Business Privacy Policy

This Business Privacy Policy applies to Roam Atlas Business accounts for dealers, operators, manufacturers, and other RV and powersports businesses: claimed profiles, business analytics, Beacon, visitor analytics, identity enrichment, Google and other integrations, CRM/marketing connections, leads and inquiries, and business user accounts.

Consumer use of Roam Atlas discovery features is covered by the Consumer Privacy Policy.

We do not sell personal information. We do not use your Google user data or private business workspace data to build advertising profiles. Roam Atlas does not use data obtained through Google Workspace APIs or other Google APIs to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models.

Business account information

Business names, contacts, team members and roles, locations, account administration, billing and subscription data, and support communications.

Business profiles and inventory

Claimed and public profiles, verification information, uploaded images and video, listing content, and inventory you publish or connect.

Leads and inquiries

Consumer inquiries and lead records delivered to your organization throughRoam Atlas, including contact details and message content the consumer submitted.

When you install Beacon on a site you control, we may process first-party events such as page views, sessions, referrer, UTM parameters, paths, CTA interactions, scroll depth, form start, form submission events (that a form was used, not field contents), conversion events, consent state, anonymous identifiers, and device/network metadata.

Beacon is not designed to collect passwords, payment card data, sensitive free-text fields, or authentication secrets. You are responsible for your privacy notice, consent tools, and lawful basis toward your site visitors.

Optional enrichment services may process Beacon and related signals:

• Network / location enrichment: approximate city/region/country and network-style attributes from an IP address
• Company enrichment: firmographic attributes associated with an IP or visit when enabled and consent rules allow
• Person-level identity enrichment: matched person-level attributes returned by an identity enrichment provider when you explicitly enable it and applicable law (including required consent or other lawful basis) permits

Person-level enrichment is off by default until you enable it and complete any required in-product acknowledgement. You are responsible for how you use enriched information after we provide it.

When you connect Google Analytics, Search Console, Ads, YouTube, email marketing platforms, social publishing tools, CRM, DMS, webhooks, or other authorized integrations, we process the data those connections provide under your instruction. Disconnecting stops future sync.

Roam Atlas's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What Google user data we access

When an authorized business user connects Google, we may access only the scopes that person approves. Depending on the connection, that Google user data may include:

• Search Console (webmasters.readonly): queries, impressions, clicks, average position, and landing pages for properties the user authorizes
• Google Analytics 4 (analytics.readonly): aggregated traffic metrics (for example sessions, page views, landing pages, and basic audience dimensions) for properties the user selects
• Google Ads (adwords): campaign delivery metrics such as impressions, clicks, spend, and conversion totals
• YouTube (youtube.readonly, yt-analytics.readonly): channel and video metadata and performance reports for channels the user owns
• Sign in with Google: name, email address, and profile photo used only to authenticate the user and populate their Roam Atlas account

How we use Google user data

We use Google user data only to:

• Authenticate the connecting user and associate the Google connection with their Roam Atlas Business organization
• Display Search Console, Analytics, Ads, and YouTube metrics inside the organization's Roam Atlas Business workspace (for example Marketing, Visitors, Inventory, and Connections) so dealers can compare owned Google evidence with Roam Atlas market and inventory signals
• Refresh and store sync snapshots needed to show those user-facing reports while the connection remains authorized
• Provide support, security, abuse investigation, and legal compliance related to the connection

We do not use Google user data for advertising, selling data, determining credit-worthiness, or lending. Roam Atlas does not use data obtained through Google Workspace APIs or other Google APIs to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models. We do not use Google user data for any purpose other than providing or improving the Roam Atlas Business features described above.

With whom we share, transfer, or disclose Google user data

We share, transfer, or disclose Google user data only as follows:

• Authorized members of your organization: users with access to your Roam Atlas Business workspace may see Google-connected reports for that organization
• Infrastructure service providers (processors): cloud hosting/CDN and database, authentication, and storage providers that process data on our behalf under contract solely to operate Roam Atlas (categories listed at https://roamatlas.org/data). These providers may receive Google user data only as needed to host, store, and deliver the product
• Legal and security: when required by applicable law, or as needed to investigate abuse, protect rights and safety, or enforce our terms
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to continued protections and notice where required

We do not sell Google user data. We do not transfer or disclose Google user data to third parties for purposes other than those listed above. In particular, we do not transfer Google user data to advertising platforms, data brokers, information resellers, identity enrichment providers, or unrelated third parties, and we do not use or transfer it for serving ads (including retargeting, personalized, or interest-based advertising).

Limited Use boundaries: Google API data (and data derived from it) is not combined into enrichment profiles. Generative AI features do not receive Google API data unless a specific product feature clearly discloses that use and is configured to comply with Google's Limited Use requirements. Non-Google market and inventory signals remain separate from Google-sourced evidence unless a disclosed feature expressly combines them under those rules.

Storage, retention, and deletion

OAuth credentials and synced Google user data are stored securely, scoped to your organization, and retained while the connection is active. After disconnect or account deletion, we delete Google connection credentials and associated synced Google user data within 30 days, except where law requires longer retention or data remains in short-lived backups. You may revoke access at any time in Roam Atlas Connections or at myaccount.google.com/permissions.

Optional generative features send only the prompt content needed for that job to contracted AI providers. Outputs may be inaccurate; verify before relying on them for business decisions. Retention by a model provider, if any, is governed by our contract with that provider. Google API data is excluded from AI prompts unless a specific feature discloses that use and is configured consistently with Google's Limited Use requirements (see Section 7).

Roam Atlas maintains a current list of material subprocessors used to process customer personal data, published by category at https://roamatlas.org/data. A named list is available to customers on request for DPIAs and DPAs.

• Account and membership: while the account is active
• After closure: export window of at least 30 days, then deletion on our schedule except legal holds and rolling backups
• Beacon and lead data: while your relationship is active, then per agreement and deletion requests
• Connected integration data: until disconnect or deletion, then within 30 days
• Invoices / tax: as required by law (often 7-10 years)

Roam Atlas is operated from the United States. Some providers may process data elsewhere. For EEA/UK/Swiss transfers we rely on Standard Contractual Clauses or an adequacy mechanism such as the EU-US Data Privacy Framework where applicable. Contact privacy@rvatlas.org for residency questions.

We protect Google user data using encryption in transit, restricted production access, organization-scoped access controls, and secure storage of OAuth credentials and tokens. Access to Google user data is limited to personnel and service providers who require access to operate, secure, or support the applicable Roam Atlas Business features. No system is perfectly secure; we will notify affected customers of qualifying incidents without unnecessary delay.

Business users and, where Roam Atlas is controller, individuals may request access, correction, deletion, export, and other rights under applicable law. Where you are controller for Beacon or lead data, we will assist with data subject requests as described in the Business Terms (and any executed DPA). Email privacy@rvatlas.org.

We post updates here and revise the version. Material changes to processing of Customer Personal Data may be notified by email where required.

privacy@rvatlas.org
Roam Atlas Business · https://roamatlas.org/business/privacy