Privacy Policy

1. What We Collect

Information You Give Us

When you create an account or use the Service, you provide:

• Name, email address, and phone number
• Business name, address, and type
• Tax identification and licensing information
• Login credentials (passwords are hashed, never stored in plain text)
• Product catalogs, pricing, and event details you create
• Support messages and communications with us

Information We Collect Automatically

• IP address and approximate location
• Device type, operating system, and browser
• Pages visited, features used, and session duration
• Transaction metadata (amounts, timestamps, order details)
• Device identifiers for order attribution

Staff and Team Pay Data

If you use Team Pay to track hours and calculate what to pay your staff, we collect and process information about each staff member you invite, including:

• Name, email address, and phone number
• Role and assigned menus/catalogs
• Hourly wage rate and time entries you log on their behalf
• Tip allocations and pay run history (hours, wages, overtime, totals)

Rowie does not collect bank account numbers, routing details, or other payment account information for your staff. Team Pay calculates amounts and generates a report (including a CSV export) that you use to pay staff externally through your own bank, payroll provider, or other method. As the merchant, you confirm you have the right to share staff contact information with Rowie for the purpose of hours tracking and pay calculation.

Referral Program Data

If you participate in the Rowie referral program, we collect and process:

• Your referral code and link
• The identity of users you refer (and, if you were referred, who referred you)
• Referral status, activation dates, and expiration dates
• Earnings amounts, commission calculations, payout history, and clawback records
• Stripe transfer IDs associated with referral payouts

Payment Data

Rowie does not collect, store, or have access to full card numbers, CVV codes, or sensitive payment authentication data. All payment information is collected and processed directly by Stripe. We only receive transaction references and limited payment tokens from Stripe.

2. How We Use Your Information

• Operate and improve the Service
• Process transactions through Stripe Connect
• Send transactional emails (receipts, order confirmations, password resets)
• Detect and prevent fraud, abuse, and security threats
• Provide customer support
• Generate analytics and business insights for your dashboard
• Track referral relationships, calculate commissions, process referral payouts, and detect referral program abuse
• Report referral earnings to tax authorities where required by law
• Comply with legal, tax, and regulatory requirements
• Communicate service updates and operational notices

We do not sell your personal information. We do not use your data for advertising purposes.

Lawful Bases (GDPR)

Where the GDPR applies, we rely on the following lawful bases:

• Performance of a contract — creating and operating your account, processing payments and orders, and providing the Service you signed up for
• Legitimate interests — preventing fraud and abuse, securing the platform, and improving the Service
• Consent — marketing communications and analytics cookies; you can withdraw consent at any time
• Legal obligation — tax, accounting, and regulatory record-keeping

3. Who We Share Data With

Stripe

We share necessary information with Stripe to facilitate payment processing, manage disputes, and meet compliance requirements. Stripe's use of data is governed by Stripe's Privacy Policy.

Google

When customers visit your public menu, event, booking, or subscription pages and select a language different from your default, Rowie may send vendor-generated content (such as product names, descriptions, and category labels) to Google Cloud Translation API to generate translations in real time. Translated content is cached on our servers for up to 7 days and is automatically refreshed when you update your content. We do not send customer personal data, payment information, or transaction data to Google for translation. Google's use of submitted text is governed by the Google Cloud Translation Data Usage Policy.

We also use Google Maps geocoding to turn venue addresses that vendors enter into map coordinates, Google Wallet to deliver event ticket passes when a customer chooses to add one, and Google Play for app distribution and in-app subscription billing on Android.

Apple

If you buy an event ticket and add it to Apple Wallet, the pass is delivered through Apple's wallet service. On iOS, Rowie subscriptions purchased in the app are billed through Apple's App Store in-app purchase system. Apple processes this data under its own privacy policy.

Infrastructure Providers

The Service runs on infrastructure we operate ourselves in the European Union — we do not use a public-cloud hosting provider for Service data. Traffic to our domains passes through Cloudflare, which terminates TLS and proxies requests as our network and security provider. We use Resend to deliver transactional email (receipts, confirmations, password resets) and Google Analytics on the marketing website (only with your consent — see Section 4). These providers process data on our behalf under data processing agreements.

Legal Requirements

We may disclose information when required by law, subpoena, or court order, or when necessary to protect our rights, investigate fraud, or respond to government requests.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change.

4. Cookies and Analytics

We use Google Analytics (GA4) to understand how visitors use our marketing website. Analytics cookies are only set after you accept them through our cookie banner — this applies to all visitors, wherever you are located. Until you make a choice, Google Analytics receives only cookieless, aggregate pings that do not identify you. You can change your choice at any time from the Cookie Policy page.

The Rowie app and vendor dashboard do not use third-party analytics cookies.

5. How Long We Keep Data

We retain your information for as long as your account is active and as needed to provide the Service. After account closure:

• Transaction records are kept for at least 7 years, even after account closure, to meet tax, accounting, and anti-fraud obligations
• Account data is deleted or anonymized within 90 days, unless we are legally required to keep it
• Backup copies may persist in encrypted backups for up to 30 additional days

6. How We Protect Your Data

• All data is encrypted in transit (TLS) and at rest
• Passwords are hashed with BCrypt (never stored in plain text)
• Access to production systems is restricted by role
• Payment data is handled entirely by Stripe (PCI-DSS Level 1 certified)
• We use webhook signature verification to prevent tampering

No system is 100% secure. We take reasonable measures to protect your data but cannot guarantee absolute security.

7. Your Rights

Depending on where you are located, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your data (subject to legal retention obligations)
• Object to or restrict certain processing
• Data portability (receive your data in a structured format)
• Withdraw consent for analytics cookies at any time
• Lodge a complaint with your local data protection supervisory authority if you believe our processing of your data infringes the GDPR (for Rowie, the lead supervisory authority is the Irish Data Protection Commission)

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

8. Your Responsibilities as a Merchant

If you collect customer data through Rowie (e.g., email addresses for receipts, customer names for orders), you are responsible for:

• Maintaining your own privacy policy if required by law
• Obtaining customer consent where applicable
• Complying with data protection laws in your jurisdiction (GDPR, CCPA, etc.)
• Training your staff on data handling best practices

9. Children

Rowie is not intended for use by anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with data, contact us and we will delete it promptly.

10. International Transfers

Service data is hosted on our infrastructure in the European Union. Some of our processors — Stripe, Google, Resend, and Cloudflare — are US companies that may process personal data in the United States. Where personal data is transferred outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where the recipient is certified, the EU-U.S. Data Privacy Framework, together with supplementary safeguards. You can request details of the safeguards that apply to a specific transfer by contacting us.

11. Updates to This Policy

We may revise this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice before they take effect. Continued use of the Service after the effective date constitutes acceptance.

12. Contact

For privacy questions, data requests, or concerns — the data controller is:

ROWIE LIMITED
12 Fairhill Court, Fairhill Road Upper, Galway, H91 K68W, Ireland
[email protected]