privacy policy

last updated: 19 october 2026 · covers the website, web app, installable mobile webapp and api

1. who we are

roloboop is a product of boopcat ltd, registered in England & Wales (company no. 16923037), at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are the controller of personal data used to manage your account, billing, support and our website. For the contact information you manage for your own purposes, we act as your processor, as explained in section 4.

Questions, privacy requests or complaints: manny@boopcat.co. Our UK data protection registration reference is ZC077244.

2. what we collect, and where it comes from

• Account and subscription data — your name, email address, password hash, company or business context you provide, account preferences, trial status and Stripe customer, subscription and payment records. Stripe handles payment details; we do not receive your full payment-card number.
• Contacts and card scans — card images you upload and contact details you enter, capture or extract: names, job titles, employers, email addresses, phone numbers, business addresses, websites and LinkedIn or other profile links.
• Relationship context — tags, where and when you met, notes, interaction history, relationship or stage information and changes you record. These may contain personal information about your contacts or other people you mention.
• Follow-up information — next steps, reminder dates and times, time-zone settings, notes and completion or outreach activity you record. Where a reminder feature is enabled for your account, we also process the status and history needed to show or deliver it.
• Connected services — HubSpot authorisation tokens, connection status, selected contact fields and sync results when you enable the integration. We do not store your HubSpot password.
• Technical and support data — device and browser information, IP addresses, request and security logs, scan counts, errors, session and device identifiers, service activity and the information you send us when asking for help.
• Optional research and AI inputs — see section 5. External contact enrichment is coming soon; a limited pilot may be available separately.
• Marketing preferences and cookies — subscription and consent records if you opt in to updates, and the storage described in our cookie policy.

You provide most information directly or through the services you choose to connect. Scanned information comes from the card you supply. If optional research is enabled and you request it, additional professional details may come from publicly accessible sources. Avoid adding sensitive personal information that is unnecessary for professional networking. Account details are needed to provide an account; billing details are needed for paid access. Optional notes, links and integrations are your choice.

3. why we use it

• Account and service delivery — to authenticate you, manage your trial or subscription, capture and organise contacts, show follow-up information, export contacts, run integrations you enable and provide support. For your account data, our lawful basis is contract. Customer contact data is processed on your instructions under section 4.
• Billing and records — to collect payments, manage renewals and cancellations, and maintain required financial records: contract and legal obligation.
• Security and reliability — to prevent fraud and abuse, diagnose errors and improve how the service works: our legitimate interests in protecting customers and running a reliable product. We balance those interests against people’s rights.
• Account and service messages — to send verification, password reset, billing, security and material service notices: contract, legal obligation or our legitimate interests, depending on the message.
• Optional marketing and analytics — marketing updates you request and any optional analytics cookies use your consent. You can unsubscribe or change your cookie choice at any time.

4. your contacts, linkedin and email

You decide which contacts to add and how to follow up. For personal data you manage as a customer, you are the controller and boopcat ltd is your processor. We use it on your instructions to capture, store, organise, display, research where requested, export and sync it. You are responsible for an appropriate lawful basis, any required privacy information and respecting correction, deletion and marketing preferences. Exchanging a business card or receiving an introduction does not, by itself, authorise every kind of marketing.

LinkedIn integration means saved profile links. Saving or opening a LinkedIn URL does not connect your LinkedIn account, import its address book or synchronise messages. LinkedIn processes visits to its service under its own terms and privacy policy.

Email integration opens your usual email app. roloboop does not read your inbox or automatically send follow-up emails. Where an editable follow-up message template is available, it is prepared locally from contact context; that draft flow does not upload or save the message body to our servers. Opening it passes the recipient, subject and body to your email app. Your email provider handles any message you choose to send. An email you send separately, or a contact copied to your CRM or exported as CSV, is outside roloboop’s deletion controls.

You can edit or delete saved contacts and export the contact fields supported by CSV. For a fuller personal-data request, account closure or help when app access is unavailable, contact manny@boopcat.co. A data processing addendum is available on request; this notice does not replace that agreement.

5. card reading, ai and enrichment

Card scanning sends the card image to the configured AI extraction provider to return editable contact details. Supported providers include OpenAI, Google Gemini and Anthropic. Optional AI relationship-workflow generation sends the name, business context and description you supply to OpenAI to return a draft for you to review, edit and explicitly save.

External contact enrichment is coming soon. If it is separately enabled for your account and you request research, the current research feature sends public professional identity details — name, employer, role, website and LinkedIn links — plus the requested missing fields to OpenAI. It searches public professional sources and may retrieve public web pages or documents. Source information and proposed details are processed to produce suggestions, evidence and confidence labels for you to review. Existing saved email addresses, phone numbers, private business context, interests, internal notes and card images are excluded from this ordinary contact-research input.

A separate controlled research pilot also uses OpenAI. Its review and processing context can include the contact fields you supply, including email or phone, identity corrections and earlier research. Public search queries use professional names or profiles, employer, role and the requested detail; supplied email addresses, phone numbers, private business context, interests and correction notes are excluded from those queries. Private business context and interests are not retained or used for the pilot’s contact-detail research. The pilot is not generally available. Viewing a contact alone does not request research.

AI output, confidence labels and public sources can be incomplete, outdated or matched to the wrong person. They are suggestions, not verification. You remain in control of follow-up decisions. These features assist contact management rather than make decisions with legal or similarly significant effects about people. General availability or materially different data uses or providers will be explained before that processing begins.

6. who receives data

We do not sell or rent personal data or share it for cross-context behavioural advertising. Information is disclosed as needed to deliver the service:

• Infrastructure — DigitalOcean for the app runtime, Neon for the database and Cloudflare for this website, network services and private card-image storage.
• Website resources — Google Fonts and unpkg deliver fonts and JavaScript to your browser. Those requests include technical information such as your IP address and browser request details.
• AI services — OpenAI for the supported relationship-workflow and optional research features, and OpenAI, Google Gemini or Anthropic for card reading, depending on the configured extraction provider.
• Payments and service email — Stripe for billing and Microsoft 365 / Microsoft Graph for transactional email.
• Your chosen services — HubSpot when connected, and your email client or LinkedIn when you open their links. Those services also have their own privacy terms.
• Other necessary disclosures — professional advisers, authorities where legally required, or a buyer or successor if the business is sold or merged, with the same protections and advance notice to you.

We require providers acting as our processors to protect personal data and use it for the agreed service, under appropriate data processing terms. Contact us for information about the providers relevant to your account.

7. international transfers

Our providers may process information outside the UK or EEA, including in the United States. This means some data may be processed outside the UK. Where transfer rules require it, we require an applicable adequacy decision or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or Addendum and EU Standard Contractual Clauses, with additional measures where needed.

You can ask manny@boopcat.co about the locations and transfer safeguards applicable to your data, including how to obtain a copy of relevant safeguards.

8. retention and deletion

We retain the following commitments. Cleanup may be carried out through automated processes or by our team:

• Unused scan images — removed within 24 hours. A short-lived scan link or token may expire sooner; token expiry is separate from deletion of the image.
• Saved contacts and card images — retained while your account exists unless you delete them or request erasure. After you delete a contact, its record, associated context and card image are removed from our systems within 30 days.
• Closed accounts — account and associated contact data are deleted within 90 days of closure. Request closure by email. Cancelling renewal alone does not close your account or request deletion.
• Financial records — relevant billing and tax records are retained for six years to meet legal obligations.
• Operational and support records — retained only as needed for the issue, security, legal obligations or resolving a dispute. Account-associated records are subject to the closure commitment, except information we must retain by law.
• Marketing — retained until you unsubscribe; a minimal suppression record may be kept so we can respect your opt-out.

Email manny@boopcat.co for help with erasure, including a saved image or closed account. Deletion in roloboop does not remove copies already exported, emailed or synced to another service; manage those copies separately.

For instructions you can use without logging in, see request account deletion.

9. security

We use account authentication and tenant-scoped access controls, hash passwords, encrypt integration tokens, and keep saved card images in private storage accessed through short-lived signed links. Production database connections use TLS. Access is limited to what is needed to operate and support the service.

No system can guarantee absolute security. If a personal-data breach occurs, we will investigate and notify affected customers and the relevant regulator as required by law, including notifying the UK regulator within 72 hours where that duty applies.

10. your uk and eu rights, and complaints

Depending on the processing, you can ask to access, correct or erase your personal data, restrict or object to its use, or receive a portable copy. You can withdraw consent without affecting earlier lawful processing. We will stop direct marketing if you object. Where we process a contact’s data for a customer, we help the customer deal with the request.

Email manny@boopcat.co. We respond to rights requests within one month, normally free of charge. If the law permits an extension or exception, we will explain it. We may ask for proportionate information to verify your identity.

You can also make a data protection complaint to manny@boopcat.co. We will acknowledge it within 30 days, investigate without undue delay, keep you informed and explain the outcome. You may complain to the UK Information Commission (ICO) or your local EU supervisory authority.

11. your california privacy rights (ccpa/cpra)

California residents can request to know, access, correct or delete personal information, opt out of sale or sharing, limit uses of sensitive personal information where applicable, and exercise their rights without discrimination.

We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and have not done so in the preceding 12 months. The categories described in section 2 include identifiers, account credentials, commercial information, internet or service activity, professional information, card images and information you record in notes. Sources, purposes, recipients and retention are described above. We do not use sensitive personal information to infer characteristics about you.

Email manny@boopcat.co with “California request” in the subject. An authorised agent may act for you; we will take reasonable steps to verify identity and authority. We acknowledge applicable requests within 10 business days and respond within 45 days, explaining any extension allowed by law.

12. other us states

Residents of states with applicable privacy laws can exercise rights of access, correction, deletion, portability and opt-out of targeted advertising or sales. We do not sell personal data or use it for targeted advertising. Contact manny@boopcat.co; if we decline a request, you may appeal by replying to the decision. Applicable legal exceptions and response deadlines will be explained.

13. children and cookies

roloboop is a professional networking tool and is not intended for anyone under 16. Do not knowingly add children’s data. Tell us if you believe we hold it inappropriately so we can investigate and delete it where required.

Essential storage supports site and account functions. Optional analytics cookies require your consent. See the cookie policy and the cookie settings link below.

14. changes to this policy

This update describes roloboop’s current contact and follow-up features and corrects service-provider information. It retains the existing retention commitments. For material changes we will email account holders and post a notice here at least 14 days before they take effect. Publishing an updated description does not authorise a new use of your data without any notice or consent required by law.

15. contact

boopcat ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom · manny@boopcat.co