Privacy Policy — RoamAid

1. Scope and who we serve

This Privacy Policy explains how ROAMAID INC ("RoamAid," "we," "us") handles personal information in connection with our website, RoamAid Trip Protection, booking, communications, travel assistance and related support. Personal information includes information that identifies, relates to or can reasonably be linked to a person. Replacing a name with an identifier or hash does not necessarily make information anonymous.

The purchaser and Primary Traveler must be a U.S. resident and provide a working U.S. mobile phone number for use during the trip. Listed family members do not need to be U.S. residents or have separate U.S. telephone numbers, but must meet the family-coverage requirements in the Terms & Conditions. Eligible travelers may travel domestically or internationally, subject to applicable service limitations.

This Policy describes data practices; it is not blanket consent to every form of processing. Separate consent is obtained where required. The Terms & Conditions explain service eligibility and operation. Arbitration and service-liability provisions are contained in the Terms, not this Policy.

2. Information involved in providing the Services

Depending on your interaction with RoamAid, relevant information includes:

Booking and contact information: names, email address, mobile phone number, preferred language, relevant time zones, customer and trip identifiers, travel dates, destinations, selected services, and check-in schedules and communication-channel choices.

Booking eligibility and covered family information: the purchaser’s confirmation that they are the Primary Traveler and at least 18 years old; names and relationship categories of listed family members; and a listed child’s age on the confirmed Start Date supplied by an authorized adult. Family members are associated with the relevant trip; they do not need separate phone numbers merely to be listed.

Emergency-contact information: the designated person's name, contact details and any supplied relationship information, together with their separate consent, refusal, withdrawal and notification history.

Communications and assistance information: calls and permitted recordings, SMS and WhatsApp messages, emails, customer-supplied attachments, check-in responses, HELP requests, agent notes and actions, and information shared during an assistance interaction. Depending on the situation, this may include location, safety or health-related information you or another participant provides. We limit collection and use to the relevant assistance and other purposes described here.

Consent and verification evidence: the disclosure or Terms version presented, selections, consent and withdrawal events, dates, times, source of the event, verification status, STOP and reactivation history, and technical evidence reasonably needed to document those events. Successful one-time code entry verifies control of the email address or mobile number at that time; it is not, by itself, proof of the purchaser's identity. A separate messaging-channel verification response, where required, establishes reachability of that channel.

Payment and transaction records: checkout, order and transaction references, amounts, currency, payment status, refunds, reversals and related reconciliation records. Payment details entered in a provider-hosted checkout are processed by the payment provider under its applicable terms and privacy notice. RoamAid's intended records contain the information necessary to verify and administer purchases, rather than full card numbers or card security codes.

Website and technical information: information generated through website operation and security, such as IP address, browser and device information, request timestamps, relevant page interactions, error information and security logs. Optional analytics and advertising technologies are subject to Section 7 and their actual configuration.

We do not continuously monitor a traveler's GPS location, device, health, activities, surroundings or safety. Information you provide about your location or situation during an interaction is different from continuous monitoring.

3. Sources and purposes

Information comes from you; the adult supplying a family booking; designated emergency contacts; participants in assistance interactions; payment and communications providers; and technical systems used to operate the Services. We do not treat shared email addresses alone as proof that two people are the same customer.

We use relevant information to process and verify bookings and payments; administer trip and family eligibility; communicate booking information; verify communication channels; perform selected check-ins; respond to assistance and HELP requests; arrange interpretation and appropriate third-party connections; contact consenting emergency contacts under applicable procedures; maintain service and consent records; investigate service issues and safety incidents; prevent fraud and unauthorized access; handle privacy requests, disputes and legal obligations; and perform authorized quality assurance and staff training.

Optional advertising and measurement are separate from safety and assistance operations and follow the restrictions below. We do not use this Policy as permission for unrelated collection or disclosure.

4. Disclosures to other people and organizations

Service providers. We disclose information reasonably necessary to organizations supporting hosting, databases, communications, customer support, payment processing, interpretation, secure storage and other authorized service functions. Relevant arrangements include GoDaddy/Airo for the application and associated services and HighLevel for communications and agent operations. Other provider-dependent functions, including the planned independent recording archive, are subject to deployment and verification. Naming a planned function does not mean it is already operational. Providers must be subject to appropriate confidentiality, security and permitted-use requirements; independent payment providers and other independent organizations may also process information under their own notices and legal obligations.

Assistance recipients. When you request or receive assistance, we may disclose limited information reasonably necessary to an interpreter, emergency responder, medical provider, government agency, embassy or consulate, security or transportation provider, or another appropriate resource. Depending on the situation, this may include your name, contact details, location or destination, relevant travel information and the nature of the assistance requested. Information you ask us to relay may be communicated for that purpose. This does not authorize disclosure of unrelated information.

Emergency contacts. We may share limited relevant information under the selected service and applicable procedures, such as your name, an unanswered check-in, your request for assistance or our attempts to reach you. Listing someone does not give automated messaging consent on their behalf. The recipient must complete any required separate affirmative consent process. Silence is not consent, and refusal or withdrawal is respected.

Legal, security and corporate matters. Information may be disclosed where legally required or permitted to comply with valid process, address fraud or security incidents, protect rights and safety, establish or defend claims, or evaluate and complete a legitimate corporate transaction. Disclosures remain limited to the relevant purpose, with appropriate safeguards and any required notice or consent.

At your direction. Other disclosures may occur when you specifically request or validly authorize them. We do not make personal assistance conversations publicly available through a public-posting feature under this service design.

5. Recording, transcripts and AI restrictions

Calls are recorded after notice and any consent required by applicable law. Recording purposes are service documentation, safety and incident review, and authorized human training and quality assurance. Newly connected participants receive notice when the call is being recorded, subject to a verified, legally valid provider consent arrangement. The proposed interpreter-provider exception requires contract review and is not assumed to exist.

If a participant objects, recording is stopped as soon as operationally possible and assistance continues without recording. This does not authorize recording contrary to applicable consent requirements. Actual recording controls must support the required consent and withdrawal process.

Routine retention is audio-only rather than automatic written transcription. For a specific legal or similar justified need, an authorized company may be privately commissioned to prepare a transcript. Transcript requests and access are restricted and logged. An authorized administrator may request an exceptional transcript without an additional internal approval layer, but the request must still have a justified purpose and comply with the applicable rules. A transcript follows the source audio's applicable retention deadline and preservation hold; creating it does not start a new retention clock.

RoamAid does not use AI to analyze call recordings. A proposed change requires separate review and approval before implementation, including required updates to disclosures and consent procedures.

RoamAid does not authorize customer conversations, recordings, transcripts, HELP requests, safety information or family information to be used to train general-purpose AI models. Any proposed change requires separate review and approval and any legally required notices or consent. Provider contracts and settings must be verified to implement this restriction.

Recordings and related sensitive assistance information are not used for advertising or retargeting. Access is limited to authorized personnel and providers with a legitimate need.

6. Messaging choices and contact verification

The purchaser verifies the email address and U.S. mobile phone number with separate one-time codes before payment. Selected SMS and WhatsApp check-in channels have separate consent and readiness states; mobile-number verification does not by itself verify WhatsApp readiness. Trip details are withheld from an unverified messaging channel until the required verification response is recorded. We retain the relevant verification and consent evidence; an affirmative response to a different message or another channel does not substitute for the required verification.

STOP records the applicable opt-out and suppresses the relevant automated messaging path. Provider-level restrictions are also respected and may have broader effect. Consent withdrawal does not erase the historical evidence that consent was previously given or withdrawn. Reactivation requires an affirmative request and completion of applicable RoamAid and provider requirements, including supported START/UNSTOP or agent-assisted procedures. Reactivation does not rewrite past events.

Stopping check-ins does not prevent you from calling or initiating a HELP request. If the sole selected channel, or both selected channels, is stopped, automatic missed-check-in emergency-contact alerts stop as described in the Terms. Customer-initiated assistance remains available subject to service limitations. A privacy deletion request and a messaging STOP request are different actions; contact us for deletion requests.

Text messaging. We do not sell, rent or share your mobile number or text-messaging consent with third parties or affiliates for their marketing or promotional purposes. Text-messaging opt-in data and consent are not shared with any third party, except service providers that deliver our messages on our behalf.

7. Cookies, advertising and measurement

Necessary website technologies support booking continuity, security and essential operation. Optional advertising and retargeting trackers remain disabled until a visitor affirmatively accepts them. Rejecting optional advertising must be as easy as accepting it, choices may be withdrawn, and recognized Global Privacy Control signals will be honored for applicable sale/sharing and targeted-advertising processing. Necessary booking and security functions remain available without advertising consent. These controls must be implemented and tested before optional trackers are activated.

RoamAid plans limited conversion measurement and advertising through platforms such as Google/YouTube and Meta/Facebook/Instagram. Any additional platform requires review. This is a description of the approved plan, not a claim that these tools are currently active. Before activation, disclosures and controls must reflect the actual providers, technologies, purposes and retention periods. Where advertising processing constitutes sale or sharing under applicable privacy law, the applicable disclosures and choices must be provided; payment for data is not the only relevant consideration.

Eligible measurement is limited to approved website or funnel events, such as a page view, signup or checkout start, or a purchase confirmed by authoritative payment evidence. A purchase event may include the relevant amount and currency. Ads may be directed to eligible non-buyers, with verified purchasers excluded from acquisition retargeting for that same trip.

Advertising platforms must not receive recordings, transcripts, traveler names or phone numbers, destinations, travel dates, emergency-contact details, check-in selections or responses, HELP activity, safety or health information, or interpreter and assistance-conversation information through our advertising integrations. Ad tags must not operate in assistance, HELP, check-in response, emergency-contact, verification-content or staff areas. URLs, event parameters and other automatically collected fields must be checked for unintended disclosure.

Enhanced conversions, hashed email or phone uploads, customer matching and similar identity-based advertising features require separate review before use. Cookie settings do not replace other applicable privacy rights. Browser settings can also affect cookie storage, but they do not replace the choices RoamAid must provide for its own applicable processing.

8. Retention and deletion schedule

The following is RoamAid's approved retention schedule. Records are limited to their documented purposes. Applicable earlier deletion rights and justified preservation requirements take precedence where required. A retained identifier or hash remains protected if it can reasonably be linked to a person.

Safety incidents and HELP requests: relevant audio, messages, check-ins, agent actions and other evidence are retained for seven years after the incident or HELP case is closed or the relevant Trip Protection ends, whichever is later. Routine information that becomes relevant incident evidence follows this rule. A longer legal hold may apply.

Routine recordings: normally up to five years after the applicable Trip Protection ends, with permitted earlier deletion and applicable preservation exceptions. Exceptional transcripts follow the source recording's deadline rather than a new clock.

Incomplete signups and abandoned bookings without payment: 90 days after the last customer activity. An unresolved payment or payable checkout is not assumed to be an unpaid abandoned booking; it must be reconciled before eligible deletion.

Core customer and trip evidence: five years after the relevant trip ends or is canceled. This includes the limited information needed to establish who purchased, who was covered, the purchased services, protection dates, activation or cancellation, and service outcomes. A new purchase does not restart the old trip's clock.

Routine messages, check-in responses and delivery history: one year after the relevant trip ends, unless relevant to an incident, HELP case, dispute or another applicable preservation need.

Detailed destinations, check-in schedules and emergency-contact details: 90 days after the trip ends, unless specific information is needed for an incident or another documented preservation purpose. Information embedded in a recording or preserved incident record follows that record's applicable schedule rather than requiring alteration of original evidence.

Family-member information: unnecessary operational and contact details are removed after 90 days from trip end; minimum evidence of who was covered follows the five-year core-trip schedule. Applicable protections for children's information and preservation needs remain relevant.

Terms acceptance and consent evidence: five years after the last service or communication relying on that consent. Current STOP or opt-out restrictions are retained in minimal form while necessary to prevent prohibited contact, with an annual review. Deletion of ordinary history must not mistakenly re-enable messages.

Payment, refund and accounting evidence: the approved target is seven years after the relevant tax return's filing date or due date, whichever is later, subject to accountant confirmation and applicable exceptions. The record is limited to necessary financial evidence rather than unnecessary payment payloads or card credentials.

Routine technical and error logs: 90 days from creation. Security and administrator-access logs: one year from the event. Relevant incident evidence is preserved under the appropriate hold.

Privacy-request records: limited evidence of the request, handling, response and any refusal is retained for 24 months after closure. Additional identity-verification information is not retained merely to create unnecessary copies of identity documents.

Preservation holds are documented, limited to relevant information and reviewed every six months. Once the reason ends, the applicable ordinary schedule and lawful deletion requirements are reassessed. A hold is not permission to keep all information indefinitely or use it for unrelated purposes.

Provider copies and backups require coordinated handling. Backup expiry and deletion depend on verified provider processes; removal from a live record is not a promise of immediate physical erasure from every backup. When a backup is restored, completed deletions must be reapplied before restored information returns to ordinary use. Applicable backup exceptions do not authorize unrestricted reuse of deleted information.

9. Requests and privacy rights

You may contact info@roamaid.me to request correction or deletion of your personal information, or to exercise other privacy rights available under applicable law. RoamAid will review and respond to requests in accordance with applicable law, including relevant verification requirements and exceptions.

Depending on the applicable law and circumstances, rights may include requesting information about processing or a copy of personal information, correction, deletion, portability, objection or restriction,

withdrawal of consent, or opting out of certain advertising disclosures. These rights and their exceptions vary; this Policy does not remove any right that applies to you.

Where necessary to protect information, we verify identity and a representative's authority using information reasonably necessary for the request. A Trip ID alone does not authorize disclosure or a lasting change to personal information. Opt-out preference signals are handled under their applicable rules rather than automatically requiring the same identity checks as disclosure requests.

Requests are recorded and handled within applicable deadlines. Where a request is denied in whole or part, we explain the relevant basis and any available appeal or complaint route as required. We do not unlawfully discriminate against individuals for exercising applicable privacy rights. Retaining specific records under a valid exception does not permit unrelated use of them, and our chosen retention period does not override a legally valid deletion right.

10. Children's privacy

RoamAid purchases and routine booking communications are handled through adults. An authorized adult may provide the names and required eligibility information of covered children. RoamAid uses this information to administer family coverage and provide requested assistance.

Children's information is not used for advertising or profiling. If a child participates directly in an assistance interaction, RoamAid limits collection to information necessary for that assistance and follows applicable parental-consent and recording requirements.

A parent or legal guardian may contact info@roamaid.me concerning their child's information, subject to appropriate verification and applicable law. Listing a child does not by itself establish that all consent requirements for direct interactions, recordings or other processing have been satisfied.

11. International assistance and processing

Although the purchaser/Primary Traveler must be a U.S. resident using a working U.S. mobile phone number, travel assistance may involve locations, recipients and service providers outside the United States. Information may be processed in the United States and other countries involved in providing the requested assistance or provider services. Exact provider locations and transfer arrangements must be verified before making location-specific claims.

Where applicable law requires safeguards for cross-border processing or transfers, RoamAid must establish those safeguards. Merely using the website or accepting this Policy is not treated as blanket consent that replaces required safeguards or removes mandatory local rights. U.S. residency alone does not establish that no other privacy law applies.

12. Security and restricted access

RoamAid uses reasonable administrative, technical and organizational safeguards appropriate to the information and risk. The approved design includes restricted access, verification before sensitive disclosures or contact changes, secure storage, access logging and procedures for handling incidents and deletion. Provider settings and the planned recording archive require implementation and verification; this Policy does not certify that a particular planned technical control is already operating.

Only authorized personnel and providers with a legitimate need may access recordings and sensitive assistance records. No information system can be guaranteed absolutely secure. Safeguards and any legally required incident notifications must reflect applicable obligations and the actual circumstances.

13. Independent services and policy changes

An independent provider, responder or linked website may have its own privacy practices and obligations. This Policy describes RoamAid's handling of information and does not replace those organizations' notices. This does not remove RoamAid's responsibility for its own disclosures or provider arrangements.

Changes to this Policy will be identified through an updated version and any additional notice or consent required by law. A later policy will not be treated as automatic permission for materially different uses requiring additional consent. Required notices must reflect actual practices before new processing begins.

14. Contact

ROAMAID INC

Indio, California

Privacy questions and requests: info@roamaid.me

For urgent travel assistance during active Trip Protection, use the RoamAid number supplied with your booking. The privacy email channel is not an emergency-response service.