Privacy Policy

roomZy automates the bays in entertainment facilities — power, lighting, door access and bookings. This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have. It applies to roomzy.io, the roomZy dashboard, our booking pages, and the roomZy equipment installed in a facility.

Two kinds of people are covered here

Operators — the facility owners and staff who hold a roomZy account.
Guests — the people who book and use a bay. For guest information, the facility decides what is collected and why; roomZy handles it on the facility's behalf and under its instructions.

If you are a guest, the facility you booked with is your first point of contact — and we help them answer you.

Who we are

roomZy is a Canadian business providing facility automation and booking software. We are responsible for the personal information under our control, including information handled by the service providers listed below. Questions, requests and complaints go to privacy@roomzy.io.

What we collect

From operators and their staff

Account and contact details — name, e-mail address, phone number, role, and the facility you belong to.
Facility information — your venue's name, address, hours, bay layout, pricing and equipment configuration.
Sign-in records — authentication events and the security details needed to keep accounts safe.
Support correspondence — what you send us when you ask for help, and our replies.

About guests, on the facility's behalf

Booking details — name, e-mail address, phone number, the bay and time booked, anyone listed as attending, and notes the facility records.
Payment status — whether a booking is paid, deposits taken, balances owed, gift cards and memberships. We never see or store full card numbers — see Payments below.
Visit history — past and upcoming bookings, session start and stop times, and time used beyond a booking.
Verification codes — short-lived codes e-mailed to confirm a booking or unlock a balance, and the device they were issued to.

From the equipment in a facility

Bay activity — when a bay powered on and off, which sequence ran, and whether equipment answered.
Equipment health — the status of controllers, outlets, projectors, lighting and locks, so we can tell you when something stops responding.
Bay computers — where the roomZy Concierge software is installed on a facility's simulator PC, it reports machine health (processor, memory, disk, uptime, network quality) and whether the simulator is running. It does not capture the screen, keystrokes, audio or video, and it does not read files.
Cameras — roomZy does not host, record or stream video.

From this website

Analytics — we use Google Analytics to understand which pages are read. It sets cookies and records a truncated network address, pages viewed and general region. You can block it with your browser's cookie settings or an ad blocker, and the site works without it.
Forms — what you type into a demo request, beta application or survey, so we can reply.
E-mail — if you are on a roomZy mailing list, we record whether a message was delivered and whether you unsubscribed. We do not track whether you open our e-mails or click the links inside them — link tracking is switched off across our account.

Why we use it

To run the service — take bookings, fire the bays, open doors, send confirmations, and show operators what happened.
To take payment — where a facility sells through roomZy, to charge, refund and reconcile through Stripe.
To support you — diagnose a bay that did not start, recover an account, answer a question.
To keep the service secure — detect abuse, rate-limit misuse, and protect accounts and equipment.
To improve the product — understand which features are used and where operators get stuck.
To tell you about roomZy — only where you have asked to hear from us, and every message carries an unsubscribe link.

We ask for consent where the law requires it, and we rely on your consent for marketing e-mail. We do not sell personal information, and we do not use guest information for our own advertising.

Payments

Card payments are processed by Stripe. Card details are entered directly into Stripe's systems and stored by Stripe — roomZy never receives or stores a full card number. Where a facility keeps a card on file, that card lives at Stripe under the facility's own Stripe account, and money moves from the guest to the facility. roomZy does not hold operators' funds. Stripe's handling of that information is governed by Stripe's privacy policy.

Who we share it with

We share personal information only with the service providers that make roomZy work, and only as much as each one needs:

Service providers

Google Cloud / Firebase — application hosting, database, sign-in and file storage (United States).
Stripe — payment processing.
Twilio SendGrid — sending booking confirmations and account e-mail.
EMQX Cloud — the secure messaging link between our servers and the equipment in a facility.
Seam — only where a facility connects a smart lock, to issue and revoke door codes.

We also share information with a facility about its own guests — that is the point of the service. We may disclose information if the law requires it, to protect our rights or someone's safety, or as part of a sale or reorganisation of the business, in which case this policy continues to apply until you are told otherwise.

Where it is stored

roomZy runs on Google Cloud infrastructure in the United States, and the service providers above may process information in the United States and elsewhere. Information stored outside Canada is subject to the laws of that country, including lawful access requests by its courts and authorities. We require our providers to protect personal information to a standard comparable to ours.

How long we keep it

Account and facility information is kept while the account is open. Booking and guest records are kept while the facility needs them to run its business and to meet its own tax and accounting obligations. Operational records — bay sessions, equipment health, security logs — are kept for a limited period for support, billing and security, then deleted or aggregated so they no longer identify anyone. When an account closes, we delete or anonymise the information we hold within a reasonable period, except where we must keep it by law.

How we protect it

Traffic between your browser, our servers and facility equipment is encrypted in transit, and stored information is encrypted at rest. Each facility's equipment holds its own credentials, scoped so it can only reach its own site. Access to production data is limited to the people who need it. No system is perfect, but if a breach creates a real risk of significant harm, we will notify the people affected and the Privacy Commissioner as the law requires.

Children

roomZy is sold to businesses and is not directed at children. Facilities may record a booking made by a parent or guardian for a family; we do not knowingly collect information directly from a child.

Your rights

Access — ask what personal information we hold about you and how it has been used.
Correction — have inaccurate or incomplete information fixed.
Withdraw consent — including unsubscribing from marketing at any time. Some withdrawals mean we can no longer provide part of the service, and we will tell you if that is the case.
Complain — to us first, at privacy@roomzy.io. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada.

We answer requests within 30 days. We may need to confirm who you are before we act. If you are a guest of a facility, contact that facility — it decides what happens to its guest records, and we will assist it in responding to you.

Changes to this policy

If we change this policy we will update the date at the top of this page, and we will tell account holders directly when a change is significant.

Contact

Privacy questions and requests: privacy@roomzy.io
Everything else: support@roomzy.io

roomZy

Privacy questions? Email privacy@roomzy.io.