The data controller responsible for the personal information described in this notice is:
ROOY AI (HK) LIMITED
Tower 1, 6/F, B5, St Martin
12 Fo Chun Road
Tai Po, Hong Kong
For purposes of Hong Kong privacy law, ROOY AI (HK) LIMITED is also the relevant data user.
For privacy questions or requests, contact:
contact@rooy.ai
1. Scope of this notice
This notice applies to the ROOY preorder flow and preorder account on the ROOY website.
It covers personal information processed for:
email verification;
preorder creation and management;
preorder account access;
payments and refunds;
transactional communications;
fraud prevention and service security;
payment disputes; and
legal, accounting, and compliance requirements related to the preorder service.
This notice does not cover motion, exercise, sensor, coaching, voice, device, or other data that may later be produced or processed through ROOY hardware, software, or app features.
Before those features begin processing personal information, ROOY will provide a separate privacy notice explaining what information is collected, how it is used, the applicable legal bases, and how long it is retained.
Where future ROOY products use personal information to improve or train models, that processing will also be described in the applicable product privacy notice.
ROOY may retain properly anonymized information derived from product or activity data for model training, product improvement, research, analytics, and similar purposes for an indefinite period, provided that the information has been anonymized so that individuals are no longer identifiable by means reasonably likely to be used.
Information that is only pseudonymized, tokenized, hashed, or otherwise capable of being linked back to an identifiable person will continue to be treated as personal information and will remain subject to applicable privacy law and retention requirements.
2. Information we process
Information you provide
When you use the preorder service, we may collect:
your email address;
your selected country or region;
information you provide when contacting customer support; and
delivery, billing, tax, or other information required when you later proceed to final purchase.
Preorder and transaction records
We process records associated with your preorder, including:
email verification status;
the version of the preorder terms and privacy notice presented to you;
the date and time associated with relevant account or transaction actions;
your preorder number;
payment and refund amounts;
payment and refund status;
transaction identifiers;
payment-provider customer identifiers; and
records associated with payment disputes, cancellations, or refunds.
Payment information
Payments are processed through Stripe.
ROOY does not receive or store your full card number or card security code.
Stripe may provide ROOY with payment-related information needed to administer the preorder and associated transactions. Depending on the payment method and transaction, this may include:
payer name;
email address;
phone number;
billing or shipping address;
tax information;
card brand;
the last four digits of a card;
card expiry information;
card issuing country;
payment method type;
transaction identifiers;
receipt information;
transaction date and time; and
fraud, verification, or risk-related information provided by Stripe.
We use this information only where reasonably necessary to reconcile transactions, administer your preorder, provide customer support, issue refunds, prevent fraud, handle disputes, and comply with applicable legal or financial obligations.
Security and technical information
We process technical information needed to operate and secure the preorder service, which may include:
verification attempts;
sign-in and authentication records;
session identifiers;
IP addresses or pseudonymous identifiers generated from IP addresses;
browser and device information;
timestamps;
security events;
rate-limiting information; and
records used to detect unusual, unauthorized, or abusive activity.
3. Why we use your information and our lawful bases
We process personal information only where we have an appropriate legal basis.
Depending on the purpose and applicable law, we rely on the following bases.
Contract and steps requested before entering into a contract
We process information where necessary to take steps at your request before entering into the preorder agreement or to perform that agreement.
This includes processing needed to:
verify your email;
create your preorder;
provide access to your preorder account;
administer your preorder;
process payments;
apply preorder benefits;
process cancellations and refunds; and
send transactional communications concerning your preorder.
Legal obligations
We may process or retain information where necessary to comply with applicable legal requirements, including accounting, tax, financial reporting, regulatory, recordkeeping, and lawful disclosure obligations.
Legitimate interests
We may process information where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights and interests.
These interests include:
securing accounts and transactions;
preventing fraud, abuse, and unauthorized activity;
maintaining the reliability and integrity of the preorder service;
investigating unusual activity;
resolving payment or refund disputes;
keeping appropriate audit and operational records; and
establishing, exercising, or defending legal claims.
Where required, we assess whether the processing is necessary and whether your interests or rights outweigh our legitimate interests.
Consent
Where we rely on your consent for a particular optional activity, we will ask for that consent separately.
For example, we may rely on consent for certain optional marketing communications where required by law.
You may withdraw consent at any time for processing that relies on consent. Withdrawal does not affect processing that occurred before withdrawal or processing that continues under another lawful basis.
Most processing required to administer, secure, pay for, cancel, or refund a preorder is not based on consent.
Using the preorder service does not subscribe you to marketing communications.
We will not use your preorder email address to send marketing communications unless we have an appropriate legal basis and, where required, you separately choose to receive them.
4. Who receives your information
We disclose personal information only where reasonably necessary for the purposes described in this notice.
Recipients may include the following categories of service providers:
Stripe and other payment-service providers, for payment processing, refunds, fraud prevention, payment authentication, and transaction administration;
transactional email providers, for delivery of verification codes, sign-in links, payment confirmations, refund notices, and other service-related communications;
hosting, database, storage, and infrastructure providers, for operating and storing components of the preorder service;
security, content-delivery, and anti-abuse providers, for protecting the website, preventing unauthorized activity, and maintaining availability;
professional advisers, such as lawyers, accountants, auditors, and insurers, where reasonably necessary; and
government authorities, regulators, courts, payment networks, banks, or other authorized recipients, where disclosure is required by law or reasonably necessary to investigate fraud, resolve disputes, or protect legal rights.
We require service providers acting on our behalf to handle personal information subject to appropriate contractual, security, and confidentiality obligations.
ROOY does not sell personal information.
We also do not share personal information with third parties for their own independent advertising purposes through the preorder service unless we separately disclose that practice and have an appropriate legal basis.
5. Cookies, browser storage, and similar technologies
The preorder service uses cookies and similar browser technologies that are necessary to operate core service functions.
These technologies may be used to:
maintain email verification state;
keep you signed in;
allow secure access to your preorder;
connect payment results to the relevant session;
prevent unauthorized actions;
limit abusive or unusual requests; and
maintain security and service reliability.
If you block necessary cookies or browser storage, some preorder, sign-in, payment, or refund features may not function correctly.
The website may also store your language preference in your browser's local storage.
You can remove locally stored preferences by clearing the website's data in your browser. Clearing browser data does not delete preorder, payment, refund, or other server-side records.
Payment providers and other service providers may use cookies or browser storage that are necessary to deliver their services securely.
ROOY does not use the preorder service's strictly necessary cookies for advertising.
If we introduce non-essential analytics, advertising, or similar technologies in a jurisdiction where consent is required, we will provide the required information and choice before using them.
6. How long we keep information
We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing the preorder service, meeting legal and financial obligations, preventing fraud, maintaining security, resolving disputes, and establishing or defending legal claims.
Retention depends on the type of information and why it is processed.
In particular:
verification codes and sign-in links expire after the period stated when they are issued and cannot be used after expiration;
short-term session, authentication, rate-limiting, and security records are retained only for as long as reasonably necessary to operate and secure the service;
active preorder records are retained while the preorder remains active;
preorder, payment, refund, terms-acceptance, and transaction records may be retained after the preorder ends where needed for accounting, tax, fraud-prevention, dispute-resolution, contractual, or other legal requirements;
records associated with a payment dispute, fraud investigation, refund review, or legal claim may be retained until the matter is resolved and for any additional period required or permitted by law; and
residual copies may remain temporarily in backups until they are overwritten through the normal backup cycle.
Where applicable law requires a particular retention period, we follow that requirement.
Where no fixed legal retention period applies, we determine retention based on factors including:
whether the preorder or related transaction remains active;
the period during which a payment may be disputed;
applicable accounting, tax, and recordkeeping obligations;
applicable limitation periods for legal claims;
fraud-prevention and security needs; and
whether the information remains necessary for the purpose for which it was collected.
When personal information is no longer required, we delete or anonymize it in accordance with our retention procedures.
Properly anonymized information that can no longer reasonably be linked to an identifiable individual may be retained indefinitely and used for legitimate purposes including aggregated analytics, research, product improvement, and model training.
7. International processing and data location
ROOY is based in Hong Kong and provides the preorder service internationally.
To support data protection requirements across different jurisdictions, ROOY and its service providers may process or store users' personal information in servers or infrastructure located in regions selected to support the legal and regulatory requirements applicable to those users.
Where appropriate, user information may be routed to or stored in infrastructure located within or serving the relevant compliant geographic region.
However, providing regional infrastructure does not necessarily mean that personal information will never be accessed or processed from another country. Certain service providers, payment networks, support personnel, security systems, or corporate operations may involve cross-border processing where necessary.
Where personal information is transferred internationally and applicable law requires additional safeguards, ROOY uses an appropriate legal transfer mechanism.
Depending on the jurisdictions involved, these safeguards may include:
transfers to jurisdictions recognized as providing an adequate level of data protection;
applicable standard contractual clauses;
UK international data-transfer mechanisms;
contractual protections for cross-border transfers;
technical and organizational safeguards; or
another transfer mechanism recognized by applicable law.
For transfers subject to EU or UK data-protection law, we use applicable international-transfer safeguards where required.
For transfers controlled from Hong Kong, ROOY also uses appropriate contractual and organizational measures designed to protect personal information, taking into account applicable Hong Kong privacy requirements and guidance.
You may contact contact@rooy.ai for additional information about the safeguards applicable to transfers of your personal information.
8. Security
We use technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, or misuse.
These measures may include:
access controls;
encryption in transit and, where appropriate, at rest;
restricted access to payment and transaction records;
authentication and session controls;
security monitoring;
rate limiting;
logging of security-relevant activity; and
contractual and security requirements for service providers.
No online service can guarantee absolute security. We review and update our security measures as the service develops.
9. Automated fraud and risk assessment
Payment providers and security systems may use automated tools to identify potentially fraudulent, abusive, or unusual transactions.
For example, Stripe may provide fraud or risk information that helps us determine whether a transaction requires additional verification or review.
Where an automated system produces a risk signal, ROOY may use that signal to protect the preorder service, prevent fraud, review a payment, or request additional verification.
We do not intentionally make a decision based solely on automated processing that produces legal or similarly significant effects on you unless the processing is permitted by applicable law and any required safeguards are provided.
If our use of automated decision-making changes materially, we will update this notice and provide any additional information required by applicable law.
10. Your privacy rights
Depending on where you live and the law that applies, you may have the right to:
request access to personal information we hold about you;
request correction of inaccurate or incomplete information;
request deletion of certain personal information;
request restriction of certain processing;
receive certain personal information in a portable format;
object to certain processing;
withdraw consent where processing is based on consent; and
lodge a complaint with the privacy or data-protection authority responsible for your jurisdiction.
Your right to object
Where applicable law gives you the right to object to processing based on our legitimate interests, you may object by contacting contact@rooy.ai.
We will consider your objection and stop the relevant processing where required by law, unless we have compelling lawful grounds to continue or the information is needed for the establishment, exercise, or defense of legal claims.
To exercise another privacy right, contact contact@rooy.ai.
We may request information reasonably necessary to verify your identity before responding to a request.
Privacy rights are subject to applicable legal exceptions. For example, we may need to retain certain payment, accounting, fraud-prevention, dispute, or legal records even after you request deletion.
We will explain any applicable limitation when responding to your request.
Most processing necessary to administer your preorder is not based on consent. Therefore, withdrawing consent does not automatically require us to delete or stop processing information that we are entitled or required to process under another legal basis.
11. Children's privacy
The preorder service is intended for adults who are legally able to enter into the preorder agreement.
We do not knowingly use the preorder flow to collect personal information directly from children who are not legally able to enter into the preorder agreement under applicable law.
If we learn that personal information was submitted through the preorder service by a child in circumstances where we should not have collected it, we will take appropriate steps in accordance with applicable law.
Future ROOY hardware, app, or family features may have different age requirements and will be addressed in the privacy notice applicable to those services.
12. Changes to this notice
We may update this notice as the preorder service, our providers, or applicable legal requirements change.
The current version will show the date it was last updated.
If we make a material change to:
how we use personal information;
the types of information we collect;
who receives personal information;
international-transfer arrangements; or
your privacy rights,
we will provide appropriate notice through the website, your preorder account, email, or another suitable method where required.
Where applicable law requires consent before we begin a new type of processing, updating this notice alone will not replace the need to obtain that consent.
13. Contact and complaints
For privacy questions or to exercise your privacy rights, contact:
ROOY AI (HK) LIMITED
Tower 1, 6/F, B5, St Martin
12 Fo Chun Road
Tai Po, Hong Kong
Email: contact@rooy.ai
Depending on where you live, you may also have the right to complain to the privacy or data-protection authority with jurisdiction over your complaint.