Rome & Oak

Privacy policy

Effective September 17, 2026. This notice explains how information is handled when you browse Rome & Oak or contact customer care.

Who is responsible

Rome & Oak operates this storefront. For questions about personal information, email support@romeandoak.com. Our business correspondence address is 950 New Jersey Avenue SE, Washington, DC 20003, United States.

Information we receive

When you visit, our hosting and security provider receives technical information such as your IP address, requested pages, browser details and request times. This information helps deliver the website, diagnose errors and protect it from misuse.

If you contact us, we receive your email address, message and any attachments you send. Include only information needed for your inquiry. Do not send card numbers, passwords or verification codes.

An available ordering flow may ask for your name, contact details, delivery address and selected items. A bag or incomplete checkout is not evidence that payment was taken. The payment step identifies any payment service actually offered.

How we use information

We use information to provide requested website features, answer questions, support available orders and investigate security or service problems. Relevant records may also be needed to meet legal obligations or resolve a dispute.

Where applicable law requires a legal basis, these purposes may involve your requested service, a legal obligation, legitimate operational interests or consent. Optional processing that requires consent must have a separate choice.

Browser storage and measurement

The bag uses session storage for product references and quantities. Checkout recovery and order-access features may use necessary browser storage when available. Privacy controls save the choices you make on your device.

Optional store and Google Ads purchase measurement run only with your corresponding permission. Hosting requests and security logs still occur when optional measurement is off.

You can clear or restrict site storage through your browser. This may empty your bag or interrupt an order-access session. Clearing browser data does not delete information already sent to us or a service provider.

Cookies and browser storage

Browser privacy choices

Service providers and disclosures

Cloudflare provides website hosting, content delivery and security. Its services process technical requests needed to display this storefront. Support correspondence is handled through the email services used to receive and answer your message.

Information may be disclosed where legally required or needed to investigate abuse, protect rights or resolve a transaction dispute. This notice does not authorize unrelated marketing use. Any additional provider enabled for payments or fulfillment must be reflected in this notice.

Cloudflare privacy notice

Retention

We keep information for the purpose for which it was collected, including support, security and applicable recordkeeping duties. The appropriate period depends on the record, unresolved issues and legal requirements. We do not promise one deletion period for every type of information.

Ask us about a particular record if you need more detail. A deletion request may not cover information we must retain for a legal obligation or an unresolved dispute.

Your choices and requests

Depending on the law that applies to you, you may have rights to access, correct, delete or obtain a copy of your information. You may also be able to object to certain processing, restrict its use or withdraw consent. These rights have conditions and exceptions.

Email support@romeandoak.com to make a request. We may ask for proportionate information to locate the relevant records and verify your request. We will explain any applicable reason that prevents us from fulfilling it. You may also contact your relevant privacy authority.

Security and international processing

We use HTTPS and access controls for available protected features. No system can promise complete security. Keep order-access links private and contact us if you believe information has been exposed.

Service providers may process information outside your location. Applicable transfer safeguards depend on the service and relevant law. Cloudflare describes its processing in the notice linked above.

Children and updates

This storefront is intended for adult shoppers. We do not ask children to provide personal information. Contact us if you believe a child has sent information that should be reviewed or removed.

We update this notice when the storefront’s data practices change. The effective date identifies this version. A new use that requires consent needs a separate choice.

Optional Google Ads measurement

With your advertising permission, Google Ads uses advertising cookies and ad-click information to measure confirmed purchases. It receives the order reference, product IDs, quantities, prices, discount and net merchandise value, plus browser and network information. We do not send customer names, email addresses, delivery addresses or payment details in this purchase payload. Personalized advertising remains off.

Advertising and optional store measurement have separate choices. The Google Ads tag waits for advertising permission before loading. You can reject either choice and keep shopping, or change and withdraw it in Cookie preferences. Choices expire after 180 days. Global Privacy Control and Do Not Track keep optional measurement off. Withdrawal removes accessible first-party advertising cookies and may refresh the page; it cannot undo data already sent.

Cookie preferences

Google Ads measurement and your choice

The Google Ads tag loads on public shopping pages with advertising storage, advertising user data and personalization denied by default. Before advertising consent, Google may receive measurements without advertising cookies, including technical network information and a sanitized public page URL. Advertising cookies and purchase measurement require your Advertising permission in Cookie preferences. This tag does not send customer names, email addresses, delivery addresses, payment details or private order-access URLs. Do Not Track and Global Privacy Control prevent advertising consent from being granted. You can withdraw your choice in Cookie preferences.

Contact information

support@romeandoak.com

Rome & Oak

950 New Jersey Avenue SE, Washington, DC 20003, United States

Optional product interest measurement

With your permission, we count product views and successful additions to the bag by product and UTC date. These are action counts, not unique shoppers or conversion rates. Each event contains only a product ID, event type and a random event ID used to prevent duplicates; it contains no customer name, email, address or payment details. Cloudflare stores the aggregate totals and temporary event IDs. Temporary IDs expire from duplicate checking after 24 hours and are removed in bounded cleanup batches when new events arrive; aggregate totals remain until deleted. No analytics cookie or persistent visitor ID is used for this counter. Optional measurement stays off until you accept, and Global Privacy Control or Do Not Track keeps it off. You can withdraw permission on the Cookie & privacy choices page. Your choice is stored in this browser with its version and timestamp and expires after 180 days. Necessary bag and checkout storage works independently. Any separately configured Google Analytics or advertising measurement uses its own disclosed settings.

Server purchase measurement

With Analytics permission, we save Google client and session identifiers in a first-party cookie for up to 24 hours and attach them to your checkout. Our server uses this link to report confirmed purchases, order references, items and amounts to Google Analytics, even if you close the confirmation page. We schedule these server-side identifiers for removal after 30 days. Advertising use follows your separate advertising choice. Names, email addresses, delivery addresses and payment-card data are excluded from these events. You can withdraw permission on the privacy choices page.

Google measurement before a choice

Before you choose, configured Google tags may send shopping measurements without analytics or advertising cookies. Before a fresh browser makes a choice, advertising click parameters may pass between pages on this site without optional cookies. Google receives public page details, store, product and order references, prices, and browser and network information. Customer names, email addresses, delivery addresses and payment details are excluded from these events. For cookieless Google measurement before a choice, temporary Google client and session references can be attached to an unpaid checkout without saving these identifiers in a browser cookie. Our server uses this reference to report a confirmed purchase if the confirmation page closes. The server-side identifiers are removed after 30 days. Saved measurement refusals, Global Privacy Control and Do Not Track keep this reporting off. Analytics and advertising cookies require their respective approval.

Cookie-free purchase reporting

Reject optional on the cookie banner turns off optional cookies and keeps cookie-free purchase reporting on. You can also select Allow cookie-free purchase reporting in Cookie & privacy choices. Google Ads receives a confirmed purchase amount and order reference without analytics or advertising cookies. The new separate choice allows purchase attribution using the order reference, amount, IP address and actual Google advertising click references observed before payment. Click references can pass through links within this site without advertising cookies and are retained server-side for at most 30 days with bounded cleanup. It does not allow analytics or advertising cookies, email hashes or personalized advertising. Earlier IP-only choices are not expanded unless you choose again. Google also receives browser and network information. Names, email, delivery addresses and payment details are excluded. You can turn off all optional measurement instead. Existing full refusals, Global Privacy Control and Do Not Track remain in effect.

Advertising purchase matching

With advertising measurement permission, an enabled enhanced-conversion integration can send Google Ads a SHA-256 hash of the checkout email, the confirmed purchase reference and amount, and available Google advertising click or session information. The email hash and advertising context are captured before payment and expire from matching use after 30 days and are removed in bounded scheduled cleanup. The email itself, customer names, delivery addresses and card details are not sent in this matching payload. A new cookie-free purchase reporting choice can include actual Google advertising click references observed before payment, without analytics or advertising cookies. These references can pass through links within this site and are attached to the unpaid checkout, retained for up to 30 days and removed in bounded cleanup. This purchase-only matching payload contains no email hash or Analytics client/session identifiers. Earlier IP-only choices keep their scope until you choose again. You can withdraw advertising permission on the privacy choices page to stop further matching; full measurement refusal, Global Privacy Control and Do Not Track keep it off.

Cookie & privacy choices
Cookie & privacy choices