1. Who we are
Roam UG (“Roam”, “we”, “us”) operates roam.ug, a locally verified travel guide for Kasese, Uganda, that answers visitor questions in plain language and publishes a directory of verified local places and services.
For the purposes of Uganda’s Data Protection and Privacy Act 2019 (the “DPA”) and the EU and UK General Data Protection Regulation (the “GDPR”), Roam UG is the data controller for the personal data described in this policy.
- Controller
- Roam UG
- Registration number
- 80034479407189
- Privacy contact
- privacy@roam.ug
Our registered postal address is available on request from the privacy contact above, and will be published in this section.
2. What this policy covers
This policy covers personal data we process when you use roam.ug, when you message Roam on WhatsApp, when you contact us through the website, and when a member of the Roam team uses our protected admin workspace.
It does not cover the practices of the local businesses listed in our directory. When you call, message or visit a business you found through Roam, that business handles your information under its own practices. It also does not cover websites we link to, such as the official Rwenzori Marathon site or Google Maps.
3. What we collect
Information you give us
- Questions you ask Roam. The text of your question is processed to produce an answer and a shortened copy is stored so we can see which needs we could not answer. Before storage we automatically remove email addresses and long digit sequences such as phone numbers, collapse whitespace, and truncate the text to 180 characters.
- Contact form submissions. Your name, email address and message, so we can reply and keep a record of the request.
- WhatsApp messages. If you message the Roam WhatsApp number, we receive and store your WhatsApp phone number, your messages and our replies, so the team can answer you and continue the conversation.
- Team accounts. For Roam staff only: name, work email address, password credentials, two-factor authentication settings, and a log of administrative actions.
Information collected automatically
- An anonymous identifier. A random identifier is generated in your browser and stored on your device so we can count visitors and group a conversation together. It is not linked to your name and we do not attempt to identify you from it.
- Usage events. Which category a question fell into, whether Roam had a confident answer, how long the answer took, which listings were shown, and the page you were on.
- Product analytics and session replay. We use PostHog, which records page views, clicks and other interactions, captures replays of browsing sessions, builds heatmaps, records browser errors and measures page performance. PostHog also derives an approximate location (typically city level) and device and browser details from your connection. This is only active if you agree to analytics cookies. See our Cookie and tracking notice.
- Performance measurement. Vercel Analytics and Speed Insights record aggregate page views and loading performance.
Information you can choose to share
- Precise location. If you ask something like “near me”, your browser asks permission to share your location. If you allow it, the coordinates are used to rank that single answer and are not written to our analytics records. If you refuse, Roam simply answers without distance ranking.
4. What we do not collect
- We do not ask visitors to create an account to use Roam.
- We do not take payments and do not collect card or mobile-money details.
- We do not store your IP address on usage events. It is used momentarily to apply rate limits that protect the service, and is processed by our hosting and analytics providers as described below.
- We do not sell personal data, and we do not share it with advertising networks.
- We do not knowingly collect data from children. See Children.
5. Why we use it, and our legal basis
Under the DPA and the GDPR we must have a lawful basis for each use of personal data. Ours are as follows.
| Purpose | Data used | Legal basis |
|---|---|---|
| Answering your question and showing relevant verified places | Question text, conversation context, optional location | Legitimate interests: providing the service you asked for |
| Recording which questions we could not answer, so the team can verify new information | Redacted question text, category, anonymous identifier | Legitimate interests: improving the accuracy and coverage of the guide |
| Replying to your contact message | Name, email, message | Legitimate interests, or steps at your request prior to a contract |
| Answering you on WhatsApp | Phone number, message content | Legitimate interests: responding to a message you sent us |
| Product analytics, session replay and heatmaps | Interaction events, replays, approximate location, device details | Consent, which you can withdraw at any time |
| Keeping the service available and secure, and preventing abuse | Rate-limit counters, error reports, audit logs | Legitimate interests: security and service integrity |
| Operating team accounts and recording administrative actions | Staff account and audit data | Contract with our staff, and legal obligation to keep records |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can object to processing based on legitimate interests at any time. See Your rights.
6. Automated processing and AI
Roam answers are produced by matching your question against our own verified Kasese records. Where an AI model is used, it is used to phrase an answer around records we already hold; it does not invent places, prices or availability, and Roam says so when it cannot find a confident match.
AI requests are routed through the Vercel AI Gateway to model providers. Your question text may be sent to those providers to generate the wording of an answer.
We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 of the GDPR.
8. International transfers
Roam is operated from Uganda and some of our providers process data outside Uganda, including in the European Union and the United States. Where personal data is transferred out of Uganda we take steps required by section 19 of the DPA, and where data protected by the GDPR is transferred outside the EEA or the UK we rely on the European Commission’s standard contractual clauses or another lawful transfer mechanism offered by the provider.
9. How long we keep things
| What | How long |
|---|---|
| Redacted question text and usage events | Kept for a maximum of 24 months, and reviewed and deleted sooner once they no longer help us improve coverage |
| Contact form messages | Kept while we handle your request and for a reasonable period afterwards for our records |
| WhatsApp conversations | Kept so the team can continue the conversation. An owner can permanently purge a conversation on request, which deletes the messages and leaves only a content-free record that a deletion happened. |
| Your conversation on your own device | Stored in your browser for up to six hours so you do not lose the thread while browsing, then discarded. You can clear it immediately using the reset control in the chat panel. |
| Listing records and their revision history | Kept for as long as the listing is published, with an append-only history so corrections are traceable |
| Team accounts and audit logs | Kept for the life of the account and afterwards where needed for security and accountability |
| Analytics held by PostHog and Vercel | Held under those providers’ retention settings for our account |
10. How we protect information
- The site is served over HTTPS.
- The admin workspace is invite-only, with two-factor authentication required for owner and administrator accounts.
- Administrative actions are recorded in an audit log, and sensitive actions such as permanently deleting a conversation require a fresh sign-in.
- Access to the database and stored media is restricted to the systems and staff that need it.
- Question text is stripped of email addresses and long digit sequences before storage.
11. Your rights
Under the DPA and, where it applies to you, the GDPR, you may ask us to:
- confirm whether we hold personal data about you, and give you a copy;
- correct data that is inaccurate or incomplete;
- delete data, where there is no overriding reason for us to keep it;
- restrict or object to how we use it, including profiling and any use based on legitimate interests;
- receive data you gave us in a portable format, where that right applies;
- withdraw consent to analytics and session replay at any time, without affecting processing carried out before you withdrew it.
Write to privacy@roam.ug or use our contact page. We will respond within 30 days. Because most visitor data is tied to a random identifier on your device rather than to your name, we may ask you for information that helps us locate the right records, and in some cases we may be unable to identify any data as yours.
If you are unhappy with our response you can complain to the Personal Data Protection Office of Uganda. If the GDPR applies to you, you can also complain to the supervisory authority where you live or work.
13. Information about listed businesses
Our directory contains details of local businesses and places, including a contact number where the business agreed to publish one. If you are a listed business and want your details corrected, your phone number hidden, or your listing removed, see our Business listing terms, which explains what we publish and how to make a request.
14. Children
Roam is intended for adults planning travel. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@roam.ug and we will delete it.
15. Changes to this policy
We update this policy when the service changes. The effective and last-updated dates appear at the top of this page. Where a change materially affects how we use your personal data we will make that clear on the site before the change takes effect.
16. Contact us
Questions about this policy, or to exercise any right described above, write to privacy@roam.ug or use the contact page.