Privacy policy.

Roome.Uni Ltd (“Roome”, “we”, “us”) is a company registered in England and Wales (company number 12673143). We are the data controller for the personal data described in this policy, registered with the UK Information Commissioner’s Office under registration number ZB254648.

This policy covers:

• the Roome app for iOS and Android,
• our website at roome-uni.com, and
• the Roome partner dashboard used by university partners.

It explains what personal data we collect, why, who we share it with, how long we keep it, and the rights you have. We have written it in plain English on purpose. If anything is unclear, email us at info@roome-uni.co.uk.

The short version:

• We collect the information you give us to verify you are a genuine student and match you with compatible housemates and housing.
• We never sell your data.
• Your university only ever sees anonymised, aggregated statistics, never your individual profile, messages or identity.
• Marketing is strictly opt-in and off by default.
• You can delete your account in the app at any time.

1. Who this policy is for

Most of this policy is written for students and applicants using the Roome app. Section 12 covers university staff who use the partner dashboard. Section 13 covers website visitors.

2. What we collect

Information you give us

Category	What it includes	Why
Identity	First name, last name, date of birth	Your account and profile; age-appropriate service
Contact	University email address, personal email address, phone number	Login codes, verification, service messages
Academic	University, campus, course, year of study, expected graduation year	Matching you to the right university community; working out when your account should wind down (Section 8)
Profile and matching	Lifestyle quiz answers (for example social and living preferences, music taste), bio, rental budget, preferred move-in dates, interests, profile photos, social handles	Housemate compatibility matching and your public profile
Optional demographics	Gender (with a “prefer not to say” option), nationality	Supporting preferences such as single-gender households
Content	Messages and images you send in chats, posts in communities and spaces, spare-room listings, messages to our support team and to the ai assistant	Providing those features
Consent records	The terms version you accepted and when, your marketing preferences	Legal record-keeping

Information collected automatically

• Technical data: device platform, push notification token, IP address and browser/device information when you log in or request a verification code.
• Usage data: how you use the app (screens visited, features used) so we can improve it.
• Install attribution: if you consent to tracking when the app asks (Apple’s App Tracking Transparency prompt on iOS), our attribution partner records which campaign or link led you to install the app. If you say no, we do not track you across other companies’ apps and websites.

Information from other sources

• Accommodation partners: if you book accommodation with one of our partner providers, the provider may confirm your booking outcome to us (matched by your email address) so we can measure whether Roome helped you find a home.
• Your university: for pre-arrival applicants, your university may issue you a code that lets you register before your university email account exists.

What we deliberately do NOT collect

• No passwords. Roome has no passwords; you log in with one-time codes (Section 9).
• No payment or bank details. Roome is free for students and has no payment functionality.
• No device location. We do not automatically access GPS or your device’s location. Housing or other location search features uses the geo coordinates of your chosen university and campus.
• No special category data. We do not collect data about race or ethnicity, religion, health, sexual orientation, political opinions, trade union membership, or biometric or genetic data. Gender is optional and has a non-disclosure choice.

3. How we use your data

• Running the service: creating your account, verifying you are a genuine student, showing your profile to potential housemates, powering chat and communities, and showing you property listings.
• Housemate matching: our matching uses your quiz answers and preferences to calculate compatibility. Matching is done by our own systems using Roome’s own rules-based logic. Vibe scores are for guidance purposes, you always choose who to talk to and live with.
• The Roome assistant (AI): the app includes an assistant you can chat with for housing help. See Section 4, which explains exactly how it works.
• Service communications: verification codes, security notices, and messages about your account. You get these regardless of marketing preferences because the service does not work without them.
• Marketing (opt-in only): news, offers and events, but only if you tick the box. Email, SMS, push and in-app are separate consents and all default to OFF. Every marketing email contains an unsubscribe link, and you can change your preferences in the app at any time.
• Analytics and improvement: understanding how the app is used so we can improve it.
• Safety and moderation: reviewing reported content, blocking abusive accounts, preventing fraud and fake accounts, and keeping the community safe.
• Legal: complying with the law and establishing or defending legal claims.

4. The Roome assistant and AI

The app includes an ai assistant that can help you search for housing, suggest potential housemates, and answer questions about renting and student living.

• The assistant is AI-powered, built on OpenAI’s language models. It is not a human, although our team can review conversations to improve the service and to step in where the assistant cannot help.
• To give useful answers, the assistant uses your profile information (such as your name, university, course, budget, move-in dates and bio) alongside your questions. When it suggests housemates or properties, it looks these up in the same way the app’s normal search does.
• Conversations with the assistant are processed by OpenAI acting as our processor. Your data is not used to train OpenAI’s models, and we never use your data (even anonymised) to train AI models ourselves.
• The assistant can make mistakes. Its suggestions are not professional, legal or financial advice. Always check important information before acting on it.

5. Who we share data with

We never sell your personal data. We share it only as described here.

Your university

Universities that partner with Roome see aggregated, anonymised statistics only: counts, trends and distributions, such as how many of their students are looking for housing. Small groups are suppressed so individuals cannot be picked out. Your university cannot see your profile, your messages, your matches, or that you personally use Roome.

Service providers (processors)

Provider	What they do for us	Personal data involved
Amazon Web Services (UK/London region)	Cloud hosting, database, photo storage, email delivery	All service data
OpenAI	Powers the in-app assistant (Section 4)	Your assistant conversations and the profile data used to answer you
Klaviyo	Email and SMS delivery, marketing preferences	Contact details, profile information, marketing consents
Amplitude (EU servers)	Product analytics	Pseudonymised usage data with limited profile attributes
AppsFlyer	Install attribution (Section 2)	Device identifiers, only with your ATT consent on iOS
BulkSMS	Delivering SMS verification codes	Phone number
Expo	Push notification delivery	Push token
Sentry (EU)	Error monitoring	Technical error data (configured not to receive personal data)
Google (Firebase)	Push notification infrastructure	Push token, device data
Resend	Email delivery for some communications	Email address, name

Our own team also uses standard business tools (such as secure team messaging) to operate the service and handle support requests; these tools can process limited personal data under our instructions. All processors are bound by contracts requiring them to protect your data and use it only on our instructions.

Property Enquiries

If you complete and submit an enquiry form for a property listing, including ‘Pre-book a Room’ or ‘Book a Viewing’, we pass your information to the housing provider (or, in some cases, their managing agent). This can include your name, contact details and budget. Once shared, any further use of this information is governed by the housing provider’s (or agent’s) own privacy policy, not ours.

Simply clicking through from Roome to view a listing, for example on the provider’s own site, does not share any personal data. The link may carry a non-personal reference (such as a source tag) so we can measure how our platform is performing, but this does not identify you.

Bill splitting

If you choose to set up shared bills, the app links you to our partner Homebox (Billing Better Ltd), a separate company with its own privacy policy. We pass no personal data to Homebox. Anything you enter on their site is between you and them.

Other users

Your profile (photos, bio, preferences you have chosen to show) is visible to other verified students so matching can work. Messages you send are visible to their recipients. Think before sharing personal contact details in chat.

Legal and business

We may disclose personal data where required by law, to protect the safety of our users, or as part of a business sale, merger or investment process (under confidentiality, and this policy would continue to apply).

6. International transfers

We host and process data in the United Kingdom (AWS London region). Some of our processors are based outside the UK, including in the United States (for example OpenAI and Klaviyo). Where data leaves the UK we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum with each provider, so your data gets equivalent protection.

7. Legal bases

Under UK GDPR our legal bases are:

• Contract: operating your account and the service you signed up for (verification, matching, chat, the assistant, listings).
• Consent: marketing communications (all channels, opt-in, withdraw-able at any time); install attribution tracking on iOS via the ATT prompt.
• Legitimate interests: service analytics and improvement, safety and moderation, fraud prevention, and aggregated university reporting. We balance these against your rights and you can object at any time.
• Legal obligation: where the law requires us to keep or disclose information.

8. How long we keep your data

• While your account is active: we keep the data needed to run your account.
• If you delete your account in the app: your profile and personal details are removed immediately from view on the platform. Messages you previously sent may remain visible in recipients’ conversations, and your username may still appear next to them, although your profile can no longer be opened.
• Behind the scenes: after deletion, your account data is kept on our systems for up to 12 months (for example, for legal or fraud-prevention purposes), after which it is automatically deleted or anonymised. We may delete it sooner where possible. If you come back after this, you’ll need to register as a new account.
• Consent and legal records: we keep minimal records (such as when you accepted the terms) for as long as needed to meet legal obligations.

9. Security

• No passwords to steal: login uses single-use, time-limited codes sent to your verified email or phone. Access to your Roome account is protected by access to your university mailbox, which your university protects with its own multi-factor authentication.
• All traffic is encrypted in transit (HTTPS/TLS) and data is encrypted at rest on AWS.
• Our systems run in a private network; databases are not exposed to the internet.
• The platform is penetration tested by an external partner and findings are remediated.
• We have a breach response procedure and will notify you and the ICO where legally required.

No system is perfectly secure, but security decisions in Roome (like having no passwords at all) are made to minimise what could ever be exposed.

10. Your rights

You can, at any time:

• Access the personal data we hold about you (a “subject access request”).
• Correct inaccurate or incomplete data (most profile fields you can edit in the app yourself).
• Delete your data (use in-app account deletion, or email us).
• Object to processing based on legitimate interests, or to direct marketing (which we will always stop).
• Restrict processing in certain circumstances.
• Port your data: receive a machine-readable copy of data you provided.
• Withdraw consent at any time where consent is the basis (for example marketing).

Email info@roome-uni.co.uk to exercise any right. We respond within one month and never charge a fee unless a request is clearly unfounded or excessive. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk), although we would appreciate the chance to sort things out first.

11. University access (partner dashboard)

If you are a university partner using the Roome partner dashboard, we process: your name, work email address, your role and permissions, sign-in records, and an audit log of significant actions. If your university enables single sign-on, we receive your work email address and organisation identifier from Microsoft Entra ID at sign-in; we do not receive your password. This data is processed to provide the dashboard under our agreement with your university, and is kept for the duration of your university’s partnership and account.

12. Website visitors and cookies

The Roome app does not use cookies, so no cookie banner is shown there.

The partner dashboard sets only cookies that are strictly necessary to sign in (session and security cookies), so no cookie banner is needed there either.

The website at roome-uni.co.uk uses:

• essential cookies needed for the site to function; and
• Google Analytics cookies, which help us understand how visitors use the site. These are only set if you accept them via the cookie banner, and you can say no without losing any functionality.

13. Changes to this policy

When we make material changes we will tell you, by email and/or a notice in the app, before or as they take effect. We will not quietly change how your data is used. The current version and its effective date always appear at the top of this page.

14. Contact

Roome.Uni Ltd

Company number: 12673143 (England and Wales)

Registered office: 14a Meadway Court, Rutherford Close, Stevenage, Hertfordshire, SG1 2EF

ICO registration: ZB254648

Email: info@roome-uni.co.uk