How RoamBook uses personal data: for readers of every reader powered by RoamBook, the people in clients' content, client staff and business contacts.
Last updated: 26 October 2026. Interim version, under legal review.
The short version. RoamBook runs the reader you are using for the client. We keep your account, learn what you like (if you are 18 or over) and run the personal guide. You can switch suggestions off, download your data or delete your account at any time on My profile. We never sell your data. The client sees your name and email if you have an account, but never what you watch or ask. Questions: privacy@roambook.io.
1.1 RoamBook is run by Outfly Innovation Ltd, a company registered in England and Wales (company number 07119494), registered office Fora Space, 42–46 Princelet Street, London E1 5LP ("RoamBook", "we", "us"). We have applied to register with the Information Commissioner's Office (ICO) and will add our registration number here when we receive it.
1.2 Questions about this policy or your data: privacy@roambook.io, or write to Outfly Innovation Ltd (Privacy), Fora Space, 42–46 Princelet Street, London E1 5LP.
RoamBook lets organisations ("clients") publish books and short video and audio clips linked to the words of those books. Readers use each client's reader, shown as "(client name) powered by RoamBook". Who is responsible for your data depends on who you are:
If you read without signing in
If you create an account
4.1 What we do. If the client's reader offers personalised suggestions and you are 18 or over, we learn which kinds of content you enjoy in that client's reader — from what you watch, finish, skip, save, share and read — and put clips you are likely to value first (for example "For you" and "Keep going"). We learn from the client's tags, such as topics, themes, speakers and formats.
4.2 Heritage tags. If the client has switched on heritage matching, we also learn which heritage tags appear on the clips you watch (tags the client has added about a speaker's heritage, with the speaker's agreement), and give similar voices a boost. We never ask for your own heritage and never label you with one. But a preference for voices of a particular heritage could suggest something about your own background. We treat it with extra care: it is used only to order your suggestions in that client's reader, it is never shown to the client or anyone else, never sent to an AI service, and you can switch it off at any time. Heritage learning has its own switch on My profile: it is on by default for adults where the client has switched heritage matching on, and you can switch it off on its own and keep the rest of your suggestions.
4.3 Our lawful basis is our legitimate interests in offering a reader that helps people find content they value. We have weighed this against your interests and rights: it only re-orders suggestions, is limited to one client's reader, keeps raw activity for no more than 180 days, is never used for under-18s, and you can switch it off at any moment. For heritage tags, our position is that learning from tags on content is not processing of your own ethnic origin; we have considered the Information Commissioner's Office's guidance on heritage learning. We have not made a formal consultation. If that view changes, we will update this policy and tell you before relying on a different basis. You can read our assessment on request.
4.4 It is on by default if you are 18 or over when you create your account. You have the right to object at any time by switching it off on My profile; that deletes what we have learned straight away. You can also clear your suggestions, see why a clip was suggested ("Why am I seeing this?" — reasons never name sensitive tags), and mark a clip "Not interested". You can switch off heritage learning on its own. If you turn 18 while you have an account, it stays off until you switch it on.
4.5 What it never does. It never hides content or decides what you can access or pay, and it has no legal or similarly significant effect on you. Your interests are never shown to the client, never sent to any AI service, and never turned into embeddings. RoamBook staff can see them only to support you or keep the service secure; access through our support tools is logged. About 1 in 10 readers see suggestions in the ordinary order so that we can check personalisation really helps; this withholds nothing.
5.1 Some clients let you choose voices you would like to hear more from — for example speakers of a particular heritage, where speakers have agreed to be tagged that way. This is a choice about content, not a question about you, and you never have to make it.
5.2 You can keep the choice for this visit only (it stays in your browser tab and is forgotten when you close it; it is sent to us only to order your suggestions and is not stored) or remember it on your account until you clear it or delete your account. Visit-only choices are open to readers who are not signed in.
5.3 Your choice only boosts matching voices in your suggestions; it never hides anything. It is never shown to the client, never sent to an AI service, and never used for anything else. Its lawful basis is the same as section 4.3.
5.4 How heritage matching works between us and the client. The client adds heritage tags to its speakers with their consent and is responsible for them. We use those tags to order suggestions for readers. The client obtains and records speakers' consent, including to this use, and answers speakers' requests. RoamBook is responsible for its own use of the tags to order suggestions, answers readers' requests and keeps reader preferences private. Either of us will pass on requests to the other.
6.1 Some clients offer a personal guide to signed-in readers aged 18 or over who have accepted the Terms. The client may give it its own name. It is an automated service that uses AI language models, not a person. When you ask a question, we search that client's published books, approved clips and the notes the client has given it, and send your question, the recent messages in your conversation and the passages found to an AI model run by Anthropic, in the United States (through Vercel AI Gateway), which writes the answer.
6.2 We keep each conversation (your messages, the answers and the sources cited), your account identifier, a session identifier and a scrambled (salted hash) form of your IP address, for 90 days, then delete them. If you delete your account we delete your conversations too. They are included when you download your data. The client cannot read your conversations; it sees only totals (such as the number of questions asked).
6.3 Lawful basis: performance of our contract with you (providing the personal guide you chose to use) and our legitimate interests in keeping it safe, preventing misuse and controlling cost. We do not use your conversations to train AI models. Under our AI suppliers' business terms, they do not train their models on them; they may keep requests for a limited time to detect abuse. We switch on zero retention where a supplier offers it.
6.4 Please do not share personal details about yourself or others. The personal guide tries to recognise messages that suggest someone may be at risk, and then shows emergency and support contacts instead of a written answer. This works for everyone, signed in or not. We do not store that message; we keep only a count that is not linked to you.
6.5 The personal guide does not make decisions about you. Its answers can be wrong; it shows its sources so you can check them.
7.1 Clients upload recordings and add details such as speakers' names and tags. Some tags can be sensitive — for example a speaker's heritage or ethnicity. The client is responsible for this information. It must have the right to publish the recording and must have the speaker's explicit consent before adding a sensitive tag. Each time a client uploads, it confirms that it owns or has permission to use the content, and that everyone who appears in it has agreed to appear in it and to the tags it gives them, with explicit consent for any sensitive tag, including for RoamBook to suggest voices.
7.2 We store, caption, transcribe and show this content for the client. To do so: recordings are processed by our video provider (Mux); audio may be sent to OpenAI's speech-to-text service for captions in languages Mux does not caption; transcripts are sent to AI services to suggest clips, links and ordinary tags; posters and chapter images may be read by Google's AI. The content may appear in share images that readers post to other services, in printed editions with QR codes, in notifications and in phone apps. Sensitive tags are never sent to AI services and never used to suggest tags. They are not shown to readers unless the client chooses to show labels, with the speaker's consent. If the client switches heritage matching on, they are used to order suggestions for readers (sections 4.2 and 5).
7.3 If you appear in a client's content, please contact the client to exercise your rights. If you contact us, we will pass your request to the client and help it respond.
8.1 If you ask for notifications on your device — with or without an account — we store the device's push address, your time zone, the topics you chose and up to 5 books you are reading. We use them to send "Today's words" (a short daily passage) and news of new clips, outside quiet hours. Notifications are delivered through your browser's or phone's push service.
8.2 You can turn them off at any time in your device settings or on My profile, and from the link in each notification. Before your device asks you, we explain what we will send. If you are 13 to 17 they start switched off. Lawful basis: your request, and our legitimate interests in sending what you asked for. You can object at any time and we will stop.
9.1 The client whose reader you use can see, for readers who have an account with its reader: your name and email address; your status (active, blocked or removed); how you joined (for example invited or signed up); when you joined and were last seen; how many clips you have saved (the number only); whether you are under 18 (not your date of birth); your subscription or membership status with the client (including whether you asked to be told when you can subscribe); and any notes the client adds. Clients can block or remove a reader, give complimentary access, and export this list. If a client blocks you, it keeps a scrambled form of your email address so the block still works if you delete your account and sign up again. When the client uses these details it is responsible for them as a controller in its own right, under its own privacy notice.
9.2 Clients never see your date of birth, your learned interests, your heritage-tag learning or "voices" choice, which clips you saved, your reading history or your personal guide conversations. They see only totals across readers (for example how often a clip is played), with small groups hidden.
9.3 Emails from the client. We send sign-in links and account emails, and invitations a client asks us to send, sometimes in the client's name. A client may email you about its own services only if it has your consent or another lawful basis, with a way to unsubscribe. Readers under 18 get no client emails other than sign-in and account emails. The client's reader list marks readers under 18 so that it can follow this rule.
We do not use advertising cookies or cross-site tracking. If your browser sends Do Not Track or Global Privacy Control, we send no statistics at all. You can also switch off statistics on this device with "Don't count my visits" in the reader's settings.
11.1 We do not sell personal data. We share it only with:
11.2 Our suppliers (sub-processors), as at 26 October 2026. We keep this list up to date and record changes. Suppliers marked "planned" are not used yet.
11.3 Independent organisations:
12.1 Our database is in Ireland and our application runs in Dublin; the UK recognises the EU as providing adequate protection. Reader pages are delivered through Vercel's worldwide network. Some suppliers — for video, AI, email support access, backups and alerts — are in the United States or may access data from there. For those transfers we rely on the UK–US data bridge where the supplier is certified, or otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You can ask us for details.
12.2 We never send your learned interests, heritage-tag learning or "voices" choice to an AI service. Personal guide questions are sent to a US AI provider — another reason not to include personal details.
14.1 Your right to object. You can object at any time to our use of your data based on legitimate interests, including personalised suggestions and notifications. The quickest way is the switch on My profile, or turning notifications off. You can also email us.
14.2 You also have the right to: access your data; have it corrected; have it deleted; restrict how it is used; receive it in a portable format; and withdraw consent where we rely on consent.
14.3 Most of this you can do yourself on My profile: switch personalisation off, clear your suggestions or your "voices" choice, Download my data, and Delete my account. For anything else, email privacy@roambook.io. We will reply within one month (we may extend this by two further months for complex requests and will tell you why). If you use the same sign-in with two clients' readers, deleting your account with one client deletes your data there; your sign-in itself is kept while you use it with another client.
14.4 Statistics with random identifiers cannot be linked to you, so we cannot find, give you or delete them for a particular person.
14.5 Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
14.6 Complaints. Please tell us first at privacy@roambook.io. We will acknowledge your complaint within 5 working days and reply in full within 30 days. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
15.1 You must be at least 13 to create an account. We ask for your date of birth when you create one. If you are 13 to 17: no personalised suggestions, no heritage learning, no personal guide, notifications start switched off, no client emails other than sign-in and account emails, and the client's WhatsApp community link is hidden until you are 16. When you turn 18 these features become available but stay off until you switch them on. If we do not know your age, we treat you as 13 to 17.
15.2 If you read without signing in we do not know your age, and we do not build a profile of you. Community links and notification prompts are not shown to readers who are not signed in.
15.3 Some clients publish content for children and young people; they are responsible for making their content suitable. If you believe a child under 13 has an account, tell us and we will delete it. We are writing a short version of this policy for 13 to 17-year-olds.
16.1 Data is encrypted in transit and at rest. Each client's data is kept apart in the application and in the database, which applies row-level security rules; private data can be read only by our servers. Studio access is invite-only and logged; RoamBook staff sign in with Google accounts that require 2-step verification. We use rate limits, monitoring and encrypted backups. No system is perfectly secure; if a breach is likely to put you at high risk, we will tell you without undue delay, and we will tell the ICO where the law requires.
17.1 If you are in the EU or EEA, you have the same rights under the EU GDPR. If we offer the service to readers in the EU, we will appoint a representative there (Article 27 EU GDPR) and name them here. The personal guide is labelled as automated (AI), in line with the EU AI Act.
18.1 We will update this page when our services or the law change, and change the date at the top. If a change is significant, we will tell you in the reader, the Studio or by email before it takes effect.