Privacy Policy

Last updated: March 2026

This Privacy Policy explains how [RoomsToRent Ltd] ("we", "us", "our") collects, uses, stores and shares your personal data when you use the RoomsToRent platform at roomstorent.london.

We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

RoomsToRent is operated by [RoomsToRent Ltd], registered in England and Wales (company number pending). Our data controller contact is ed@roomstorent.london.

2. What data we collect

Data type	What we collect	Why
Account data	Name, email address, password (hashed)	To create and manage your account
Profile data	Role (tenant/landlord/agency), phone number, bio	To show relevant information to other users
Listing data	Property address, postcode, photos, description, pricing	To display your listing to prospective tenants
Messages	Content of messages sent between users via the platform	To provide the messaging feature
Payment data	Payment confirmation and amount (card details are handled by Stripe, not us)	To process success fees
Usage data	Pages visited, search queries, browser type, IP address	To improve the platform and fix issues
AI interactions	Listing details and search preferences submitted to AI features	To power the AI assistant and area finder

3. Lawful basis for processing

We process your data under the following lawful bases:

Contract performance — processing necessary to provide the platform services you have signed up for.
Legitimate interests — to improve the platform, prevent fraud, and ensure safety of users.
Legal obligation — where we are required to retain or disclose data by law.
Consent — where we explicitly ask for your consent, such as for marketing communications.

4. How we use your data

To create and manage your account.
To display your listings to other users.
To enable messaging between tenants and landlords.
To process payments for successful lets.
To provide AI-powered features including the area finder and listing assistant.
To send you transactional emails (e.g. message notifications, payment confirmations).
To improve the platform and diagnose technical issues.
To detect and prevent fraud or abuse.

5. Who we share your data with

We do not sell your personal data. We share data only with the following third parties, and only to the extent necessary to provide our services:

Third party	Purpose	Location
Supabase	Database hosting, authentication, and file storage	EU / USA (standard contractual clauses apply)
Stripe	Payment processing	USA (adequacy decision / SCCs apply)
Anthropic	AI features (listing assistant, area finder)	USA (SCCs apply)
Vercel	Platform hosting and deployment	USA (SCCs apply)

We may also disclose your data to law enforcement or regulatory bodies where required by law.

6. Data retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 12 months, except where we are required to retain it for legal or financial compliance purposes (for example, payment records which we retain for 7 years in line with HMRC requirements).

Messages between users are retained for 12 months after account deletion and then permanently deleted.

7. Your rights

Under UK GDPR, you have the following rights:

Right of access — you can request a copy of the personal data we hold about you.
Right to rectification — you can ask us to correct inaccurate data.
Right to erasure — you can ask us to delete your data (subject to legal retention obligations).
Right to restriction — you can ask us to restrict processing of your data in certain circumstances.
Right to data portability — you can ask for your data in a machine-readable format.
Right to object — you can object to processing based on legitimate interests.
Right to withdraw consent — where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at ed@roomstorent.london. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

We use essential cookies to keep you logged in and maintain your session. We do not currently use advertising or tracking cookies. If this changes, we will update this policy and request your consent where required.

9. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS), hashed passwords, and restricted access to our database.

However, no method of transmission over the internet is 100% secure. You use the platform at your own risk and should take care to keep your account credentials secure.

10. Children

RoomsToRent is not intended for anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a notice on the platform. The date at the top of this page reflects when the policy was last updated.

12. Contact

For any privacy-related queries or to exercise your rights, contact us at:

[RoomsToRent Ltd]
Registered in England and Wales (company number pending)
Registered address: pending
Email: ed@roomstorent.london