Data Practices

ROME works from the exports your point-of-sale already produces — sales/orders, order items, menu & costs, and labor shifts. They land in a Bronze layer exactly as received (validated row by row, with rejected rows counted and reported, never silently dropped), are refined into Silver (cleaned, typed, reconciled facts), and finally into Gold — the audit findings, forecasts, and action plans you see. Because each layer builds on the one below, every figure on a ROME screen traces back to the exact source rows behind it.

One platform, many restaurants — every table is keyed by restaurant, and every query the product runs is scoped to the requesting restaurant on the server. One customer’s data is never visible to another, and the same isolation applies inside our own admin tooling.

All data is stored in access-controlled databases encrypted at rest. Guest identity fields — names, emails, phones — live in a separated identity store with an additional layer of field-level encryption (AES-256-GCM), with keys held outside the database. The analytics side of ROME works entirely on pseudonymous customer IDs; every access to identity data is written to an audit log (the access, never the values).

Most of ROME’s analysis never touches AI at all. The Profit Leak Audit, the briefing, menu engineering, and forecasts are computed by ROME’s own analysis engine on our own infrastructure — deterministic calculations, no AI involved. AI enters only in the conversational layers: Ask ROME inside the product and the concierge chat on this site.

When Ask ROME answers a question, it sends the AI provider the computed results it is grounded on plus the conversation so far (the last 20 messages) — always scoped to your restaurant, never raw database access. No guest name, email, phone, or address is included in anything sent to an AI model, written to a log, or placed in a web address.

Two separate things happen to a conversation. The AI provider is Anthropic (Claude), used under their published commercial terms, which prohibit using customer data to train their models; Anthropic keeps inputs only short-term for safety monitoring. ROME keeps your conversations with Ask ROME and with the concierge chat on this site, sends each one to the ROME team, and reviews them to improve the product. Conversations are never sold and never shared with other restaurants. Questions about any of this: rome@romeintel.com.

We keep customer data for as long as the customer relationship lasts, and delete or return it on request when it ends. Guests may request an export of the data held about them or the deletion of their identifying data through their restaurant; visit history may be retained in anonymous form so the restaurant’s totals stay accurate.

This page describes the architecture in plain language; the binding commitments live in the Privacy Policy and Terms of Service. Questions: rome@romeintel.com.