Privacy Policy

Roseiies (“Roseiies”, “we”, “our”) builds a modular operations platform for hospitality properties, gardens, kitchens, dining rooms, cellars, cafés, and rooms, that share one workspace. This Privacy Policy explains what personal data we collect when you visit roseiies.com, sign in to the Studio app, or interact with a public surface a workplace has chosen to publish, why we collect it, and the choices you have.

1. Who we are

Roseiies is operated by Roseiies LLC, a company organized in the United States. Our product team is based in Mexico. Roseiies LLC runs the marketing site at roseiies.com, the Studio app used by workplaces and their teams, and the booking and guest pages workplaces publish, such as reserve.roseiies.com. Olivea is the founding beta workplace; additional workplaces are onboarded as we open access. If you have any question about this policy, write to us at hello@roseiies.com.

Who controls your data. For Roseiies accounts, access requests and visits to roseiies.com, Roseiies LLC is the controller. For the data a workplace puts into Roseiies (its team, its guests, and the messages guests send it), the workplace is the controller, and Roseiies LLC processes that data on the workplace’s behalf and on its instructions.

2. What we collect

2.1 Information you give us

• Access requests. When you request access on roseiies.com we collect your name, email address, and (optionally) your company.
• Account information. When you sign in to Studio, we receive your name, email, and the role your workplace owner assigned to you.
• Operational workspace data. Anything you or your team enter into the apps your workplace has enabled, for example garden plantings and water schedules, kitchen prep events, wine cellar inventory, property-map zones, room and suite data, tasks, schedules, attendance, payroll, and inventory entries. Some apps handle employee data; for those, your workplace owner is the data controller and we process the data on their behalf.
• Faces, ID photos and vehicles. A workplace that uses the Attendance app can keep a photo each time a team member checks in at a face-recognition terminal; the terminal recognises people from their profile photo. A workplace that uses the Security app can photograph a visitor or their ID (such as an INE), and a vehicle and its licence plate, at the gate. Face data used for recognition is sensitive personal data in many countries, including Mexico, so the workplace is responsible for telling the people involved and, where the law requires it, getting their written consent.
• Branding assets. Logos and other files your workplace owner uploads through Studio (stored as workspace settings).
• Communications. If you email us we’ll keep a record of that conversation so we can follow up.

2.2 Information collected automatically

• Usage & technical data. Like most web services, we receive standard request data (IP address, user agent, requested URL, timestamps) when you visit our pages. We use this for security, debugging, and aggregate traffic analysis.
• Cookies. We use strictly-necessary cookies: a session cookie issued by our authentication provider (Supabase) so you stay signed in. On reserve.roseiies.com we also set one analytics cookie. It holds a random code and nothing else: no name, email or IP address. It lets the business whose page you're viewing see how many people visit, how many come back, and where visitors came from. It is only read on reserve.roseiies.com, it is never shared with advertisers or used to follow you to other websites, and it expires after 13 months. If your browser sends a “Global Privacy Control” or “Do Not Track” signal, we don't set it at all. We use no advertising or cross-site tracking cookies.
• Privacy-friendly analytics. On roseiies.com we use Vercel Web Analytics and Speed Insights to measure aggregate traffic and page performance. These are cookieless: they set no cookies, do not track you across other websites, and do not store your IP address or build a profile of you. Visit counts on reserve.roseiies.com are kept in our own database for 13 months and shown only to the business that owns the page.
• Demo sessions. If you sign in to the demo flow on roseiies.com, we issue a short-lived guest token tied to a sample workplace so you can explore the product. The token carries no personal data beyond the email you submitted.

2.3 Guests who message a workplace

Workplaces can connect WhatsApp, Instagram, Facebook Messenger and a chat on their own website to Roseiies, so their team can read and answer guests in one inbox. When you message a workplace through one of these channels, we receive and store, on that workplace’s behalf:

• your name, profile photo, and handle or phone number, as the messaging platform shares them;
• the messages you send and the replies the workplace sends, including photos, files and other attachments;
• the time of each message and whether it was delivered or read.

When a workplace connects a WhatsApp Business app number it already uses on a phone, WhatsApp may also share up to about six months of that number’s past one-to-one chats and its contact names, so the inbox starts with the existing history. Group chats are not shared.

Messages sent through WhatsApp, Instagram and Messenger also pass through Meta Platforms, Inc., which handles them under its own terms and privacy policy.

The workplace decides what happens to these conversations. By default, message content is deleted automatically 90 days after it was sent; a workplace can choose a shorter or longer period, or keep messages until it deletes them. See Deleting your data to ask for your messages to be deleted.

3. How we use your data

• To operate, maintain, and improve the Roseiies product.
• To communicate with you about your account, your access request, and product updates you’ve opted into.
• To debug issues, prevent abuse, and protect the security of our service.
• To comply with our legal obligations.

We do not sell your personal data, and we do not use one workplace’s operational data to train models that serve other workplaces.

3.1 AI features (eiiɘ)

Roseiies includes an AI assistant we call eiiɘ. Inside Studio, eiiɘ can summarize what’s happening across your workplace, surface tasks, and answer questions, always scoped to the data your role can already see. We send the prompts and the relevant data context to a large-language-model provider under contract to generate the response, then return it to you. Your workspace data is used to serve you within your workspace; it is not used to train shared models, sold to third parties, or shown to other workplaces.

4. Who we share data with

We rely on a small set of trusted third-party providers (“subprocessors”) to run the service:

• Supabase, primary database, authentication, file storage, and realtime sync. All operational data is stored here under row-level security so a workplace member can only read or write what their role permits.
• Vercel, hosts the marketing site and Studio app, serves them from edge locations near you, runs the serverless functions behind our APIs, and provides the cookieless Web Analytics and Speed Insights described above.
• Meta Platforms, Inc. (WhatsApp, Instagram and Messenger), delivers messages between guests and the workplaces that connect those channels to Roseiies.
• Anthropic, runs the AI model behind the eiiɘ assistant and AI-drafted replies. Your prompt and the relevant workspace context are sent for each response. Anthropic does not use data sent through its commercial API to train its models.
• Google, reads photos of wine labels and seed packets you choose to scan (Gemini), helps look up addresses (Places), and adds passes to Google Wallet when a guest asks for one.
• Apple, updates passes a guest has added to Apple Wallet.
• Resend, sends transactional email such as access-request confirmations and account-related notifications.
• Inngest, runs our background jobs, such as sending emails and notifications and syncing attendance devices. A job can carry the names and contact details it needs.
• Cloudflare (Turnstile), checks that a booking or form is sent by a person and not a bot.
• Payment processors a workplace chooses (Stripe, Conekta or Mercado Pago), take payments for bookings, tickets and plans. Card details are handled by the processor.
• Railway, runs the service that reads license plates from vehicle photos for workplaces that use the Security app.

Map and weather services receive a location, not personal data about you.

We may also disclose data if required by law, to enforce our Terms, or to protect our rights, property, or the safety of our users.

4.1 Requests from governments

As of the date at the top of this page, Roseiies LLC has never received a request from a government or law-enforcement authority, including a national-security request, for the data of any user, guest or workplace. If we receive one, we will require valid legal process, disclose only what the law requires, and notify the affected workplace unless the law prohibits it. We may challenge a request we believe is unlawful or overbroad.

4a. Public surfaces a workplace can choose to publish

Workplace owners can choose to make some surfaces of their workspace public, for example a live garden map at /r/{workplace}/{slug}/live or a snapshot at /view/{viewId}. Anything published this way is intentionally accessible at the public URL the workplace shares, and may be embedded by third parties. If you’re a workplace owner, only publish data you’re comfortable making public.

5. Where data is stored & transferred

Roseiies LLC is a United States company. Our database, file storage and sign-in (Supabase) are hosted in the United States, in the Oregon region. Our website and app run on Vercel, which serves pages from locations close to you and runs its server functions in the United States. Some providers listed above may process data in other countries.

If you use Roseiies from Mexico or any other country, your data is transferred to and stored in the United States. That transfer is necessary to provide the service a workplace has chosen, and we only work with providers that are bound to protect the data they handle for us.

6. How we protect data

• All traffic to roseiies.com and Studio is encrypted in transit (HTTPS / TLS).
• Data at rest in Supabase is encrypted by the provider.
• Workplace data is partitioned by row-level security and per-app permissions, so members only see what their role allows.
• We follow the principle of least privilege internally: only people who need access to support a feature have it.

No system is perfectly secure. If we ever discover a breach that affects you, we’ll notify you promptly and follow the legal requirements that apply.

7. How long we keep data

• Access request data is kept until you ask us to delete it or for a reasonable period after public launch.
• Account & workspace data is kept while your workspace is active. When a workspace is closed, its data is deleted (or de-identified for aggregate analytics) within a reasonable window.
• Guest messages are deleted automatically 90 days after they were sent, unless the workplace chose a different period or chose to keep them.
• Check-in photos from attendance terminals are deleted automatically 90 days after they were taken. A team member’s enrolled face is removed from the workplace’s terminals when they leave.
• Visitor, ID and vehicle photos taken at the gate are deleted automatically 30 days after the visit, unless the workplace saved them to a regular supplier’s profile. The record of the visit (name, time and plate number) stays as the workplace’s security log.
• Records that a workplace accepted WhatsApp’s terms are kept for as long as they may be needed to show that acceptance, including after the account that accepted is deleted.
• Server logs are kept for a short window for debugging and abuse prevention.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to or restrict certain uses. If you are in Mexico, these include your ARCO rights (access, rectification, cancellation and opposition) and the right to withdraw your consent. To exercise any of these rights, email us at hello@roseiies.com. We’ll respond within a reasonable time and, where we’re required to, within the timeframes set out by applicable law.

You also have the right to lodge a complaint with your local data protection authority.

8a. Deleting your data

• Team members. Ask your workplace owner to remove you, or email hello@roseiies.com from the address on your account to delete your account.
• Workplace owners. To stop receiving messages from a channel, open Settings → Connections in Studio and disconnect it; this takes effect at once. Conversations already received stay until your message retention period deletes them or you delete them. To remove Roseiies’ access in Meta, go to your Facebook settings, open Business Integrations, and remove Roseiies. To close your workplace and delete its data, email us.
• Guests who messaged a workplace. Contact the workplace you wrote to, or email hello@roseiies.com with the workplace’s name, the channel you used (WhatsApp, Instagram, Messenger or web chat), and your phone number or handle. We will confirm the request with the workplace, delete your messages and contact details within 30 days, and tell you when it is done.

9. Children

Roseiies is not intended for children under 16, and we do not knowingly collect personal data from anyone under that age. If you believe a child has provided us with personal data, please contact us and we’ll delete it.

10. Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent change. If we make a material change we’ll let you know, for account holders, by email or by a notice in Studio.

11. Contact us

Questions, requests, or concerns? Write to hello@roseiies.com.