Privacy policy

Version of this policy: November 2026

This policy explains which personal data is processed when you visit assistant.rooom.ai, talk to our video avatar, or contact us via the form – who receives it, how long we keep it and what rights you have.

1. Controller and data protection officer

The controller responsible for data processing on this website is:

rooom AG
represented by its Management Board (Vorstand), Hans Elstner (Chairman)
Löbstedter Str. 47a
07749 Jena
Germany
Phone: +49 3641 5549440
E-mail: info@rooom.com

Data protection officer

Landgraf Datenschutz GmbH
Markt 22
07743 Jena
Germany
E-mail: info@landgraf-datenschutz.de

2. The essentials

• No cookies, no tracking, no advertising networks. For visits we only count daily totals, without IP address and without any identifier (section 5).
• The avatar is an AI. The video image and voice of the avatar on our home page are artificially generated. You are talking to an AI, not to a person (section 4.3).
• No connection without your click. Until you start the conversation, the page only shows a still image from our server. Only then does your browser connect to the service provider that runs the video avatar for us and ask for your microphone. Camera and screen are not used on this site.
• The conversation with the video avatar is processed by a specialised service provider on our behalf – your voice, the answers and the video image (section 4.1).
• Some service providers are based outside the EU (hosting, database, error reporting and e-mail delivery in the US; the video avatar may also be processed outside the EU). Where we can choose the location, we choose Europe. Which data goes where is set out in section 10.

3. Hosting, server logs, encryption

Hosting

This website is operated by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). Our server functions (for example chat, form, counting) run in the Frankfurt am Main data centre. The pages themselves are delivered via Vercel's global network of servers, usually from a server near you.

Our database is operated for us by Supabase Inc. (USA) in the Frankfurt am Main region (Amazon Web Services data centre).

Server logs

With every request the server processes technically necessary information: IP address, date and time, requested address, amount of data transferred, status code, browser and operating system, and the previously visited page (referrer) if your browser sends it. Without this information the site cannot be delivered or protected against misuse. The hosting provider keeps these logs only briefly; we do not combine them with other data.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and error-free operation of the website.

Encryption

All connections to this website are TLS-encrypted (recognisable by “https://”). The conversation with the video avatar is encrypted as well.

Fonts, images, videos

We serve fonts, images, videos and program libraries from our own server. No content from third parties is loaded when the page loads; the avatar's still image is also served from our server. Only when you start the conversation with the video avatar does your browser connect to its service provider (section 4.1). Links to social networks (in the legal notice) are plain links; data only flows there if you click such a link.

4. Talking to our avatar: video avatar and text chat

On the home page you can talk to our video avatar. The conversation only begins when you start it yourself. Until then the page shows a still image served from our own server; no connection to a service provider is made.

4.1 Conversation with the video avatar

When you start the conversation, the following happens:

1. Player: your browser loads our avatar player from our server (assistant.rooom.ai) in an embedded frame.
2. Connection to the service provider: the player connects to a specialised provider of live video avatars, which generates the avatar's video image and voice on our behalf. In the process the provider technically receives your IP address and information about your browser and connection.
3. Microphone: your browser asks whether the site may use your microphone. If you allow it, your voice is transmitted to the provider during the conversation, converted into text there and answered by a language model; the answer comes back as the avatar's voice and video image. Without a microphone, no conversation is possible.
4. Ending: “End conversation” stops the transmission and the page removes the player. The conversation time per conversation and the number of conversations per browser and day are limited; if you switch to another tab for more than a minute, the conversation ends.
5. Storage: we do not record your voice and do not use it to identify you. The provider processes the conversation data only on our behalf and on our instructions (Art. 28 GDPR); how long it keeps them is set out in section 11.

The legal basis for processing your voice is your consent (Art. 6(1)(a) GDPR), which you give by starting the conversation and allowing microphone access in your browser; access to your device's microphone is governed by Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You can withdraw your consent at any time by ending the conversation or revoking microphone access in your browser. Processing up to the withdrawal remains lawful. For establishing the connection and protecting against overload the legal basis is Art. 6(1)(f) GDPR (secure operation).

4.2 Text chat

If the site offers a text chat with our avatar and you write to it, your browser sends your question together with the latest messages of this chat (at most twelve) to our server. The server passes them, together with the avatar's instructions, to the language AI of Mistral AI SAS (15 rue des Halles, 75001 Paris, France) via its EU endpoint. The answer comes back the same way.

• We do not store the content: we store questions and answers neither in the database nor in logs nor in error reporting. The history exists only in the memory of your browser window and is gone as soon as you close or reload the page.
• Protection against misuse: to prevent automated mass use, the number of messages per connection is limited (per day and per hour), and there is an overall daily limit. For this the server derives a check value from your IP address (for IPv6 from its network part) using a secret key that changes daily. Only this check value and a counter are stored – not the IP address. Counters from previous days are deleted with the first chat of a new day.
• Please do not enter sensitive information such as health data or login credentials in the chat.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to answer your questions about our product at your request and to protect the service against misuse. If the chat is used in connection with an enquiry, Art. 6(1)(b) GDPR (pre-contractual measures) also applies.

4.3 Note on artificial intelligence

Our avatar is an AI system within the meaning of Article 50 of Regulation (EU) 2024/1689 (AI Act). You are talking to an AI. The video image and the voice are artificially generated. The site points this out next to the avatar and before the conversation starts. The answers are generated by a language model; they may be incomplete or wrong and are not binding information or commitments by rooom AG. Binding offers come from our team. No automated decision-making within the meaning of Art. 22 GDPR takes place.

5. Counting without cookies

To understand which parts of the site are used, the site counts individual events – for example “page viewed”, “conversation started”, “form sent” or the duration class of a conversation (“0–30 seconds”). Per day, only a total per event, page and language is stored. We store no IP address, no identifier and no exact time for this, and we set no cookies; nothing is stored in your browser for this purpose. The server uses your IP address only briefly in memory to reject excessive numbers of reports. No individual can be identified from the daily totals.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to improve the site based on aggregated figures.

6. Error reporting

To find technical errors quickly, we use the Sentry service of Functional Software, Inc. (45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA), with its data location in the EU (Frankfurt am Main). If an error occurs on the site or on our server, the error message, the location in the program, the requested address, browser, operating system, screen size and page settings are transmitted; for a small share of requests also loading times. Your IP address is technically transmitted in the process. Content from the chat or the conversation is not transmitted. Sentry sets no cookies.

In addition, the site reports its own warnings (for example “live picture did not arrive”) to our server. We store the report with fixed attributes, the page address without query string, your IP address and the browser identifier. We use these reports only for troubleshooting and delete them as soon as they are no longer needed for that purpose.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is error-free and secure operation.

7. Contact and partner form, e-mail

When you write to us via the “meeting” form or the partner form, we process the information you enter: name, e-mail address, company, your message and, optionally, website, role, preferred times, type of company and interests, as well as your request type, the page language and the section you came from. To protect against misuse we also store your IP address, browser identifier, the previously visited page and the time of your consent. We store the enquiry in our database (Supabase, Frankfurt am Main) and send a notification with this information to our mailbox info@rooom.com.

To send this notification we use the e-mail service of Resend, Inc. (USA). The information from the form is transferred to the US in the process.

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract or its preparation, and otherwise your consent under Art. 6(1)(a) GDPR, which you give with the tick box in the form and can withdraw at any time by e-mail to info@rooom.com. For protection against misuse the legal basis is Art. 6(1)(f) GDPR.

If you contact us directly by e-mail or phone, we process your information to handle your request on the same legal basis.

8. Storage in your browser (no cookies)

The site sets no cookies. For some convenience functions it stores small entries in your browser's local storage (localStorage). These entries do not leave your device and are not transmitted to us. You can delete them at any time in your browser settings.

The legal basis is Section 25(2) no. 2 TDDDG (the storage is necessary for the function you requested) and Art. 6(1)(f) GDPR.

9. Our clients' avatars and the admin area

assistant.rooom.ai also hosts avatars that our business clients set up with rooomAssistant and embed via their own links (/s/…) or on their websites. For these conversations the respective client is generally the controller; we process the data on the client's behalf (Art. 28 GDPR). Which data is processed there, whether conversations are stored and for how long is decided by the client and described in the client's privacy policy. This policy applies to our own website and to the avatar on our home page.

The admin area (/admin) used by our clients is governed by the agreements in the respective contract.

10. Recipients and transfers to third countries

We only pass your data to service providers that process it on our behalf and with whom we have concluded data processing agreements, or where we are legally obliged to do so. We do not sell data.

On request to info@rooom.com we will tell you the name of the video avatar provider and the safeguards for any processing outside the EU.

With providers headquartered in the US it cannot be ruled out that data is transferred to the US or that US authorities request access, even if processing takes place in Europe. We base any transfer to the US on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards from info@rooom.com.

11. Retention at a glance

12. Your rights

You have the right at any time to

• access the data we hold about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

For any request, an informal message to info@rooom.com or to our data protection officer is sufficient. Because we do not store chat or conversation content in our database and the counting uses no identifier, we generally cannot attribute data from these processes to an individual.

Providing your data is voluntary. Without the information in the form, however, we cannot answer your enquiry; without a microphone, no conversation with the video avatar is possible – feel free to write to us via the form instead.

We object to the use of the contact details published in the legal notice for sending unsolicited advertising and information material.

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI)
Häßlerstraße 8
99096 Erfurt
Germany
E-mail: poststelle@datenschutz.thueringen.de
Web: www.tlfdi.de

14. Changes to this policy

We update this policy when the website, our service providers or the legal situation change. The version published here applies. This is a translation; the German version is authoritative.