Room Word Privacy Policy

ROOMWORD-PRIVACY-20261110-B1.0 · Effective November 10, 2026

PRIV-01 — Who we are and scope

海口织机科技有限责任公司 (English translation: Haikou Zhiji Technology Co., Ltd.) operates the Room Word product under the Loom brand (full name Loom Voice). Its registered address is No. 45, Block B, 15th Floor, New HNA Building, No. 7 Guoxing Avenue, Lantian Street, Meilan District, Haikou, Hainan, 570100 China. Contact support@loom-us.com for privacy matters.

This Policy covers website visitors, store owners’ accounts and billing, authorized Account users (one linked account for the website and App), support enquiries and people interacting with a store’s enabled telephone or workflow service. The website Merchant Portal is for owners only. It is separate from Creem’s billing portal and privacy notice.

PRIV-02 — Information by activity

Account and store information includes name, business email and contact details, store name, type, country/state, address, time zone, role and account-to-store permissions. App operations can include staff and Consumer names, schedules, services, appointments, records and authorized team messages.

Store setup information includes menus, services and prices, business hours, staff schedules and call-transfer rules, photos or files of these that the owner uploads, and documents added to the store's knowledge base. A store may also import Consumer names, telephone numbers, appointment summaries (such as the most recent visit, service and preferred staff member), allergy or other notes the store keeps, and text-message consent status and its source.

Enabled telephone features can process caller identifiers, call time and duration, voice/audio, permitted recordings, transcripts, translations, summaries and enquiry or appointment details. Ordinary recording is not described here as voiceprint identification. Unnecessary sensitive information should not be supplied.

Order data includes Subscriber, checkout, transaction and subscription references, selected plan and interval, amounts, payment/refund status, paid-through dates and minute-pack expiry. Creem receives the payment, billing/address/tax information requested in its form directly. The Company receives reconciliation records, not your full payment-card number through this integration. If you enable Auto-refill, Creem stores and charges the payment method saved at your checkout under its own Privacy Notice; the Company receives the refill order, status and your Auto-refill settings and limits, not your full card number.

The current contact form prepares a local email draft from name, email, topic and message, with optional store and usage details. It does not automatically send a message or submit a ticket. Once you send the email, the email provider and Company receive its contents. Technical information can include IP address, device/browser details, request times, errors, security records and service usage.

PRIV-03 — Sources

Sources include merchants, owners and authorized staff, callers and other Consumers, Account users (website and App), integrations directed by a store, customer lists and future appointments imported by a store, store setup materials uploaded by the owner, payment transaction records and systems that run enabled services. Sources and collected fields depend on the feature actually used; device permissions do not by themselves define all server-side processing.

PRIV-04 — Purposes and AI use

The intended purposes are account and store access, organizing store setup information and the store's knowledge base, configured calls and bookings, displaying authorized business records, calculating usage and minutes, reconciling payments and entitlements, support, security, fraud prevention and legally required records. Each enabled data flow must be matched to these purposes before production use.

This Policy does not authorize recordings, transcripts or team messages for model training, advertising or unrelated reuse. Any service-quality evaluation or model-improvement use needs its own verified scope, legal basis, notice and provider controls. Provider training and retention settings must be verified before a “no third-party training” claim is published. Whether DeepSeek uses data submitted through its API to train its models has not yet been verified. OpenAI states that data sent through its API is not used to train or improve its models unless the customer chooses to share it, and that it keeps API abuse-monitoring logs for up to 30 days unless longer retention is required by law.

PRIV-05 — Call notices and caller choices

Calls to a store that uses Room Word may be recorded and transcribed as described in PRIV-02 and PRIV-09. Call notices follow the law that applies to each call, based on the store's location and the caller's telephone number. Where the applicable law requires it, you are told at the start of the call that the call is recorded and/or that you are speaking with an AI assistant. Where no such notice is required, if you ask whether you are speaking with a person, the AI assistant will truthfully tell you it is an AI assistant; it never claims to be a human. An owner's or employee's acceptance of the store's terms does not give consent on a caller's behalf.

You may ask not to be recorded. Recording then stops, any portion already recorded is deleted, and no transcript of the rest of the call is kept; the call continues so your request can be completed, and only the information needed for your booking is kept.

PRIV-06 — App permissions and communications

Displaying telephone-system call records in the App does not itself require recording through the device microphone. The released build’s permissions and SDK behavior must be verified. Optional microphone, photo/media or notification access, if a feature actually requires it, must have a purpose-specific notice; denial or revocation affects that feature, not a blanket right to all device information.

Creem may send transaction receipts and billing-portal access messages. The Company may respond to support enquiries and send enabled service messages. These messages do not prove telephone activation. A purchase, App download or policy acknowledgment is not unrelated marketing consent; marketing and unsubscribe controls require separate approval and configuration.

Service emails from the Company, such as account invitations and sign-in links, are sent from support@loom-us.com, an address operated by the Company; replies go to support@loom-us.com.

Text messages. Where a store enables text messages, such as appointment confirmations or reminders, they are sent only to Consumers who have agreed to receive messages from that store. Consent given to one store does not extend to any other business. Message and data rates may apply. Reply STOP to stop receiving messages or HELP for help. Mobile numbers and text-message consent are not shared with third parties or affiliates for their marketing purposes.

PRIV-07 — Recipients and third-party categories

The following maps intended service-related disclosures by data and purpose. It avoids a public internal-provider roster. Specific recipient information or provider-change notices are supplied where required by applicable law or an approved data-processing agreement. The actual production map and past-12-month disclosures must be verified before effectiveness.

Creem is the merchant of record for checkout, subscriptions and its customer billing portal. Its own Privacy Notice explains its payment-data roles. A separate approved data-processing agreement governs any service-provider obligations for operational data; being included in a category does not itself prove a provider has that agreement.

Creem Privacy Notice: https://www.creem.io/privacy.

The AI and voice processing services include DeepSeek, which processes data in China, and OpenAI, which processes data in the United States, as described in PRIV-08.

Recipient category	Information category	Purpose
Relevant store and authorized Account users	Consumer/call/appointment records and authorized team messages	Business service and coordination within role permissions
Payment and billing services (Creem)	Identity/contact, order, transaction, billing and payment information	Checkout, tax, renewal, invoice, refund and billing-portal management
AI and voice processing services	Audio, caller requests, transcripts, translations and summaries as enabled; store setup materials, uploaded photos and documents, and knowledge-base content	Understand/respond to calls, create the configured records, and organize store information and the knowledge base
Telephone and text-message delivery services	Caller identifiers, call/routing metadata and audio as required; recipient numbers and message content for enabled text messages	Connect, route and deliver calls and text messages
Cloud hosting, storage and security services	Enabled account, operational and technical/security records	Run, store, back up and protect the service within approved limits
Email and support services	Contact details, enquiry/message and relevant order references	Deliver enabled correspondence and handle support
Professional advisers and authorities where legally required	Minimum records relevant to the particular obligation or claim	Legal/accounting obligations, disputes and lawful requests

PRIV-08 — Data roles and international processing

The store may determine the purposes of its Consumer and operational records, while the Company processes them on its behalf. The Company also handles account, security, billing and support records for its own purposes. Creem has its own roles for its payment and customer services. Roles must be assessed by activity; this Policy alone is not a complete or executed data-processing agreement.

The Company is registered in China and serves businesses through international services. Data may be processed where the Company and authorized providers operate. The service's backend and databases are hosted on Alibaba Cloud in North America, and the website is hosted on Netlify. AI providers used for store setup and call handling may process data in other locations. Some store setup materials (such as menus, price lists and photos) and call content (such as caller requests and transcripts) are processed by DeepSeek, an AI service operated by 杭州深度求索人工智能基础技术研究有限公司 (Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd.), located in Hangzhou, China. DeepSeek's servers are in the People's Republic of China, so this information may be processed and stored in China. Call audio (listening and speaking during calls), caller requests and transcripts, and knowledge-base content are also processed by OpenAI, an AI service operated by OpenAI, a company based in San Francisco, California, United States, so this information may be processed in the United States. Backups, remote access locations and applicable transfer mechanisms require verification. This Policy makes no United States-only storage, executed standard contractual clauses or completed cross-border compliance claim.

PRIV-09 — Retention, archive and deletion

The proposed retention approach limits data to the time needed for the particular service, store instructions, unresolved support, security or disputes, and required accounting or legal obligations. Category-specific limits, legal holds, provider copies and backup cycles must be documented and tested before this Policy is effective. Draft periods pending legal approval: call recordings are kept on the server for one week and cached on the store's phone; original transcripts, translations and in-store chat are kept in the cloud for 30 days; Consumer phone numbers and booking records are kept long-term. Original spreadsheets and photos uploaded for store setup are deleted after the information is checked and confirmed; no separate copy is kept. Suspending a Merchant or store does not delete its data.

Archiving a store is reversible and preserves purchase records; it is not account deletion or cancellation. Account or personal-data deletion is a separate request, subject to verified authority and lawful exceptions. Data no longer needed should be deleted or de-identified according to the approved schedule; billing and dispute records are treated separately.

Any export or device cache is separate from cloud retention. Local copies can remain on authorized devices or fail to download; offline access revocation cannot be assumed to remotely erase them. Reinstallation, device loss or cache expiry may remove a local copy. No implemented automatic caching or recovery guarantee is claimed here.

PRIV-10 — Access and security

Access must follow store and role permissions: owner access and staff participation-based access are different. Production authentication, access logging, encryption, backups, deletion controls and incident response need technical evidence. No security certification, breach-notification deadline or fully implemented control is asserted by this Policy. No transmission or storage system is completely secure.

PRIV-11 — Privacy requests and account deletion

Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of information, object to or restrict processing, withdraw consent, or appeal. Email support@loom-us.com or use the website contact page to prepare and send a privacy enquiry. No account is required to make an enquiry. Identify the relevant account, store or call and requested action without including unnecessary identity documents or sensitive information.

We must verify identity or an agent’s authority proportionately and apply the deadlines, exceptions and appeal rights of the applicable law. Callers can contact the store or Company; responsibility must be identified for the particular records. Deleting an account does not automatically cancel store billing or erase another party’s lawfully retained records. The production request workflow must be verified before publication.

PRIV-12 — California disclosure and choices

Where California privacy law applies, the disclosure must reflect actual practices in the preceding 12 months. Potential categories for this service include identifiers; commercial/order records; internet or electronic-network activity; audio/electronic information; employment-related staff information; and appointment or service inferences where generated. Sources, purposes and recipient categories are described above. Whether each category was actually collected or disclosed, and any sensitive information, must be verified before effectiveness.

A service-provider disclosure is not automatically a “sale” or “sharing” for cross-context behavioral advertising. Whether the legal conditions are met must be checked against actual data flows and contracts. The inspected website has no Company advertising or analytics integration; that does not establish a complete past-12-month no-sale/no-share statement for the App and all providers. Required sale/sharing, sensitive-use and opt-out preference-signal disclosures and controls must be completed from the production inventory.

Applicable rights include knowing/accessing, correcting, deleting and obtaining information; opting out of sale or sharing where relevant; limiting qualifying sensitive-information use; using an authorized agent; and receiving service without unlawful discrimination. Required request channels, verification, response and appeal procedures must be operational. Email alone must not be treated as satisfying every business’s channel requirement; applicability and any required second method or toll-free channel need legal review.

PRIV-13 — Browser storage, cookies and embedded payments

The inspected website stores language preference locally and purchase/store or plan-change recovery references per browser tab. Display theme follows the operating system. Necessary authentication/security cookies may be used by connected services. Clearing site data can reset preferences, login and recovery context.

Creem’s script/iframe and billing portal remain third-party services when embedded. They can receive technical requests and payment data when opened, under Creem’s Privacy Notice. New non-essential tracking requires a verified inventory and applicable notices and controls before activation.

PRIV-14 — Children and sensitive information

The product is intended for business use, not as a children’s service. A store may receive family or child-related booking enquiries, so this Policy does not claim no child data is ever processed. Merchants must minimize information and follow applicable age, notice and consent requirements. Do not submit unnecessary health, identity, payment-secret or other sensitive data to general-purpose AI or support. Contact us if inappropriate information has been processed.

PRIV-15 — Changes and one shared policy

The website and App reference the same approved Policy, with a same-version Chinese translation. English controls unless mandatory law provides otherwise. Permission notices and call-opening notices explain a particular activity without creating a separate policy. Material changes require the notices and any separate permission required by law. Reading this page does not itself consent to recording, marketing or unrelated processing.

PRIV-16 — Contact and version

Privacy, access, correction, deletion and support: support@loom-us.com. Sales enquiries: sales@loom-company.com. Operator: 海口织机科技有限责任公司. Shared legal entry: https://loom-us.com/privacy-policy.html, with lang=en or lang=zh. Effective date: November 10, 2026.