Privacy Policy

This Privacy Policy explains how Rouchat Inc ("Rou", "we", "us") collects, uses, and protects information when you use the Rou browser extension and the website at rouchat.com (together, the "Service"). Rou is an AI co-pilot and relationship CRM that runs inside WhatsApp Web as a Chrome or Chromium browser extension. Your account and billing are managed on rouchat.com.

Rou is built privacy-first. Your WhatsApp contacts, relationship and CRM data, and conversation memory stay on your device, in your browser. Rou runs inside your own WhatsApp Web session and never asks for your WhatsApp password or login.

1. Information we collect

We collect only what we need to provide and bill the Service:

• Account information. When you create an account on rouchat.com you sign in by email magic-link or Google OAuth (handled through our backend provider). We receive your email address and, for Google sign-in, your basic profile (name, profile picture, Google account ID).
• Billing information. Payments are processed by Stripe. Stripe collects and stores your payment details directly. We do not store full card numbers. We receive limited information from Stripe such as your plan, billing status, the last four digits of your card, country, and invoice history.
• Device pairing. The extension links to your account using device pairing tokens. We store the pairing token, an extension/device identifier, and basic client metadata (browser, extension version) so the right extension is associated with the right account.
• Content-free AI usage records. When you use AI features we record that an action happened and how many credits it consumed (for example: a draft was generated, X credits used, at a given timestamp). These records are content-free: we do not store the content of your messages, the prompts you send, or the AI responses you receive.
• Optional Google Calendar. If you choose to connect Google Calendar, we use OAuth tokens scoped to the calendar features you enable. We use this data only to power the calendar features you ask for and never to advertise to you or train AI models.
• Minimal, privacy-preserving analytics. We collect a small amount of essential product telemetry (for example: feature reached, error encountered, app version) to keep the Service reliable. We do not use third-party advertising trackers.

2. What we explicitly do NOT collect

• We do not collect or store the content of your WhatsApp messages, your AI prompts, or the AI responses generated for you.
• We do not collect or receive your WhatsApp password, phone number verification code, or WhatsApp login session. Rou runs inside your own WhatsApp Web tab in your browser.
• We do not sell your personal data, and we do not share it with advertisers.

3. How we use information

We use the information above to:

• Create and authenticate your account, and link your extension to it.
• Process subscriptions, free trials, top-ups, invoices, and tax through Stripe.
• Meter AI usage so we can apply your plan's credits and prevent abuse.
• Operate, maintain, debug, and improve the Service.
• Send you essential service messages (sign-in links, billing receipts, security or policy notices).
• Comply with legal obligations and enforce our Terms of Service.

4. AI processing

To generate drafts, translations, summaries, and other AI features, the necessary context for that single request is sent to our AI provider, Anthropic, which returns a response that is shown back to you in the extension. Anthropic processes this content only to fulfill the request.

We do not use your data to train AI models. Message content and AI responses are not retained by Rou. We keep only the content-free usage record described above (that an action happened and how many credits it used).

5. Data stored on your device (local-first)

Rou is local-first. Your WhatsApp contacts, your relationship and CRM notes, tags, reminders, and Rou's conversation memory live on your device in your browser's extension storage. This data is not uploaded to our servers as part of normal use. If you uninstall the extension or clear your browser storage, that local data is removed. We recommend exporting anything you want to keep before doing so.

6. Sub-processors and third parties

We rely on a short list of trusted providers:

• Stripe - payment processing, subscriptions, invoices, and tax.
• Supabase - our cloud backend, authentication, and database.
• Anthropic - AI processing for drafts, summaries, and related features.
• Google - sign-in (Google OAuth) and, if you connect it, Google Calendar.

Each provider processes data on our behalf under their own security and privacy terms, and only for the purposes described in this policy.

7. Data retention

We keep account information for as long as your account is active. We keep billing records for as long as required by tax and accounting law (typically several years). We keep content-free AI usage records for as long as needed to apply your plan's credits, detect abuse, and meet our legal obligations. When you delete your account, we delete or anonymize personal data that we are not legally required to retain, within a reasonable period.

8. Your rights

You can access, correct, export, or delete your personal data. You can also object to or restrict certain processing, and withdraw consent where processing is based on consent. To exercise any of these rights, email rou@rouchat.com from your account email.

EEA and UK (GDPR). If you are in the European Economic Area or the United Kingdom, you have the rights above under the GDPR / UK GDPR, and you have the right to lodge a complaint with your local data protection authority.

California (CCPA/CPRA). If you are a California resident, you have the right to know what personal information we collect, to request deletion or correction, to opt out of "sale" or "sharing" of personal information (we do not sell or share your personal information as those terms are defined under the CCPA/CPRA), and to not be discriminated against for exercising your rights.

9. Cookies

We use only essential cookies and similar storage needed to keep you signed in and to operate the Service. We do not use advertising or cross-site tracking cookies.

10. Security

We use industry-standard safeguards including encryption in transit (HTTPS/TLS), access controls, and limited employee access on a need-to-know basis. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Please use a strong, unique password and keep your sign-in email secure.

11. Children

Rou is not directed to, and we do not knowingly collect personal information from, anyone under 16. If you believe a child has provided us personal information, please contact us and we will delete it.

12. International transfers

Rouchat Inc is based in the United States and our providers operate globally. When you use the Service, your information may be processed in the United States and other countries that may have different data protection laws than your own. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

13. WhatsApp / Meta disclaimer

Rou is an independent product and is not affiliated with, endorsed by, or sponsored by WhatsApp LLC or Meta Platforms, Inc. "WhatsApp" is a trademark of its respective owner.

14. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or in-product before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

15. Contact

Rouchat Inc, a Delaware corporation. For privacy questions or to exercise your rights, email rou@rouchat.com.