Privacy Notice

TenantVolt is operated by ROMM Technology. For account, billing and usage data we act as the data controller. For the business records you enter into your workspace — customers, patients, guests, orders — you are the controller and we act as your processor, handling that data only on your instructions to provide the service.

• Account data (name, email, password hash, business name, industry) — to create and secure your account and workspace. Legal basis: performance of a contract.
• Team and role data (memberships, roles, invitations) — to enforce role-based access control. Legal basis: contract.
• Business records you enter (customers, reservations, tickets, clinical and prescription records) — stored and processed to provide the service to you. Legal basis: contract; you are responsible for your own lawful basis toward your customers.
• Support messages — to answer your questions. Legal basis: legitimate interest in supporting customers.
• Usage and telemetry, device identifiers, IP address, audit logs — to secure the platform, detect fraud and abuse, apply rate limits and improve the product. Legal basis: legitimate interest in security and service improvement.
• Subscription state (plan, status, renewal dates, transaction references) — to grant the right entitlements. Card details are never collected or seen by us; they are handled entirely by Paddle.

• Merchant of Record — Paddle.com, for the sale of subscriptions, payments, subscription management, invoicing and tax compliance.
• Service providers and subprocessors — cloud hosting, managed database and authentication infrastructure, email delivery and error monitoring, all bound by confidentiality and data-protection terms.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where required by law or to protect rights and safety.

We do not sell personal data.

Our infrastructure and subprocessors may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

We keep account and workspace data for as long as your business is active. When you close a business we retain it for the stated grace period so you can change your mind and export it, then permanently delete or anonymise it. Immutable audit and tenancy-lifecycle records are retained for a limited period for security, dispute and legal-compliance purposes. Billing records are retained as long as tax law requires.

Depending on where you live, you may have the right to access, rectify, erase, restrict or port your personal data, to object to processing based on legitimate interests, to withdraw consent, and to complain to your supervisory authority. Contact us through our support page and we will respond within one month. You can also export your workspace data and delete your account directly in the app.

We apply appropriate technical and organisational measures: encryption in transit and at rest, strict tenant isolation enforced at the database level with row-level security, role-based access control, audit logging of privileged actions, and rate limiting. No system is perfectly secure, but we work continuously to protect your data.

We use essential cookies and local storage to keep you signed in, remember your active business and your light or dark theme preference. Our checkout provider sets its own cookies during payment. We do not use advertising cookies. You can clear or block cookies in your browser, though the app will not function correctly without the essential ones.

Data-protection questions can be raised with ROMM Technology through our support page.