Privacy Policy

Who we are

Rooms.net is operated by Netavo Global Data Services Ltd, a company registered in the United Kingdom. We are the data controller for the personal data described here, which means we decide what is collected and why, and we are the ones answerable for it.

You can reach us about anything on this page through our contact page.

What we collect

When you create an account

Your email address, and a name to show other users.
A password, which we store only as a hash — we cannot read it, and neither can anyone who steals the database.
If you sign in with Google or Apple instead, we receive your email address and name from them. We never receive your password.
If you use a passkey, we store a public key. The private half never leaves your device and we could not obtain it if we wanted to.
A phone number, if you choose to give one.

When you look for a room

The searches you run, the rooms you save, and the alerts you set up.
Messages you send to landlords, and any files you attach to them.
Applications you submit, including anything you choose to upload in support of one — proof of income, for example. Please upload only what is asked for.
Viewings you book.
If you use the "near me" search, your device's location at that moment. We use it to sort results by distance and we do not store it.

When you list a room

The property's address and postcode. We convert the postcode into approximate coordinates so the room can appear in distance searches.
Photographs and descriptions you upload.
Documents you upload, including safety and compliance certificates, which often contain names and addresses.
Enquiries and applications you receive, and your replies.

Automatically, whoever you are

Your IP address, browser or device type, and the pages you requested, in our server logs. We keep these to keep the service running and secure.
Which listings were shown to you in search results and which you opened. Landlords see counts from this, never who you are.
If you use the mobile app and turn on notifications, a device token so we can send them.

We do not track you across other websites. There is no advertising network here, and nothing is sold or rented to anyone. We do use Google Analytics to count how the site is used - our cookies page lists every cookie the site sets, including that one, and explains how to turn it off.

Why we are allowed to hold it

UK data protection law requires a lawful basis for each use. Ours are:

To perform our contract with you — running your account, showing your listings, carrying your messages, handling applications and viewings. Without this data there is no service.
Our legitimate interests — keeping the site safe and free of fraud, investigating reports, preventing abuse, securing our systems, and understanding which parts of the site are used. We have weighed these against your interests and kept the data to what the purpose needs.
Your consent — for saved-search alerts and any optional notifications. You can withdraw it at any time in your notification settings, and withdrawing it does not affect anything we did while it was in force.
Legal obligation — for financial and accounting records, and for responding to lawful requests.

Who else sees it

Other users

This is a marketplace, so some sharing is the point. Your display name and profile photo are visible to people you message. A landlord sees your name and what you wrote when you apply or enquire. A tenant sees the listing you published and how to contact you through the site. We do not publish landlords' names on public listings unless they have chosen to trade under a business name.

Companies that process data for us

These act on our instructions and cannot use your data for their own purposes:

SendGrid (Twilio Inc.) — sends our emails.
Twilio — sends text messages, where used.
Microsoft Azure — stores uploaded photographs and documents.
Google Firebase and Apple — deliver push notifications to the mobile apps.
Mapbox — draws the map on a room's page. Loading it reveals your IP address to Mapbox.
postcodes.io — converts a postcode into coordinates. It receives the postcode only, never anything identifying you.
Google and Apple — only if you choose to sign in with them.

Other people

We will disclose data where the law requires it, to protect someone's safety, or to establish or defend a legal claim. If Rooms.net is ever sold, data would transfer with it, and we would tell you before that happened.

Outside the UK

Some of the companies above process data in the United States. Where they do, the transfer is covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

While your account is open — we keep your account and the content in it, so that the service works.
When you delete your account — we immediately remove your ability to sign in, delete your profile, your saved searches, favourites, notification settings and devices, take your listings off the market, and erase your name, email and phone number from the account record.
For 12 months after that — we keep the records that belong to someone else as much as to you: messages the other party can still see in their own inbox, applications a landlord received, and viewings that were booked. These are then erased. We keep them because deleting them would delete another person's record of a conversation they took part in, and because disputes over deposits and conduct tend to surface within a year.
For 6 years — financial and accounting records, where any exist, because HMRC requires it.
Server logs — kept for a short period for security and troubleshooting, then discarded.

We want to be straight about one thing. During those 12 months the retained records still refer to the account you deleted. They no longer carry your name, email or phone number, but they are not fully anonymous, and it would be dishonest to call them so. They are restricted — used only to keep the other party's records intact and to answer a legal claim — and then they are gone.

Your rights

You can ask us to:

Show you what we hold about you, and give you a copy.
Correct anything that is wrong.
Delete your account and data. You can do this yourself in the app or on the site, without asking us. Where we have to keep something, the section above says what and why.
Give you your data in a portable form, or send it to someone else.
Stop or limit a particular use, including any use we justify by legitimate interests.

Ask through our contact page. We will respond within one month. There is no charge.

If we get it wrong, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but it is your right either way.

Security

Traffic is encrypted in transit. Passwords are hashed, never stored. Uploaded documents are held in private storage rather than at a public address. Access to production data is limited to those who need it. No system is perfect, and if a breach ever put you at risk we will tell you and the ICO within the time the law allows.

Children

Rooms.net is for adults. You must be 18 or over to create an account. If we learn that an account belongs to a child, we will delete it.

Changes

If we change how we use your data in a way that matters, we will say so on this page and, where it is significant, tell you directly. We will not quietly widen what we do with data you gave us for something else.

Last updated: 10 September 2026.