Privacy Policy

There are two kinds of personal data in Roundo, and we treat them differently:

• Your account data: the information about you as a Roundo user. For this we are the “data controller”.
• Your customers’ data: the records you enter about the people you do work for. For this you are the controller and Roundo is your “data processor”: we only handle it to provide the Service to you, and we don’t use it for our own purposes.

This policy covers both, and acts as the data-processing terms for the customer data you entrust to us.

About you, as a Roundo user:

• Account details: your name, email address and a securely hashed password.
• Technical data: your IP address and basic device/browser information, and a single sign-in cookie needed to keep you logged in.
• Messages you send us: for example support emails.

About your customers, entered and controlled by you:

• Names, addresses, phone numbers and email addresses.
• Job details, schedules, prices, and payment and completion history.

• To provide and run the Service for you, on the basis of our contract with you (these are our Terms of Service).
• To keep the Service secure, prevent abuse and improve it, on the basis of our legitimate interests in running a safe, working product.
• To contact you about your account, security or important changes, on the basis of contract and legitimate interests.
• To measure whether our own advertising works, on the basis of our legitimate interests in understanding which adverts bring people to Roundo. You can object to this at any time: see section 9.
• To count visits to our website and record how its pages are used, on the basis of our legitimate interests in understanding how our own website is used so we can improve it. This applies to our website only, never inside your account, and section 4 explains it. You can object to this at any time: see section 9.
• To meet legal obligations where they apply.

We don’t sell your data. We never use your customers’ data for advertising, or for any purpose other than running Roundo for you. The only advertising-related processing we do involves your own account email address, and section 6 explains it in full.

We keep cookies to a minimum. Roundo sets one strictly-necessary cookie that signs you in and keeps you logged in. It can’t be switched off because the app won’t work without it, and under the rules it doesn’t require a consent banner. We don’t use advertising or third-party tracking cookies.

We do measure whether our advertising works, but we do it from our own server rather than with a tracking pixel in your browser. Nothing is stored on or read from your device for advertising, which is why there’s no cookie banner on this site. Section 6 sets out what we share and who with.

We also count visits using Cloudflare Web Analytics, which is cookieless: it sets no cookie, stores nothing on your device and can’t follow you across other sites, so it needs no consent banner either. It runs on this website and on the app’s sign-in, sign-up, password-reset and invite screens, so we can see how many people reach the sign-up form. It is not used inside your account: once you’re signed in, none of the work you do in Roundo is measured this way.

On this website (roundo.io) we also record how pages are used, with Microsoft Clarity. That means your mouse movement, clicks, taps and how far you scroll are captured and can be played back, so we can see which parts of a page people actually read and where they give up. Anything typed into a page is masked. It’s cookieless: it sets no cookie and stores nothing on your device, so it can’t follow you across other sites or link one visit to another, and it needs no consent banner. It is not used inside the Roundo app: nothing you or your customers do in a signed-in account is ever recorded. We rely on our legitimate interests in understanding how our own website is used, and you can object at any time by emailing support@roundo.io.

Roundo is hosted on Amazon Web Services in the London (eu-west-2) region, so your data is stored in the United Kingdom. There are two routine exceptions, both listed in section 6. The advertising measurement sends a limited amount of data to Meta, and the website recording described in section 4 sends page-interaction data to Microsoft; the processing by either may take place outside the UK. Those transfers rely on the standard contractual clauses and the UK International Data Transfer Addendum in Meta’s business tools terms and Microsoft’s data protection terms respectively.

We use a small number of trusted providers (“sub-processors”) to run Roundo. They only process data to provide their service to us:

• Amazon Web Services (UK / eu-west-2): application hosting, database and file storage.
• Amazon Simple Email Service (UK / eu-west-2): sending account and password-reset emails.
• Cloudflare: cookieless visit counting on this website and on the app’s signed-out screens (sign-in, sign-up, password reset and invite), as described in section 4.
• Microsoft (Microsoft Clarity): cookieless recording of how pages on this website are used, as described in section 4. Never used inside the app. Microsoft’s processing may take place outside the UK, and that transfer relies on the standard contractual clauses and the UK International Data Transfer Addendum in Microsoft’s data protection terms.

As we add features such as subscription billing or Direct Debit, we’ll add the relevant providers (for example Stripe or GoCardless) here before they go live.

Advertising measurement

Separately from those sub-processors, we share a small amount of data with Meta Platforms Ireland Limited to measure our own advertising. If you create a Roundo account after seeing one of our adverts, we send Meta:

• your email address, converted into a one-way code before it leaves our server, so Meta never receives it in readable form;
• your IP address and browser user-agent string;
• an identifier from the advert you clicked, where there was one.

Meta uses this to tell us that an advert led to a sign-up. For that purpose Meta acts as a controller in its own right, not as our processor. We never send your customers’ data to Meta, and we never send anything about the work you do or the money you take.

We rely on our legitimate interests in understanding which of our adverts work. We’ve weighed that against your privacy: the data is limited, your email address is one-way coded before it leaves us, nothing is stored on your device, and none of your customers’ data is involved. You can object at any time by emailing support@roundo.io, and we’ll stop including you.

We keep your account and the data in it for as long as your account is open. If you close your account we delete or anonymise your data within a reasonable period, except where we need to keep limited records to meet a legal obligation or resolve a dispute. You can ask us to delete your account at any time.

Data is encrypted in transit (HTTPS/TLS), passwords are stored only as a strong one-way hash (we never see your password), and access to production systems is restricted. No system is perfectly secure, but we take reasonable steps to protect your data.

Under UK data protection law you have the right to access your data, correct it, delete it, restrict or object to how we use it, and to data portability. To exercise any of these for your own account, email support@roundo.io.

Where we rely on our legitimate interests, including the advertising measurement in section 6, you have a specific right to object. Email us at the address above and we’ll stop that processing for you.

If your request is about a customer’s data held in a Roundo account, that business is the controller; contact them, or let us know and we’ll help them respond.

Roundo is a tool for businesses and isn’t directed at children. We don’t knowingly collect data about anyone under 18 as a Roundo user.

We may update this policy as Roundo grows. If we make a significant change we’ll let you know, and we’ll always show the “last updated” date at the top.

For any privacy question, email support@roundo.io, or write to us at Antumbra Ltd, 66 Paul Street, London, EC2A 4NA. If you’re unhappy with how we’ve handled your data you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to put things right first.