Data Practices

ROME works from the exports your point-of-sale already produces — sales/orders, order items, menu & costs, and labor shifts. They land in a Bronze layer exactly as received (validated row by row, with rejected rows counted and reported, never silently dropped), are refined into Silver (cleaned, typed, reconciled facts), and finally into Gold — the audit findings, forecasts, and action plans you see. Because each layer builds on the one below, every figure on a ROME screen traces back to the exact source rows behind it.

One platform, many restaurants — every table is keyed by restaurant, and every query the product runs is scoped to the requesting restaurant on the server. One customer’s data is never visible to another, and the same isolation applies inside our own admin tooling.

All data is stored in access-controlled databases encrypted at rest. Guest identity fields — names, emails, phones — live in a separated identity store with an additional layer of field-level encryption (AES-256-GCM), with keys held outside the database. The analytics side of ROME works entirely on pseudonymous customer IDs; every access to identity data is written to an audit log (the access, never the values).

Most of ROME’s analysis never touches AI at all. The Profit Leak Audit, the briefing, menu engineering, and forecasts are computed by ROME’s own analysis engine on our own infrastructure — deterministic calculations, no AI involved. AI enters only in the conversational layers: Ask ROME inside the product and the concierge chat on this site.

When Ask ROME answers a question, it sends only the small slice of computed results needed for that one question — always scoped to your restaurant, never raw database access. No guest name, email, phone, or address is included in anything sent to an AI model, written to a log, or placed in a web address. The AI provider is Anthropic (Claude), used under their published commercial terms, which prohibit using customer data to train their models; inputs are retained only short-term for safety monitoring. Your data is never sold and never shared with other restaurants. Questions about any of this: rome@romeintel.com.

We keep customer data for as long as the customer relationship lasts, and delete or return it on request when it ends. Guests may request an export of the data held about them or the deletion of their identifying data through their restaurant; visit history may be retained in anonymous form so the restaurant’s totals stay accurate.

Prefer to keep raw numbers off our servers entirely? ROME’s in-browser audit runs the same analysis engine locally on your machine — you point it at your own export files, and the raw rows are never uploaded anywhere.

This page describes the architecture in plain language; the binding commitments live in the Privacy Policy and Terms of Service. Questions: rome@romeintel.com.