--- title: "Privacy Policy - roji.ai" description: "Privacy Policy for roji.ai, the platform where verified businesses list services and AI agents order them. Learn how ROJI Inc. collects, uses, and protects your data." doc_version: 14d3d06188f4 last_updated: 2026-09-10 --- # Privacy Policy - roji.ai Privacy Policy ## Introduction This Privacy Policy describes how ROJI Inc. ("ROJI," "we," "us," or "our") collects, uses, discloses, and protects information about you when you access or use our website at roji.ai, our platform, and any related services (collectively, the "Services"). The Services connect **Principals** and their **Agents** (who place and pay for orders) with **Businesses** (verified merchants who publish service listings and fulfill orders) — see the [Acceptable Use Policy](/acceptable-use) for how we define these roles. By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you have questions about this Privacy Policy or our data practices, please contact us at [legal@roji.ai](mailto:legal@roji.ai). ## Information We Collect ### Information You Provide to Us **If you are a Principal or use an Agent:** - **Account Information.** Your name, email address, phone number, business name, billing address, and payment information. - **Agent Configuration.** Information about the agents you register, including their authentication credentials, spend controls (per-order ceilings, rolling budgets, vertical allowlists, approval thresholds), and authorization scope. - **Order Inputs.** The structured inputs, parameters, and input files your agent submits when placing an order against a listing. - **Uploaded Documents.** Files you or your agent upload in connection with an order, such as authorization letters, source documents, or reference materials. **If you are a Business:** - **Business and Verification Data.** Information collected during business verification (KYB), including legal-entity details, beneficial-ownership information, government ID and liveness-check data for the individuals we are required to verify, and related verification outcomes. - **Listing Content.** The service listings you publish, including descriptions, input requirements, deliverable schemas, prices, turnaround commitments, refund windows, and covered jurisdictions. - **Licensure and Credential Data.** Professional licenses, notary commissions, or other credentials, and the jurisdiction-registry information used to verify them. - **Payout and Bank Information.** Bank account and payout details, which are collected and processed by our payment partner, Stripe, through Stripe Connect. We do not store full bank account or card numbers on our servers. - **Location Data.** For field or mobile service verticals (such as site visits or in-person verification), the location information necessary to publish coverage areas and to verify a delivery. **From all users:** - **Communications.** Information you provide when you contact support, respond to surveys, or otherwise communicate with us — including the structured questions, document requests, checkpoints, and status updates exchanged through the Services in the course of an order. - **Payment Information.** Billing details processed through our third-party payment processor. ### Information We Collect Automatically When you use the Services, we automatically collect: - **Usage Data.** How you interact with the Services, such as features used, pages viewed, search queries, clicks, and timestamps. - **Device Information.** Device type, operating system, browser type, screen resolution, and unique device identifiers. - **Log Data.** Server logs recording IP address, access times, referring URLs, and pages visited. - **Approximate Location.** Derived from your IP address (distinct from the precise location data collected for field services above). - **Cookie and Tracking Data.** Collected through cookies, pixel tags, web beacons, and similar technologies. See our [Cookie Policy](/cookie-policy) for details. ### Information We Collect from Third Parties - **Identity and Verification Partners.** We use third-party identity-verification and background-check vendors to verify business and individual identity, credentials, and licensure. - **Stripe.** Our payment partner provides us information related to funding, payouts, KYC/KYB outcomes for payment purposes, and fraud signals. - **Integration Partners.** If you connect a third-party service to your account, we receive information from that service as necessary to provide the integration. - **Analytics Providers.** We receive aggregated analytics data from third-party analytics providers. ## How We Use Your Information We use the information we collect to: - **Operate the Platform.** Publish listings, run discovery, and place and manage orders between Principals/Agents and Businesses. - **Verify Businesses and Licensure.** Confirm business identity, credentials, and licensure before a listing can be published, and re-verify on renewal. - **Process Payments.** Charge orders, settle payments to Businesses through our payment partner, and process refunds and fee collection. - **Power AI Features.** Help Businesses draft listings, help agents structure orders, screen listing and order content, rank search results, and provide other AI-assisted functionality. See "AI Processing" below. - **Prevent Fraud and Abuse.** Detect, investigate, and prevent fraud, review manipulation, and other harmful activity, including monitoring connected accounts to meet our payment partner's requirements. - **Communicate with You.** Send service-related notices, order updates, security alerts, and support messages. - **Provide Support.** Respond to your requests and troubleshoot issues. - **Comply with Legal Obligations.** Meet legal, tax (including 1099-K reporting), and regulatory requirements. - **Improve the Services.** Analyze usage patterns to improve functionality, fix bugs, and develop new features. ## How Order Data Flows Between Parties ROJI is a two-sided platform, and order data is necessarily shared between the parties to an order in order for the order to be fulfilled: - When an order is placed, the inputs and uploaded documents attached to that order are shared with the fulfilling Business. A Business sees only the inputs attached to its own orders, not the buyer's broader account. - When a Business submits a deliverable, that deliverable — and any attestation or supporting evidence it includes — is shared with the Principal/Agent that placed the order. - Structured communications exchanged during an order (questions, document requests, checkpoints, status updates) are shared between the two parties to that order as needed to complete it. - Reviews submitted by either party after a completed order are visible as part of the counterparty's reputation record. Each party may use information received through an order only to complete or operate that order, consistent with our [Acceptable Use Policy](/acceptable-use). ## AI Processing The Services use AI to help Businesses draft listings, help agents structure orders, screen listing and order content for policy compliance, rank search results, and provide other platform functionality ("AI Features"). AI Features process the listing and order data described above — listing content, inputs, and deliverables — to perform these functions. - **No Training of Third-Party Models Without Consent.** We do not use your data to train third-party general-purpose AI models without your consent. - **Data Isolation.** AI processing for a given order uses only the data associated with that order. - **Human Oversight.** AI Features support the platform; ordering, delivery, and refund decisions are made by the human or agent parties to the order, or, where a refund request is contested, by human platform mediation. ## How We Share Your Information We do not sell your personal information. We share information only in the following circumstances: ### Between Platform Parties As described in "How Order Data Flows Between Parties" above, listing content, order inputs, deliverables, attestations, and order-related communications are shared between the Principal/Agent and the Business on a given order, as necessary to complete it. ### Service Providers and Sub-processors We share information with third-party vendors who perform services on our behalf, including cloud hosting, identity verification, analytics, and customer support tools. This includes **Stripe**, our payment partner, which processes payments, KYC/KYB checks for payment purposes, and payouts to Businesses through Stripe Connect. These providers are contractually obligated to use your data only as necessary to provide services to us and are bound by data processing agreements. See our [Subprocessors](/subprocessors) page for a current list. ### Legal Compliance and Safety We may disclose information if we believe in good faith that disclosure is necessary to: comply with applicable law, regulation, legal process, or governmental request; enforce our [Terms of Service](/terms) or [Acceptable Use Policy](/acceptable-use); protect the rights, property, or safety of ROJI, our users, or the public; or detect, prevent, or address fraud, security, or technical issues. ### Business Transfers If ROJI is involved in a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information. ### With Your Consent We may share information with third parties when you direct us to do so or provide your explicit consent. ## Data Retention We retain your information for as long as your account is active or as needed to provide the Services. Order-related deliverables and verification documents are retained per vertical-specific retention policies and purged on schedule after the post-completion window closes; financial and payment records are retained as long as required for legal, tax, and recordkeeping purposes. When you close your account, we will delete or anonymize your data within 90 days, except where we are required to retain it for legal, regulatory, dispute-resolution, or recordkeeping purposes. You may request export of your data at any time by contacting [legal@roji.ai](mailto:legal@roji.ai). ## Data Security We implement technical and organizational security measures to protect your information, including: - Encryption of data in transit and at rest - Isolated, per-order storage for deliverables, with short-lived, scoped access links and access logging - Role-based access controls and multi-factor authentication - Continuous monitoring and incident response procedures For more information, visit our [Security](/security) page. No method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security. ## Cookies and Tracking Technologies We use cookies and similar tracking technologies to operate and improve the Services. See our [Cookie Policy](/cookie-policy) for details on the cookies we use and how to manage your preferences. ## Your Rights and Choices Depending on your jurisdiction, you may have the following rights regarding your personal information: - **Access.** Request a copy of the personal information we hold about you. - **Correction.** Request correction of inaccurate or incomplete information. - **Deletion.** Request deletion of your personal information, subject to certain exceptions (for example, we cannot delete verification or financial records we are legally required to retain, or that are needed to resolve an open order or refund request). - **Portability.** Request a machine-readable copy of your data. - **Restriction.** Request that we restrict processing of your information in certain circumstances. - **Objection.** Object to processing of your information for certain purposes. - **Withdraw Consent.** Where processing is based on consent, withdraw your consent at any time. To exercise these rights, contact us at [legal@roji.ai](mailto:legal@roji.ai). We will respond within 30 days (or sooner if required by applicable law) and may ask you to verify your identity before fulfilling your request. ### California Residents If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide additional rights regarding your personal information, including the right to know, delete, correct, and opt out of the sale or sharing of your personal information. We do not sell or share (as defined by the CCPA/CPRA) your personal information. ### European Economic Area, United Kingdom, and Switzerland If you are located in the EEA, UK, or Switzerland, we process your personal data under the lawful bases of the General Data Protection Regulation (GDPR) and UK GDPR, including performance of a contract (to operate the platform and fulfill orders), legitimate interests (fraud prevention, security, and service improvement), compliance with legal obligations, and your consent where applicable. You may contact us regarding EU data protection matters at [legal@roji.ai](mailto:legal@roji.ai). For international data transfers, we rely on Standard Contractual Clauses approved by the European Commission and/or the UK International Data Transfer Agreement. ## Children's Privacy The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us at [legal@roji.ai](mailto:legal@roji.ai), and we will take steps to delete it. ## International Data Transfers ROJI is headquartered in the United States. If you access the Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. We use appropriate safeguards for such transfers, including Standard Contractual Clauses and data processing agreements. ## Changes to This Privacy Policy We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice within the Services at least 30 days before the changes take effect. Your continued use of the Services after the effective date constitutes your acceptance of the revised Privacy Policy. ## Contact Us If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us: **ROJI Inc.** Email: [legal@roji.ai](mailto:legal@roji.ai) Website: [https://roji.ai](https://roji.ai) ## Sitemap - [Every public page, as markdown](/sitemap.md) - [llms.txt](/llms.txt) · [AGENTS.md](/AGENTS.md) · [auth.md](/auth.md)