Privacy Policy

This policy applies when you browse RoomMeet, create an account, submit a post, track a submission, contact support, make a payment, manage billing, or otherwise use RoomMeet.

It also applies when an authorized administrator connects an Instagram professional account to RoomMeet so approved student submissions can be published to a class page. Instagram Platform Data received through Meta integrations is described separately below and is distinct from an Instagram handle a student includes in a submission.

Account information, which may include your name (if you add one), email address, phone number, SMS consent if you opt in to texts, and account settings. Account, payment, authentication, support, and administrative information is not treated as public content merely because you have an account.

Submission information, which may include your Instagram handle, photos, bio or introduction text, school or class-page selection, and plan or purchase choices.

Support information, which may include your email address, message, tracking number, Instagram handle or post link, and details about edits, removals, or other requests.

School-request information, if you ask RoomMeet to add a school, which may include the school name, your email address, and optional notes you choose to send.

Age and agreement affirmations, including records that you confirmed you are at least 18 years old and agreed to the Terms of Service and Privacy Policy (with the policy versions and time of affirmation).

When you sign in or verify contact information, we may collect your email address, telephone number, authentication request details, verification status, and related security information. We or our service providers may generate and transmit temporary one-time authentication codes.

We use this information to authenticate users, associate verified contact information with an account, prevent unauthorized access, investigate abuse, and maintain the security of the Services. Users should not share authentication codes with another person.

Authentication codes are stored in hashed form for temporary verification. They are not retained as long-term credentials. RoomMeet login verification codes currently expire after 10 minutes, and codes expire after the period stated during the authentication process.

When you use RoomMeet, we may collect limited technical and usage information needed to run, secure, and improve the service. This can include basic device or browser information and general activity on the site, such as pages visited or actions taken in the submission, account, tracking, or support flows.

We use cookies and similar technologies for login sessions, security, and basic site functionality so you can stay signed in and use protected features. RoomMeet also records first-party product analytics in its own systems.

For product analytics and pricing tests, RoomMeet may create an anonymous visitor identifier stored in your browser and record campaign tags from links you use to reach RoomMeet (such as utm_source, utm_medium, and utm_campaign). Those tags may be kept in your browser so later visits and school links can keep the same campaign attribution when the destination URL does not already include tags.

When RoomMeet runs a pricing or related experiment, we may assign your anonymous visitor identifier to a test group and store that assignment so pricing shown to you stays consistent during the test.

We may receive personal information from third parties when you interact with an integrated service or when information is needed to provide, secure, or support the Services. Depending on how you use RoomMeet, this may include:

payment status, transaction identifiers, billing details, and fraud-related signals from payment processors;

Instagram Platform Data when an authorized admin connects or uses a Meta-related feature, which may include account and profile information, publishing data, comments, messages, insights, and related technical information as described in Instagram Platform Data below;

delivery status, verification results, and limited technical information from email or SMS providers;

security, device, network, performance, and diagnostic information from infrastructure, hosting, and database providers; and

information submitted by another person when they contact us about a transaction, submission, support issue, infringement claim, safety concern, or suspected violation.

The information we receive depends on the third-party service, your settings, the permissions you grant, and the features you use.

Paid purchases are processed by Stripe. We may receive payment status, amount, product or plan details, and Stripe transaction identifiers. We do not store full payment card numbers.

Billing, refunds, cancellations, and chargebacks are described in our Refund Policy. Related purchase terms appear in our Terms of Service. The Refund Policy controls refund and billing-dispute questions.

We collect the photographs, biographies, profile details, social-media handles, preferences, messages, and other content that users submit through the Services.

We may also generate and maintain administrative information relating to submissions and accounts, including review status, approval or rejection decisions, scheduling information, moderation flags, support history, internal notes, reports, removal requests, transaction status, and records concerning suspected fraud, abuse, policy violations, or account restrictions.

We use this information to review and publish submissions, administer paid and unpaid services, provide support, enforce our policies, protect users and the Services, and maintain appropriate operational records. Internal notes and similar administrative records are used for RoomMeet operations and are not disclosed to the public as part of a class-page post.

The license you grant RoomMeet to use submitted Content, and RoomMeet’s rights to approve, reject, edit, remove, or decline to publish submissions, are described in our Terms of Service.

Certain information submitted through RoomMeet is intended to be publicly displayed or distributed as part of the service. This may include photographs, biography or introduction text, school or class information, interests or preferences you choose to write in your bio, your social-media handle, and other content included in a submission. A name may appear publicly if you include it in your bio or other submitted content; RoomMeet does not treat ordinary private account fields as public merely because an account exists.

If your submission is approved, that public submission content may be published on a connected Instagram class-page account as a feed post, story, or both, depending on the school and posting choices. Publicly displayed information may be viewed, copied, saved, reshared, indexed, or otherwise used by other users or third parties outside RoomMeet’s control.

Removing content from RoomMeet or requesting that RoomMeet remove a post does not guarantee the removal of copies previously saved, shared, indexed, or posted through third-party platforms. How to request edits or removals, and limits on third-party copies, are also described in our Terms of Service. Refund consequences of removal or deletion requests are described in our Refund Policy.

Instagram Platform Data is information RoomMeet may receive from Meta/Instagram through an authorized Instagram-related integration. It is separate from an Instagram handle or other content a student voluntarily includes in a RoomMeet submission.

When an authorized administrator connects an Instagram professional account or uses Instagram-related RoomMeet features, RoomMeet may request, receive, store, and process Instagram Platform Data needed to operate those features. Depending on the permissions granted to RoomMeet and the features used, this may include:

account identifiers, usernames, profile information, and profile picture URLs;

access tokens, token expiration information, connection status, and related authentication or permission details;

connected professional account or page information and school or admin associations;

media, captions, publishing status, permalinks, and related content used to create, schedule, publish, or manage posts and stories;

comments and related commenter information used for moderation, review, filtering, or support;

direct messages and related participant or conversation information used for inbox sync, support, and reply workflows;

insights and engagement metrics (such as reach, interactions, likes, comments, or similar performance data) used for operational reporting; and

webhook or technical event data needed to keep connected messaging, publishing, and account features working.

We use Instagram Platform Data only to provide, maintain, secure, and support the applicable RoomMeet features; publish approved RoomMeet content when authorized; operate admin tools; comply with user or admin instructions; troubleshoot platform functionality; enforce our policies; and comply with applicable law and Meta’s requirements. We do not use Instagram Platform Data for sale to data brokers, advertisers, or other third parties, and we do not use it for cross-context behavioral advertising.

The precise information available may depend on Meta’s permissions, App Review status, account settings, and which RoomMeet features are enabled. If a permission is granted to RoomMeet, we may process the corresponding data category when the related feature is used.

Instagram access tokens are kept while the connection remains active or as needed to support reconnect, audit, security, and operational workflows. Disconnecting an Instagram account removes the active assignment from schools and disables future posting through that token.

If you connected Instagram through RoomMeet, you may revoke RoomMeet access from your Instagram or Meta account settings. Revoking access stops future use of that connection. Contact us if you also want RoomMeet’s stored connection records deleted.

RoomMeet does not currently exchange personal information for monetary payment. Based on our current documented practices for this RoomMeet product, we do not knowingly sell personal information, share it for cross-context behavioral advertising, or use personal information for cross-context behavioral advertising, as those terms are defined under applicable privacy laws.

We disclose personal information to service providers and other parties as described in this Privacy Policy for operational purposes such as hosting, payments, communications, security, social-media integration, support, and legal compliance.

Privacy laws may define “sale,” “sharing,” and “targeted advertising” more broadly than their ordinary meanings. If our practices change in a way that creates additional notice or opt-out obligations, we will update this Privacy Policy and provide any rights required by applicable law.

We use information to operate RoomMeet, including creating and managing accounts, verifying login, processing and reviewing submissions, providing tracking and status updates, publishing approved content, responding to support requests, sending verification codes and transactional notices, processing payments, preventing abuse, and improving the service.

We may use submission content and Instagram Platform Data in RoomMeet admin tools so authorized personnel can review, schedule, post, moderate, message, support, and report on connected class-page accounts and related submissions.

We share information with service providers that help us operate RoomMeet, as described in Service Providers below.

Approved submission content may be published publicly as described in Information You Choose To Make Public.

You are responsible for making sure you have the rights and consent needed for content you submit, and for not including information you do not want made public.

We may disclose information if required by law, to enforce our Terms of Service, to protect RoomMeet or users, or to respond to lawful requests.

Depending on the features enabled and used, we may use service providers for hosting, database infrastructure, payment processing, email delivery, telephone or SMS verification, security, and social-media platform integrations.

RoomMeet currently uses or expects to use the following providers: Vercel for website and application hosting (including related file storage used for uploaded and generated images, and related infrastructure, security, or diagnostic logs); Neon for database infrastructure; Stripe for payment processing; Resend for transactional email delivery; Twilio for telephone or SMS verification and related transactional text delivery; and Meta/Instagram for Instagram publishing, comments, messaging, insights, and related platform functionality.

Product analytics described in this Privacy Policy (including anonymous visitor identifiers, campaign attribution, and pricing-experiment assignment) are recorded in RoomMeet’s own systems. The named providers above are not used as a separate third-party advertising analytics product for those practices.

These providers may process personal information as needed to provide their services to RoomMeet, including hosting, storage, transmission, security monitoring, delivery, and support. Their own terms and privacy policies may also apply to their handling of information.

We retain personal information for as long as reasonably necessary to provide and operate the Services, maintain accounts and submissions, process transactions, provide support, enforce our agreements, prevent fraud or abuse, meet legal and accounting obligations, and establish, exercise, or defend legal claims.

Retention periods vary based on the type of information, the reason it was collected, whether an account or submission remains active, and applicable legal or operational requirements. When information is no longer reasonably necessary, we may delete, anonymize, or securely dispose of it.

Deleted information may remain for a limited period in backups, archives, logs, transaction records, fraud-prevention records, or disaster-recovery systems. We may also retain information when required by law or reasonably necessary for security, dispute resolution, enforcement, or legal claims. Information retained in backups may not be immediately accessible or removed individually and may be deleted through the applicable backup-rotation process.

Authentication codes are intended for temporary verification purposes and expire after the period stated during the authentication process. RoomMeet login verification codes currently expire after 10 minutes and are stored in hashed form during that period.

Depending on where you live and whether the applicable law applies to RoomMeet, you may have rights to request access to, correction of, or deletion of personal information. You may submit privacy requests by emailing hello@roommeet.net. You may also use our Data Deletion page for instructions related to RoomMeet account data and Instagram-connected data.

While signed in, you may be able to update certain account details and manage SMS consent where those controls are available. If you receive RoomMeet texts after opting in, you may reply STOP where that option is offered.

Deleting your RoomMeet account removes your login account. It does not automatically delete every related record. If you want submissions, photos, support history, or published Instagram content removed, request that separately through Support, our Data Deletion page, or hello@roommeet.net.

We may take reasonable steps to verify your identity, authority, account, or relationship to the personal information involved before fulfilling a request.

We will respond within the period required by applicable law. When the Virginia Consumer Data Protection Act applies, we generally respond without undue delay and within 45 days after receiving the request. We may extend the response period once by up to an additional 45 days when reasonably necessary, provided that we notify you within the initial period and explain the reason for the extension.

If we decline to act on a qualifying request, we will provide the explanation and appeal instructions required by applicable law. Requests may be limited or denied where permitted by law, including when we cannot reasonably verify the requester, an exception applies, or the request is manifestly unfounded, excessive, or repetitive.

We use reasonable administrative, technical, and organizational safeguards to protect information, including limiting access to sensitive credentials. No internet service can guarantee perfect security.

RoomMeet is based in the United States. If you access the Services from outside the United States, your personal information may be transferred to, stored in, or processed in the United States and in other locations where RoomMeet or its service providers operate. Privacy and data-protection laws in those locations may differ from the laws in your jurisdiction.

Where applicable law requires specific safeguards for an international transfer, RoomMeet will take the measures required by that law.

RoomMeet is intended for users who are at least 18 years old, consistent with our Terms of Service. We do not knowingly permit individuals under 18 to use the Services, and we do not knowingly collect personal information from children under 13. If you believe a child under 13, or any person under 18, has provided personal information, contact hello@roommeet.net. We may take the steps described in our Terms of Service, including suspending or terminating access, removing associated content, and deleting information where appropriate, subject to legal, fraud-prevention, transaction-record, dispute-resolution, and security requirements.

Privacy and data-deletion requests: hello@roommeet.net.

General support for edits, removals, and submission help: support@roommeet.net.

Billing and refund-review requests: support@roommeet.net, as described in our Refund Policy.

We may update this Privacy Policy as RoomMeet changes. The “Last updated” date above indicates the latest version. Continued use of RoomMeet after an update means you accept the updated Privacy Policy, except where applicable law requires a different process. Updates to the Terms of Service and Refund Policy are governed as stated in those documents.