Privacy Policy

Privacy Policy

Last updated: 11 October 2026

This Privacy Policy explains how Roraima ("we", "us", "the Platform"), operated by Dario Salaris, collects, uses, shares, and protects your personal data when you use our IoT marketplace platform, including our website, mobile services, AI assistants, and connected device features. For the stay.roraima.io portal, the privacy notice published on the portal also applies; it describes the processing specific to search, to the forwarding of enquiries to properties and to properties not listed on Roraima.

We are committed to protecting your privacy in accordance with Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR"), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and all applicable data protection laws.

Please read this policy carefully. By using our Platform, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

The data controller for personal data processed through the Platform is:

2. Data Protection Officer (DPO)

We have not appointed a Data Protection Officer (DPO), as the conditions set out in Article 37 GDPR do not apply. For any matter relating to the processing of your personal data you may contact the data controller at: privacy@roraima.io.

3. Categories of Personal Data We Collect

Depending on how you interact with the Platform, we may collect the following categories of personal data:

3.1 Account and identity data

• Full name, email address, phone number
• Billing and shipping address
• Company name and VAT number or national business number (for vendors and for buyers who request an invoice)
• Tax code (codice fiscale) or other personal tax number, recipient code or certified email (PEC) address for Italian electronic invoicing (only if you request an invoice)
• Account credentials (password stored in hashed form only)
• User role (buyer, vendor/seller, installer)
• Vendor subtype classification (seller, installer, or both)
• Professional documentation uploaded by installers (certifications, insurance)

3.2 Transaction and order data

• Order history, order amounts, payment status
• Booking and rental reservations (dates, guests, duration)
• Invoice and billing information
• Stripe payment identifiers (we do not store full card numbers)
• AI credit balances and consumption history

3.3 IoT device data

• Device status: on/off state, connectivity, firmware version, battery level
• Telemetry data: sensor readings (temperature, humidity, motion, energy consumption), relay states, device health metrics
• Smart lock access logs: timestamps of lock/unlock events, access method used (PIN, app, temporary code), user identifiers associated with each access event
• Usage patterns: frequency of device interactions, automation trigger history, scenario execution logs
• Device configuration: custom names, assigned rooms/zones, automation rules, schedules
• Device pairing and delegation data: device ownership transfers, installer delegation records, sharing permissions

3.4 AI interaction data

• Conversations with our AI assistants (Buyer Agent, Vendor Agent, Installer Agent)
• Questions submitted and responses received
• Knowledge base search queries (Installer Agent only)

3.5 Technical and usage data

• IP address, browser type and version, operating system
• Pages visited, time spent, click patterns
• Cookies and similar tracking technologies (see Section 12)
• Referral source

3.6 Location data

• Vendor business address (displayed on Google Maps for buyer convenience)
• Buyer shipping address
• Approximate location derived from IP address

3.7 Communication data

• Support requests and correspondence
• Vendor-buyer order communications
• Notification preferences

4. Purposes and Legal Bases for Processing

We process your personal data for the following purposes, each with the corresponding legal basis under GDPR Article 6(1):

4.1 Contract performance (Art. 6(1)(b))

4.2 Legitimate interest (Art. 6(1)(f))

4.3 Legal obligation (Art. 6(1)(c))

• Tax and accounting records retention (Italian fiscal law)
• Compliance with consumer protection regulations
• Responding to lawful requests from public authorities
• VAT calculation and reporting for EU cross-border transactions

4.4 Consent (Art. 6(1)(a))

• Marketing communications and newsletters (where applicable)
• Non-essential cookies and analytics (managed via Klaro consent manager)
• Processing of special categories of data, if ever required

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. IoT Device Data — Special Provisions

Given the nature of our platform, IoT device data requires specific attention:

5.1 What IoT data we collect and why

• Device status and telemetry are collected to enable real-time monitoring, automation scenarios, and troubleshooting. This data flows through our IoT Gateway and may be temporarily cached for performance.
• Smart lock access logs record who accessed a property and when. This data is essential for security, booking verification, and dispute resolution. Access logs include timestamps, the method of entry (PIN, temporary code, app), and the associated user or guest identifier.
• Automation scenario execution logs are retained to enable trigger-based automations, allow users to review scenario history, and diagnose failures.
• MQTT real-time data may be transmitted for devices using the MQTT protocol. This data is encrypted in transit and is not stored beyond the duration necessary for real-time processing unless explicitly configured by the user in an automation scenario.

5.2 Data minimisation for IoT

We collect only the device data points necessary for the features you have activated. If you do not use automation scenarios, scenario execution data is not generated. Telemetry granularity is determined by the device manufacturer's firmware and the features you choose to enable.

5.3 Device data sharing

When a device is delegated to an installer or shared with other users, the delegated party gains access to the device data necessary for their role. Delegation is tracked and can be revoked at any time by the device owner. Upon revocation, the delegated party's access to device data ceases immediately.

6. AI Assistants — Special Provisions

6.1 How our AI assistants work

Roraima offers three AI-powered assistants (Buyer Agent, Vendor Agent, and Installer Agent) powered by Anthropic's Claude language model. These assistants help users with product questions, IoT device management, and installation guidance.

6.2 Data processed by AI assistants

• Your messages and queries submitted during a conversation session
• Relevant contextual data (e.g., device status, order information) provided to the AI to generate helpful responses
• For the Installer Agent: indexed documentation from the knowledge base (RAG) used to answer technical queries

6.3 What we do NOT do with AI data

• We do not use your conversations to train or fine-tune any AI model
• We do not share your conversation content with other users
• We do not use AI conversations for profiling or automated decision-making that produces legal or similarly significant effects

6.4 AI data retention

AI conversation logs are retained for up to 90 days to enable conversation continuity and support dispute resolution. After this period, conversations are permanently deleted. You may request earlier deletion at any time (see Section 10).

6.5 Sub-processor

AI processing is performed by Anthropic, PBC (USA) as a data sub-processor. See Sections 7 and 8 for details on international transfers and safeguards.

7. Recipients and Data Processors

We may share your personal data with the following categories of recipients:

7.1 Marketplace vendors (independent controllers)

When you place an order with a vendor on Roraima, the vendor receives the personal data necessary to fulfil your order (name, shipping address, order details) and, if you request an invoice, the data you enter in order to receive it. Each vendor is an independent data controller for the data they receive and process in the context of their customer relationship with you. Vendors are contractually obligated to comply with GDPR and applicable data protection laws. We encourage you to review each vendor's own privacy policy. If you are a vendor, the verified company phone number in your profile is shown to guests on the page of their booking, so that they may contact you during identity verification.

To complete your business profile, you must verify its phone number by entering the code received by SMS in the panel. Roraima generates the code and checks your confirmation. To deliver the message, we send the business phone number and the short verification text containing the code to Sendberry, a service of Think Intermedia SIA (Latvia). Only a verified number is used as the business contact. The current number remains in the profile, and every change requires a new verification. This message verifies the vendor’s phone and contains no promotional content.

The code is valid for 10 minutes. In our records it is stored in a protected form, without the readable digits, and is removed after use or expiry at the first run of the periodic cleanup, scheduled every 5 minutes. Roraima retains request counters for 24 hours, failed attempts for 10 minutes and the technical sending register for 30 days, using the same periodic cleanup. This register contains sending references, the outcome, the cost and a protected recipient reference, without the full SMS text. These periods apply to Roraima’s records.

If you are a guest and the property you booked has a code lock, the door code may also reach you by SMS, at the number given in the booking or on your guest page. It is a copy of the code shown on that page, and it helps when you have no data connection on arrival. To deliver it, we send your number and the text of the SMS, which contains only the name of each door and its code, to Sendberry, a service of Think Intermedia SIA (Latvia). If the number belongs to a country outside the European Union, the SMS reaches you through that country’s phone operators, because there is no other way to deliver it. For this message Roraima processes the data on behalf of whoever runs the property.

Roraima does not keep the text of these SMS. The technical sending register is kept for 30 days and contains the sending references, the outcome, the cost and a protected reference to the number. The status of the last message, which prevents the same SMS from being sent twice and lets it be sent again when the code or the number changes, stays with the booking and is deleted together with its contact details. Sendberry processes this data on our behalf and only on our instructions, as its terms of service provide.

7.2 Payment processor

Stripe, Inc. (USA) and its affiliate Stripe Payments Europe, Ltd. (Ireland) process payment transactions via Stripe Connect. Stripe acts as an independent data controller for payment data. Stripe's privacy policy is available at stripe.com/privacy.

7.3 AI service provider

Anthropic, PBC (USA) provides the Claude language model that powers our AI assistants. Anthropic processes conversation data solely on our behalf as a data processor and does not use this data to train its models.

7.4 Mapping service

Google LLC (USA) provides Google Maps services to display vendor locations. Google's privacy policy is available at policies.google.com/privacy.

7.5 Hosting and infrastructure

Our platform is hosted on servers located in the European Union (Netherlands). Our hosting provider processes data solely on our behalf under a data processing agreement compliant with GDPR Article 28.

7.6 Other recipients

• Professional advisors: legal counsel, accountants, and auditors, bound by professional secrecy obligations
• Public authorities: when required by applicable law, regulation, or legal process
• IoT device manufacturers: certain device data may be exchanged with the device manufacturer's cloud platform (e.g., Tuya Smart) to enable device functionality. Such exchanges are governed by the manufacturer's privacy policy and our data processing agreements

7.7 Smart lock access providers

When your host manages property access through smart locks operated via igloohome, your access credentials are processed by Igloocompany Pte. Ltd. (Singapore), which provides the igloohome platform. Each host uses their own igloohome account and is an independent data controller for this processing; Igloocompany acts as processor and, for access data, may also act as a controller under its own terms. Roraima's platform transmits only a neutral booking reference (not your name) to generate your access PIN and, where a Wi-Fi bridge is active, receives lock access events (timestamps of PIN use) for security and dispute resolution. We apply data minimisation and do not send direct guest identifiers to igloohome. Igloocompany declares compliance with the GDPR and UK GDPR in addition to Singapore's Personal Data Protection Act (PDPA); its Data Protection Officer can be contacted at [email protected]. International transfer safeguards are described in Section 8.

8. International Data Transfers

Some of our processors and partners are located outside the European Economic Area (EEA), specifically in the United States. We ensure that any transfer of personal data to countries outside the EEA is protected by appropriate safeguards as required by GDPR Chapter V:

• Standard Contractual Clauses (SCCs): We have entered into the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with our US-based processors (Anthropic, Stripe, Google) to ensure an adequate level of protection for transferred data.
• EU-U.S. Data Privacy Framework: Where applicable, we rely on processors' certification under the EU-U.S. Data Privacy Framework as an additional safeguard.
• Supplementary measures: We implement additional technical and organisational measures as necessary, including encryption in transit and at rest, access controls, and data minimisation.
• Providers in other third countries: In addition to the United States, certain recipients are located in other third countries — in particular Igloocompany Pte. Ltd. (Singapore), our smart lock access provider, and the cloud platforms of some IoT device manufacturers (for example Tuya Smart, China). For these transfers we rely on the safeguards declared by each provider to ensure a level of protection essentially equivalent to that guaranteed within the EEA: igloohome declares adequate safeguards under the EEA/UK appendix to its privacy policy and compliance with the GDPR and UK GDPR, in addition to Singapore's PDPA. We combine these with our own data minimisation measures (only a neutral booking reference is transmitted). You may request details of these safeguards from the data controller.

You may request a copy of the relevant safeguards by contacting the data controller.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Below are the specific retention periods by data category:

When data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you.

10. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

How to exercise your rights

You may exercise any of the above rights by contacting us at privacy@roraima.io or the data controller at privacy@roraima.io. We will respond to your request within 30 days, which may be extended by a further 60 days for complex requests, in which case we will inform you of the extension and the reasons for it.

We may ask you to verify your identity before fulfilling your request to prevent unauthorised access to personal data.

Supervisory authority

The competent supervisory authority for complaints is:

Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma, Italy
Website: www.garanteprivacy.it
Email: [email protected]
PEC: [email protected]

11. Marketplace Roles — Controller and Processor

Roraima operates as a marketplace platform connecting vendors and buyers. This creates distinct data controller roles:

11.1 Roraima as data controller

We are the data controller for:

• User account data (registration, authentication, profile management)
• Platform usage and analytics data
• Payment processing coordination (via Stripe Connect)
• IoT device data managed through the platform
• AI assistant conversations
• AI credit management
• Cookie consent management
• Platform communications and support

11.2 Vendors as independent data controllers

Each vendor on the Roraima marketplace is an independent data controller for personal data they collect and process in the context of their relationship with buyers, including:

• Fulfilling orders and providing after-sales support
• Managing their own customer communications
• Processing returns and warranty claims
• Installation services and property access arrangements

Vendors are required under our Terms and Conditions to comply with the GDPR and to maintain their own privacy policies. We are not responsible for vendors' data processing practices beyond what occurs through the Platform.

11.3 Joint controllership

For certain processing activities (e.g., displaying vendor profile pages, facilitating reviews), Roraima and the vendor may act as joint controllers under GDPR Article 26. The respective responsibilities are defined in our Vendor Agreement.

12. Cookies and Similar Technologies

We use cookies and similar technologies on our Platform. We use Klaro as our consent management platform to allow you to manage your cookie preferences.

In summary, we use:

• Strictly necessary cookies: essential for the functioning of the Platform (e.g., session management, shopping cart, security). These do not require consent.
• Functional cookies: remember your preferences (e.g., language, currency).
• Analytics cookies: help us understand how the Platform is used so we can improve it.
• Third-party cookies: set by our partners (e.g., Stripe for payment security, Google Maps for vendor locations).

You can manage your cookie preferences at any time by clicking the cookie settings link in the footer of our website. For full details, please refer to our Cookie Policy.

13. Automated Decision-Making

We do not currently engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of GDPR Article 22.

Our AI assistants provide informational responses and suggestions but do not make decisions that have legal or significant effects on users. All purchase decisions, account actions, and service activations require explicit user action.

Should we introduce any form of automated decision-making in the future, we will update this Privacy Policy and, where required, obtain your explicit consent or implement suitable safeguards, including the right to obtain human intervention, express your point of view, and contest the decision.

14. Children's Privacy

The Roraima Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete such data promptly.

If you are a parent or guardian and believe that your child has provided personal data to us, please contact us at privacy@roraima.io so that we can take appropriate action.

15. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• Encryption of data in transit (TLS/SSL) and at rest where applicable
• Hashed password storage using industry-standard algorithms
• Access controls and role-based permissions
• Regular security assessments and vulnerability testing
• Secure smart lock access code generation and encrypted transmission
• Rate limiting and abuse prevention on all API endpoints
• CSRF protection on all forms
• Content Security Policy (CSP) headers
• Server-side input validation and sanitisation

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify registered users via email or platform notification for significant changes
• Where required by law, seek your renewed consent before applying changes to your data

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after the effective date of any changes constitutes your acknowledgement of the updated policy.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

This Privacy Policy is available in the following languages: English, Italiano, Deutsch, Ελληνικά, Español, Français, Polski, Português.