Privacy policy

1. Who we are and what this policy covers

Roam Industries Pty Ltd, trading as Roam (“Roam”, “we”, “us”), is an Australian company. We build and operate a destination marketing platform for Australian tourism organisations, and we run this website, roamhq.io.

This policy explains how we handle personal information collected through roamhq.io, for example when you book a demo, send us a message or browse the site. We handle personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

This policy does not cover the destination websites that run on the Roam platform. Each of those is operated by the tourism organisation whose name is on it, under its own privacy policy. Nor does it cover the personal information we handle on behalf of our clients as part of providing the platform; that is governed by our agreements with them.

2. What we collect

Information you give us. When you book a demo, we ask for your first and last name, work email, organisation, organisation type and state. You can also give us your phone number, your current website and anything you’d like us to see. When you contact us, we ask for your name, email, the kind of enquiry and your message, and you can also give us your organisation. Optional fields say “(optional)”. Both forms ask you to agree to Roam contacting you about your enquiry, and we keep that with your submission.

Information sent with a form. When you send a form, we also receive the page you sent it from, the page you first landed on during that visit, the website that referred you (its address only) and any campaign tags in the address you arrived at (such as utm_source). With each submission we also keep your IP address, your browser’s description of itself (its “user agent”), the page that referred you to the form, and the country our hosting provider reports for your connection.

Information collected automatically. When you use the site we collect limited technical information so that it works and so that we can understand how it is used:

Analytics. We use Google Analytics 4, which Cloudflare runs for us (through a service called Zaraz), and Cloudflare Web Analytics, to understand which pages are visited, where visitors come from, and whether they reach and complete a demo request. Google receives the page address, the page that referred you, your device and browser type, an approximate location worked out from your IP address, and events such as opening a question, playing a video or sending a form, with an identifier and a count. It never receives what you type into a form, or your name, email or organisation. Google Analytics uses cookies to recognise your browser (see section 9). Cloudflare Web Analytics doesn’t use cookies.
First-touch details. To understand how people find Roam, the site stores in your browser the page you first landed on, the website that referred you, and any campaign tags in the address. They stay in your browser until that browser session ends, and reach us only if you send a form.
Security checks. Our forms are protected against automated submissions by checks that don’t ask anything of you. If a form shows a security check, it comes from Cloudflare Turnstile, which processes technical information about your browser and connection to judge whether a person is using it.
Maps. Some pages show a map from Mapbox. When a map loads, your browser requests it directly from Mapbox, which receives your IP address and technical information about your browser.
Server logs. Like most websites, our hosting and content-delivery provider records technical information such as IP address, browser type and the pages requested, which is used for security and to keep the site running.

We do not ask for sensitive information (such as health or political information) through this website, and we ask that you don’t include it in a message to us.

3. Why we collect it

We collect and use personal information to:

respond to your enquiry or demo request, and arrange and deliver the demo;
keep a record of our conversations with you and your organisation, so you don’t have to repeat yourself;
understand how people find the website and how it is used, so we can improve it;
keep the website secure and prevent misuse;
meet our legal obligations.

We do not sell personal information, and we do not use it for automated decision-making that affects you.

We share personal information only with the service providers we need to run the website and respond to you, and only for those purposes:

Attio: our customer relationship management system, where we keep details of enquiries, demo requests and our conversations with organisations. What you enter in a form, and the page and campaign details sent with it, are passed to Attio. We keep details of leads there, not cookie data. Attio may store information on servers outside Australia.
Cloudflare: hosts this website and the data its forms collect, delivers the site, and provides our analytics and any security check on our forms. Cloudflare operates globally.
Google: Google Analytics 4, as described in section 2. Google LLC may process this information in the United States and other countries.
Mapbox: provides the maps on this site, as described in section 2. Mapbox operates globally.
Our email provider: Google, which also handles the email we send and receive.

Where a provider stores information outside Australia, we take reasonable steps to ensure it is handled in a way consistent with the APPs, including by relying on the provider’s contractual commitments and security practices (APP 8).

We may also disclose personal information where the law requires it, or to protect our rights or the safety of a person.

5. Marketing emails

Our forms do not sign you up to marketing emails. We use your details to reply to you and to arrange or follow up a demo you asked for. If you register interest in a product that isn’t available yet, we’ll contact you about that product. We don’t send marketing emails at this stage.

6. How long we keep it

Form submissions are kept in the website’s own storage for 90 days, then their personal details are deleted within a week. That includes the IP address, browser and country kept with them.
A record that a form was passed to Attio stays after that, without your name or email: its form, dates, status, the page and campaign details, and Attio’s reference for the record.
Records in Attio are kept for as long as we have an ongoing relationship or a reasonable business need, after which they are deleted or de-identified.
Google Analytics keeps data about your visits for 14 months, restarting each time your browser returns, then deletes it.
First-touch details in your browser end with your browser session.

7. How we keep it secure

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. The website is served over HTTPS; access to our systems is restricted to the people who need it; and our providers maintain their own security programs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Access, correction and complaints

You can ask us for access to the personal information we hold about you, or ask us to correct it, by contacting us using the details in section 10. We will respond within a reasonable time, and we may need to verify your identity first.

If you believe we have mishandled your personal information, please contact us first and we will do our best to resolve it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au⁠ (opens in a new tab).

9. Cookies and browser storage

The site uses no advertising cookies. It uses:

analytics cookies set for Google Analytics 4, which recognise your browser between visits and typically last up to two years;
browser storage for the first-touch details in section 2, and to remember your place in a video;
a cookie from Cloudflare, only if a form shows a security check or Cloudflare’s protection needs one;
a sign-in cookie, only for Roam staff using the site’s admin.

You can clear or block cookies and browser storage in your browser settings, use a content blocker, or install Google’s opt-out add-on for Google Analytics (tools.google.com/dlpage/gaoptout). The site still works without them; forms may ask you to complete a security check again.

10. Contact

Privacy enquiries: connect@roamhq.io.

Roam Industries Pty Ltd, trading as Roam. ABN 33 670 658 956.

11. Changes to this policy

We may update this policy from time to time. The date at the top tells you when it last changed. If a change is significant we will note it here.