth remembering about your goals, your situation and what matters to you. These are stored text, not audio, and they are what make Rumi's sessions personal over time rather than starting from nothing each session. You can delete your memories on their own, without deleting anything else, from Settings → Manage Data, and they are erased when you delete your account.

Session recap and insights: At the end of a session we keep a short written recap and the insights drawn from it, so you can look back at what you worked on. These are stored on your account and are yours to delete at any time.

Session outputs (Dashboard data): The structured outputs generated during your sessions — such as habit lists, goal roadmaps, priorities, and reflections — are stored in your account on your chosen Google Cloud region and are visible in your Visual Clarity Dashboard. You control this data and may delete any or all of it at any time.

In-app chat messages: The messages you exchange with Rumi in the in-app chat are stored on your account so you can see the conversation. You choose how long they are kept in the app settings: 3 days, 7 days, 30 days or forever. Messages older than the period you chose are deleted automatically, and you can delete your chat history at any time.

Session metadata: We store limited technical metadata about sessions, including session date, duration in minutes, and minutes deducted from your balance. This is required to manage your minute allowance and billing accurately.

Phone number: A phone number can be how you sign in — we send a one-time code by SMS and you enter it instead of a password. Where your number is your sign-in identifier, we hold it because the Service cannot let you in without it (performance of contract), and we also use it, on the basis of our legitimate interests, for the few onboarding text messages described in Section 5, which you can stop at any time by replying STOP. You may also add a number to an account you created another way; in that case we use it only to send you SMS messages related to the Service, on the basis of your consent (Art. 6(1)(a)), and you can remove it at any time in your account settings, which withdraws that consent. Either way, we never use your number for advertising and never share it with advertisers.

Payment information: We never see or store your payment card details. Purchases made inside the iOS or Android app are billed by Apple or Google under their own privacy policies, and all we receive is confirmation that a purchase or renewal happened — no card number, no last four digits, no billing address. Purchases made on our website are billed by Paddle as merchant of record. RevenueCat receives the purchase confirmation to keep track of what your account is entitled to; it never processes a payment.

1.3 Data Collected Automatically

When you visit our website or use the Service, we automatically collect:

Log and device data: IP address, browser type and version, operating system, device type, pages visited, and timestamps. This data is used to maintain service security and diagnose technical issues.

Analytics data (Google Analytics): We use Google Analytics to understand how visitors use our website (not the in-app experience). Google Analytics collects data such as pages visited, time on page, approximate geographic location (derived from IP address), and device/browser information. This data is aggregated and used solely to improve the website. We have enabled IP anonymisation in our Google Analytics configuration.

Product analytics inside the app (PostHog, Mixpanel, Firebase Analytics): To understand how the app is actually used, and where people get stuck, we record which screens you open and which actions you take — a session started, a paywall seen, a commitment created. Alongside those events we send your account identifier and a small profile: your chosen persona and voice, gender, an age bracket rather than your date of birth, language, country, data region, theme, focus area, whether setup is complete, and when you signed up.

What in-app analytics never receive: the content of your sessions. No audio, no transcript, no memory, no Dashboard text ever goes to an analytics provider — those events carry the fact that something happened and nothing of what was said.

Crash and diagnostic data (Firebase Crashlytics): If the app crashes, we receive the crash report — device model, operating system version, app version, and the technical stack trace — so we can fix it.

Push notifications (Firebase Cloud Messaging): If you allow notifications, your device is issued a push token that we store on your account and use to send you reminders and session prompts. Turning notifications off in your device settings ends this.

Time zone: The app sends your device's time zone with its requests, and we store it on your account so that reminders and messages reach you at a reasonable hour where you are.

2. Data Storage and Location

At account creation, you choose where your personal account data is stored:

• Europe: Google Cloud europe-west1 (Belgium)
• United States: Google Cloud us-central1 (Iowa)

Your choice determines the primary location of your account data — your Dashboard outputs, memories, session recaps, session metadata, and account profile — and the region where your voice sessions are processed in real time. The AI services we use run inside Google Cloud in both regions, so your session is served from the region you chose. This is a permanent setting per account. If you wish to change your data region, you must contact us at support@rumi.coach; this will require deletion of your current account and creation of a new one.

Regardless of your chosen region, voice audio is never written to any storage system anywhere. It reaches our backend inside Google Cloud, is processed in memory, and does not leave Google Cloud.

Google Cloud is certified under ISO 27001 and SOC 2, and processes data under a Data Processing Addendum that complies with GDPR requirements.

3. International Data Transfers

If you choose to store your data in the United States (Iowa), your personal data will be transferred to and processed in the United States, which the European Commission has not determined to provide an equivalent level of data protection to the EU.

To ensure your data remains protected, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the legal transfer mechanism for data processed in the US region. You may request a copy of the applicable SCCs by contacting us at support@rumi.coach.

If you choose the EU (Belgium) region, your data does not leave the European Economic Area.

4. Legal Bases for Processing (GDPR)

We process your personal data only where we have a lawful basis to do so under GDPR. The applicable bases are:

• Performance of contract (Art. 6(1)(b)): Processing necessary to provide the Service to you — account management, session delivery, Dashboard, billing.
• Legal obligation (Art. 6(1)(c)): Processing required by law — age verification, VAT records, consumer rights compliance.
• Legitimate interests (Art. 6(1)(f)): Processing necessary for our legitimate business interests — fraud prevention, security monitoring, service stability, and helping you get started with the Service you signed up for through the onboarding messages described in Section 5 — where these interests are not overridden by your rights. We carefully weigh our interests against your privacy in each case.
• Consent (Art. 6(1)(a)): Where we rely on consent — the AI processing of your voice described below, marketing email, an optional phone number, Google Analytics cookies on the website — you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

AI processing of your voice rests on your consent. Before your first session you must confirm, in a checkbox of its own and separate from accepting the Terms, that you understand you are talking to an AI system, that the audio of your voice is sent to our backend and processed by our services inside Google Cloud so that Rumi can reply out loud, and that what you say is saved to your profile as memories. No session can start until you do, and the date and time of that consent is recorded on your account. You withdraw it by deleting your account, which also erases your memories; withdrawing it means the Service can no longer be provided, because speaking with Rumi is the entire Service.

We deliberately minimise sensitive data: the audio of your voice is never stored, we do not perform biometric identification, we do not use your voice to identify you, and we do not build health profiles or infer health-related characteristics about you. However, what you choose to say in a session — and any reflections you choose to save to your Dashboard — may reveal information about your emotional wellbeing. Where content you provide includes special category data (GDPR Art. 9), we process it solely to provide the Service to you, on the basis of your explicit consent (Art. 9(2)(a)) given when you create your account. You may withdraw that consent at any time by deleting the relevant content or your account.

5. How We Use Your Data

We use the data we collect for the following purposes only:

• Providing and maintaining the Service: Delivering voice sessions, generating Dashboard outputs, managing your account, and processing billing.
• Managing your minute balance: Tracking session duration and deducting minutes from your allowance.
• Customer support: Responding to your questions and resolving issues you raise with us.
• Service security and fraud prevention: Detecting and preventing unauthorised access, abuse, or fraudulent use of the Service.
• Legal compliance: Meeting our obligations under Portuguese, EU, and applicable tax law.
• Website analytics: Understanding how visitors use our public website to improve it (via Google Analytics, with your consent).
• Product analytics inside the app: Understanding which features are used and where people get stuck, so we can improve the app (via PostHog, Mixpanel and Firebase Analytics, and never including the content of your sessions).
• Crash diagnostics: Receiving crash reports so we can fix defects (via Firebase Crashlytics).
• Notifications: Sending reminders and session prompts to your device, if you allow notifications (via Firebase Cloud Messaging).
• Service communications: Sending you transactional emails such as subscription confirmations, payment receipts, minute-balance warnings, and policy updates.
• Onboarding messages: While your account is new, a short series of emails — and, if you sign in with your phone number, a few text messages — to help you have your first session and, if you wish, connect WhatsApp or Telegram. They stop as soon as you have done what they are about and end within two weeks of signing up. Emails and text messages are sent only between 9:00 and 21:00 in your time zone, and each one lets you stop them: through the link in every email, or by replying STOP to a text message. If you have connected WhatsApp or Telegram, they reach you there instead. They contain no offers and do not depend on the marketing email choice you made at registration (legitimate interests, Art. 6(1)(f)).

We do not use your data for:

• Advertising or retargeting
• Sale to any third party
• Training AI models (your sessions are not used to train any model, including the AI that powers rumi.coach)
• Profiling for automated decision-making that produces legal or significant effects

6. Who We Share Your Data With

We do not sell your personal data. We share it only in the following limited circumstances:

Service providers (data processors): We work with a small number of trusted third-party providers who process data on our behalf under strict contractual obligations:

• Google Cloud Platform — cloud infrastructure, data storage, and the AI services that power a session. Our backend, your account data and your memories all live here, in the region you chose (EU — Belgium, or US — Iowa), and the real-time voice transcription and AI response generation happen in that same region. Your session audio reaches our backend inside Google Cloud and is processed there; it does not leave Google Cloud. It is processed transiently to power your session, is never stored as audio, and is never used to train any model.
• PostHog, Mixpanel — product analytics for the app: which screens and actions, plus the small account profile described in Section 1.3. Never the content of your sessions.
• Google (Firebase Analytics, Crashlytics, Cloud Messaging) — app analytics, crash reports, and push notification delivery.
• RevenueCat — subscription state management
• Google Analytics — website analytics (anonymised, with your cookie consent)
• SMTP2GO and SendGrid — email delivery (one serves as backup for the other)
• Twilio — SMS delivery: your one-time sign-in codes and onboarding messages if you sign in by phone, and Service messages if you added a number to your account

All processors are bound by GDPR-compliant data processing agreements and may only process your data for the specific purpose we instruct. Each of them is contractually required to protect your data to the same standard set out in this Policy — the same or an equivalent level of protection — and none of them is permitted to use your data for its own purposes, to sell it, or to train its own models on it. Where a processor is used, we remain the controller and remain accountable to you for what it does with your data.

Payment platforms (independent controllers): Purchases are billed by Apple (App Store), Google (Google Play), or Paddle (merchant of record for website purchases). These platforms process your payment and billing data under their own privacy policies, and rumi.coach never receives or stores any of your payment card details. Where these platforms process data outside the EEA, they do so under their own GDPR transfer safeguards.

Legal requirements: We may disclose your data if required by law, court order, or other legal process, or where necessary to protect the rights, safety, or property of rumi.coach or others. We will notify you of any such disclosure where legally permitted to do so.

Business transfers: In the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred as part of that transaction. We will notify you in advance and your rights under this Policy will continue to apply.

7. Data Retention

We retain your personal data only for as long as necessary for the purpose for which it was collected, or as required by law.

When you delete your account, your memories, session recaps, Dashboard outputs and profile details are erased immediately as part of that request, and in any case all personal data is permanently deleted within 30 days, except where we are required by law to retain it (e.g. payment records for tax purposes). What survives is a record of the session with no content in it — its date, duration and the minutes it consumed — which we keep as a business and billing record and which no longer identifies you.

8. Cookies

We use cookies on our public website only. We do not use cookies inside the app beyond what is strictly necessary for authentication and session security.

Strictly necessary cookies: Required for the website and application to function — authentication, security tokens, session state. These cannot be disabled.

Analytics cookies (Google Analytics): Used to understand how visitors navigate our public website. These are only placed with your consent via our cookie banner. You may withdraw or change your consent at any time via Cookie settings.

We do not use advertising cookies, tracking pixels, or any third-party marketing cookies.

The cookies we use are:

Cookie durations above are the maximum lifetime of the cookie in your browser. The analytics data itself is retained by Google Analytics for up to 14 months (see Section 7).

9. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights, which you may exercise at any time:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten"), subject to our legal retention obligations.
• Right to restriction (Art. 18): Request that we limit processing of your data in certain circumstances.
• Right to data portability (Art. 20): Request your data in a structured, machine-readable format to transfer to another service.
• Right to object (Art. 21): Object to processing based on legitimate interests, including any direct marketing.
• Right to withdraw consent: Where processing is based on consent (e.g. analytics cookies), you may withdraw it at any time.
• Right not to be subject to automated decision-making (Art. 22): We do not make any automated decisions that produce legal or significant effects about you.

How to exercise your rights: You may exercise any of the above rights through your account settings, or by contacting us at support@rumi.coach. We will respond within 30 days. We may ask you to verify your identity before processing your request.

Right to lodge a complaint: If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Portuguese data protection authority:

Comissão Nacional de Proteção de Dados (CNPD)
Rua de São Bento, 148-3º
1200-821 Lisboa, Portugal
www.cnpd.pt

You may also contact the data protection authority in your country of residence if you are located in another EU member state.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or destruction. These include:

• Encryption of data in transit (TLS) and at rest (AES-256) on Google Cloud
• Access controls limiting who within our team can access personal data
• Regular security reviews
• In-memory-only processing of voice audio with no write operations to any storage system

No system is perfectly secure. If we become aware of a data breach that is likely to affect your rights and freedoms, we will notify the CNPD within 72 hours and notify you without undue delay, as required by GDPR Art. 33–34.

11. Children's Privacy

The Service is not directed at anyone under the age of 16. We do not knowingly collect personal data from anyone under 16. If we become aware that we have inadvertently collected data from a user under 16, we will delete that data and close the account promptly. If you believe a child under 16 has created an account, please contact us at support@rumi.coach.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 14 days before the new policy takes effect. The updated policy will always be available at rumi.coach/privacy-policy. Your continued use of the Service after the effective date constitutes acceptance of the updated policy. If you do not agree, you may delete your account before the changes take effect.

13. Contact

For any privacy-related questions, data subject requests, or concerns, please contact us:

RUMI LABS, LDA
Travessa Velha do Picoto 125, 3700-638 Cesar
Cesar, Portugal

Email: support@rumi.coach
Website: rumi.coach/support

We aim to respond to all privacy enquiries within 5 business days.