Version: romba-privacy-2026-10
Last updated: 10 October 2026.
Your data. Briefly.
We collect only what the service needs to work. No third-party advertising, no data selling, no hidden trackers.
1. Who we are
RomBa is a platform for trusted hand-over of duty-free goods by a faithful courier who is already flying your route. This policy describes which personal data we process, why, and who we share it with.
The data controller is the company that operates RomBa:
Company: ROMBA LLC («ՌՈՄԲԱ» ՍՊԸ)
Legal address: 19 A. Khachatryan St., apt. 33, Arabkir, Yerevan 0033, Armenia
Business address: 19 A. Khachatryan St., apt. 33, Arabkir, Yerevan 0033, Armenia
Registration number: 999.110.1605034
Tax ID (ՀՎՀՀ): 08332163
Privacy contact: [email protected].
2. What data we collect
Account: username, email, phone number and password (stored only as a one-way hash). Couriers also give us their full name, postal address and payout bank details. Payment data: card number, expiry and CVC are entered only on the bank's secure page (Fast Bank, via the ArCa payment system) — the app and our servers never receive the full card number or the CVC. We receive the result: masked card number, cardholder name, expiry date, approval code and transaction reference. Order and payout history stays with us.
Government ID: the text of your passport photo page, including the machine-readable zone, is read on your device from a photo. If the passport has a chip, the app reads it over NFC (ICAO eMRTD): name, document number, nationality, date of birth, sex, expiry date and, where available, the chip photo. Our servers keep your name, document type, this chip data (without the chip photo, which is used only on your device for the face match and is never sent to our servers), the results of the checks, and a SHA-256 hash of the passport (normally of its document number) that links one passport to one device.
Face images (biometric data), only with your explicit consent: the app takes a live selfie and compares it on your phone with the photo from your passport chip or photo page; we receive only the match score. The selfie is deleted from the phone right after the check, the passport photo when you leave the verification screen. An automatic match does not approve an account on its own, so the passport-page photo and the selfie are also sent to us, encrypted, for authorised staff to compare. Face ID or fingerprint confirmation uses your phone's own lock — we only learn whether it succeeded. Profile photo: the selfie from the face check is your profile picture — the only picture of you in the app — if you agree to keep it, and you need it to order or deliver. The other party of your orders sees it from when the courier takes the order until the handover; nobody else sees it, and not after that. A selfie taken later is used at once if you read the chip of the same passport again (same number and name) and the selfie matches your passport photo on your phone; otherwise authorised staff compare it with your passport photo before it is used. It is stored encrypted on our servers.
Behavioural checks: during verification and before an order, the app measures press length, tap rhythm and slight hand tremor (motion sensor) and compares them with a profile kept on your phone. Measurements and profile stay on the phone; only the result (score, pass/fail and, at checkout, tap count and tremor value) is sent to us. The checkout check can be switched off in the app. Location: if you allow it, the app uses your location to show where you are and, for couriers, to confirm they are inside the airport zone (a radius set per airport, up to 50 km). When a courier accepts an order, the coordinates are sent to our servers, which repeat the check and compare them with the previous position.
Boarding pass (couriers): the barcode is read on the phone; a photo of the pass is checked by our AI provider to read the flight details and spot forgeries. We store the barcode content (name, booking reference, route, flight, date, seat), linked to the courier's device and passport, so one pass cannot be used on two phones. User content: photos of goods and receipts taken during an order (OCULAR); the receipt photo is kept with the order. The ultrasonic ECHO signal that proves both phones met is processed on the phones only — no audio reaches us.
Identifiers: a random device_id tied to a hardware-backed key, transaction IDs, a hash of your IP address in consent and verification records. Purchase history: your orders, routes, statuses, tips. Usage & diagnostics: anonymised metrics and crash reports via Apple/Google system services.
3. Why we collect it
To run the service: match you with a faithful courier on your route, place the order and the payment, have the courier buy your goods at the duty-free, complete the OCULAR hand-over.
To keep both sides safe: KYC on both sides, anti-fraud, payment escrow, tamper-proof hand-over log. To comply with law: tax/customs, AML checks, responses to lawful regulator requests. To improve the product: aggregated analytics and crash reports — always on anonymised data.
Legal bases: our contract with you (account, orders, payments, hand-over); legal obligations (identity verification under anti-money-laundering and know-your-customer rules, keeping payment and contract records, tax and customs); legitimate interest in preventing fraud (location, boarding-pass, device and behavioural checks, AI checks of photos); and your explicit consent for face images and the face match, which are biometric data under Armenian law and the GDPR. The app asks for this consent separately before the face step. You can withdraw it by writing to us or deleting your account, but verification — required to use the service — is then not possible.
4. Who we share data with
Fast Bank — card payments and refunds through the ArCa payment system. Fast Bank is an independent controller for payment operations: fastbank.am. Telegram — when you ask for a person in the support chat, the conversation (your messages, any photos or videos you send, the assistant's answers, your username, app language and the screen or order you wrote from) reaches our support team through it, and they answer you in the app. Stripe — only for payments not routed through ArCa: card payments on Stripe's pages and, for couriers, payout accounts and single-use purchase cards; we see only card brand, last four digits and expiry. Apple and Google — system services (crash reports, place names for your location, font downloads). Cloudflare — carries and protects traffic between the app and our servers.
OpenAI — our AI provider. Through our server it receives: photos of goods and receipts, photos you take to search the catalogue, and an order's reference, goods, route and totals. Before order data is sent, everything that identifies a person is removed from it: names, passport data and hash, device identifiers, identity and biometric scores, location, contact and payment data, and the record of your acceptance of the terms. For the boarding-pass check it also receives the courier's boarding-pass photo, with the name and flight details printed on it, and the surname the pass should carry. What you write and the photos you send in the in-app support chat go to it too. Passport photos, selfies and card data are never sent to it. Our staff — authorised staff see identity data when reviewing an account; review photos open only for administrator accounts, and every view is logged. The other party to your order — your passport name appears on the hand-over contract; the customer also sees the courier's display name, photo and flight details. Legal authorities — we will disclose data only on a lawful request and, where permitted, will notify you. We never sell your data to ad networks, data brokers or any third party for marketing profiling.
5. Where and how long we keep it
Where. Our servers are in the Republic of Armenia, and that is where your data is mainly processed and stored. TLS in transit; identity-review photos are also encrypted at rest (AES-256). Fast Bank and ArCa are in Armenia too. These providers outside Armenia receive data: Cloudflare — all traffic between the app and our servers passes through its network; OpenAI — what section 4 lists (photos, order data without identifying fields, the boarding-pass photo and expected surname, support-chat messages); Telegram — a support conversation you hand to a person; Stripe — only for payments not routed through ArCa, the payment and payout data those need; Apple and Google — crash reports, the location your phone turns into a place name, font downloads. These are US companies, so data sent to them may be processed in the United States. We send data abroad only where it is necessary to provide the service or the feature you use, or with your consent where that is the basis. We do not yet have a data processing agreement with OpenAI and are putting agreements in place.
How long. We keep data only as long as the purposes above need or the law obliges us to, under the Law of the Republic of Armenia on Protection of Personal Data and, where it applies, the GDPR:
- Account and profile data (including a courier's contact and payout details): while your account is active; deleted within 30 days after the account is deleted, except the records below that the law requires us to keep. You can delete your account in the app once no order has money in progress.
- Identity verification records (passport data, results of the checks, passport hash): until the account is deleted, then kept for 5 years after the end of our relationship, for anti-money-laundering and fraud-prevention record-keeping.
- Face images uploaded for a manual check (the selfie and the passport-page photo): deleted when the check is decided, and within 48 hours at the latest.
- Profile photo (verified selfie): until you delete your account or take a new one, which replaces it.
- Orders, payments, receipts, hand-over records (including the signed contract) and Terms of Sale acceptance: 5 years after the order, for accounting and tax obligations and to handle disputes and chargebacks. Abandoned unpaid orders are deleted after about 30 minutes; OCULAR goods photos are not kept after the check.
- Boarding-pass data: 90 days after the flight.
- Location: the position used for the airport check is deleted after 12 hours; a location attached to an order acceptance is deleted 90 days after the order.
- Support conversations: 1 year after the last message.
- Technical logs: 12 months.
- Backups: rotated, each backup deleted after 30 days, so deleted data leaves them too.
6. Your rights
If you're in the EU/UK/Switzerland, you have GDPR rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent. If you're in California, you have CCPA/CPRA rights: know, delete, correct, non-discrimination. We don't sell or share your data for targeted advertising — see our privacy choices page.
To exercise any of these rights, email [email protected]; you can also delete your account yourself in the app, under Profile. Most requests are answered within 30 days. If you're not satisfied, you have the right to lodge a complaint with your country's data-protection authority.
7. How we keep your data safe
Payment escrow: the customer's money sits in Fast Bank until the hand-over is signed; the faithful never has access to the customer's balance. Your card stays with the bank: neither the courier nor the app ever sees your card details.
OCULAR ultrasonic hand-over: proof of meeting is a physical ultrasonic signal — remote scams are mathematically impossible. KYC on both sides: passport (NFC or OCR), live face match, Face ID, behavioural checks; the face comparison runs on your phone. Hardware-backed keys live in Secure Enclave / StrongBox.
8. Age, changes, contact
The service is for users aged 18+ — the catalog includes alcohol and tobacco. We don't knowingly collect children's data; if any reaches us, tell us and we'll delete it within 7 days.
Material changes are announced inside the app at least 30 days before they take effect. The last-updated date is at the top of this page. Continued use after a change means you agree to the new version.
This policy is available in every language of the app. If the language versions differ, the Armenian version prevails.
Privacy questions?
Drop us a note — we answer within 5 business days. For urgent data requests, tag your email \[URGENT\].