Privacy policy

This policy explains what personal data Roomee collects, why, and what you can do about it. It covers the Roomee service at getroomee.com and at any other hostname on which Roomee is operated by us.

Who we are

Roomee is operated from Ground Floor, Radley House, Richardshaw Road, Leeds LS28 6LE, United Kingdom. For questions about this policy, or to exercise any of the rights below, write to support@getroomee.com.

Two different roles, and which one applies

Roomee holds two kinds of personal data and our responsibilities differ between them.

• Account data. The name and email address of the person who creates an account, and the record of their plan and payments. We decide why and how this is handled, so we are the data controller for it.
• House data. The names, email addresses, dates of birth, family relationships and stay records of the people an administrator adds to a house. That administrator decides who goes in and what is recorded about them; we hold and process it on their behalf. In data protection terms they are the controller and we act as a processor for them.

If you have been added to somebody else's house and you want your details changed or removed, the fastest route is to ask whoever administers that house. You can also write to us and we will help.

What we collect

• Email address. Used to sign you in and to send you the emails below.
• Name. Shown to the other people in your house.
• Date of birth. Used to decide bedrooms - Roomee allocates rooms in age order and applies age-banded rates where a house uses them. It is visible to the people in your house.
• Family relationships. Who your partner and children are, so that you can book for them and so that rooms are allocated sensibly.
• Stays and preferences. The nights you have booked, the rooms you prefer, and where you slept.
• Money. Where a house uses nightly rates or receipts, what was charged and what was spent.
• Photographs. A single photograph of the property, if an administrator uploads one.
• Technical data. Standard web server records including IP address, and the country your request came from. We use the country to show prices in your currency, and we send it - the country code and nothing else about you - to our payment provider, Paddle, to work those prices out.

We do not collect payment card details. Payments are taken by Paddle, acting as merchant of record, and card details go to them and never to us.

Children

Roomee records children as members of a house, including their names and dates of birth, because that is what allocating bedrooms in a family requires. Those records are entered by an adult administrator and children do not create accounts, sign in, or receive marketing from us. If you are the parent or guardian of a child recorded in a house and you want those details removed, contact the house administrator or write to us.

Why we are allowed to hold it

• Performing a contract. Account data, and the operation of the service for the person who signed up.
• Legitimate interests. Keeping the service secure, preventing abuse, and sending the invitation email that tells somebody they have been added to a house. Our interest in that last one is that a house is unusable if the family cannot be told it exists; it is balanced by the email naming who added you and offering no way for us to contact you again.
• The instructions of a house administrator. House data, held on their behalf.
• Legal obligation. Records we are required to keep, such as those for tax.

Emails we send

Roomee sends three kinds of email and no others: a sign-in link when you ask for one, a verification message when you start creating an account, and an invitation when somebody adds you to a house. We do not send marketing email and there is no mailing list.

Cookies

Roomee sets cookies to keep you signed in, to carry you through account creation, and to remember where you are in the guided tour. All of them are strictly necessary for a service you have asked for, which is why you are not asked to consent to them. We do not use advertising cookies and we do not track you across other websites.

Who else handles it

We use a small number of suppliers, each of which acts on our instructions:

• Cloudflare - hosting, the database, file storage and network security.
• Resend - sending the three emails described above.
• Paddle - taking payments for paid plans as merchant of record, and working out the prices shown for your country.

We do not sell personal data, and we do not share it for anybody else's advertising.

Where it is held

Roomee runs on infrastructure distributed across several countries, which may include the United States. Where personal data leaves the UK or the European Economic Area, it is transferred under the safeguards our suppliers provide for that purpose, such as standard contractual clauses and the UK addendum to them.

How long we keep it

House data is kept for as long as the house exists. Deleting a house deletes the people, stays, rooms and records in it. An account deleted at your request is removed, save for records we must keep for tax or fraud prevention. Sign-in links expire shortly after being issued and are destroyed when used. Server logs are kept for a short period for security and troubleshooting.

Your rights

If you are in the UK or the European Economic Area you have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how it is used, and to receive it in a portable form. You may also complain to a supervisory authority - in the UK, the Information Commissioner's Office at ico.org.uk.

If you are a California resident you have the right to know what personal information we collect and why, to request its deletion or correction, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are used in California law.

To exercise any of these, write to support@getroomee.com. We will respond within one month.

Security

Roomee has no passwords to steal: you sign in with a single-use link, and the links are stored hashed rather than in readable form. Traffic is encrypted in transit. Access to a house is restricted to the people an administrator has added to it.

Changes

We will update this page when what we do changes, and the date at the top is the date of the current version.