Privacy Policy for Ruma

Last updated: 3 July 2026

Ruma (the "App") is a property and booking management tool that lets accommodation operators manage rooms, bookings, guests and invoices. This Privacy Policy explains what information the App collects, how it is used, and the choices you have. By using the App you agree to the practices described here.

Who we are

The App is operated by AInject ("we", "us"). For any privacy question or request, contact us at boris@ainject.com.

Information we collect

Ruma is a business tool used by account holders to run their accommodation business. We collect:

• Account information — your name, email address and password. Passwords are transmitted securely and stored only in hashed form on our servers; we never store them in plain text.
• Business records you enter — rooms, availability, bookings and invoices, including their prices, taxes and payment status.
• Guest details you enter — the name, and (where you choose to provide them) the email address and phone number of guests you create bookings or invoices for. You are responsible for having a lawful basis to enter this information about your guests.

We do not collect your location, we do not use advertising or tracking technologies, and we do not use third-party analytics SDKs.

Information stored on your device

After you sign in, an authentication token and your theme preference are stored in your device's encrypted secure storage (iOS Keychain / Android Keystore). This data stays on your device and is removed when you sign out.

How we use information

• To authenticate you and keep you signed in.
• To provide the core features of the App — managing rooms, bookings, guests and invoices.
• To secure the service and troubleshoot problems.

We do not sell your data, and we do not use it for advertising.

How information is stored and transmitted

All communication between the App and our servers is encrypted in transit using HTTPS (TLS). Data is hosted on our backend infrastructure provider (Railway), which processes data on our behalf under its own security and privacy commitments.

Sharing

We do not share your personal information with third parties for their own use. We use service providers (such as our hosting provider) strictly to operate the App on our behalf.

Data retention and deletion

We retain your account and business records for as long as your account is active. You can request deletion of your account and associated personal data at any time by emailing boris@ainject.com. We will action verified requests within 30 days, subject to any legal record-keeping obligations.

Children

The App is a business tool and is not directed to children under 16, and we do not knowingly collect personal information from children.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, export or delete your personal data. To exercise these rights, contact boris@ainject.com.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page.

Contact

AInject — boris@ainject.com