Home/Privacy Policy

Privacy Policy

ZoomyRoom mobile application & platform · Effective date: 1 June 2026

1. Who We Are

Red Software Development Ltd, trading as ZoomyRoom, is the data controller responsible for your personal data. We are registered in England and Wales with our registered office at 124 City Road, London, EC1V 2NX.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you download, install, and use the ZoomyRoom mobile application (“App”) available on the Apple App Store and Google Play Store, and any related services we provide through the App, including this website.

This policy applies to all users of the App, including Sublettors (people listing rooms), Renters (people searching for rooms), and visitors. It should be read alongside our Terms and Conditions.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

If you have any questions about this policy or your data, contact us at:

Email: privacy@zoomyroom.com
Post: Red Software Development Ltd, 124 City Road, London, EC1V 2NX

2. Data We Collect

2.1 Data You Give Us

When you create an account, use the App, or communicate with us, you may provide:

Account data: your name, email address, phone number, and password.
Profile data: profile photograph, bio, and personal preferences.
Listing data (Sublettors): property address, room descriptions, photographs, videos, pricing, availability, house rules, and any other details you include in a Listing.
Search and preference data (Renters): preferred area, budget range, move-in date, room type, lifestyle preferences, and saved searches.
Enquiry data: messages you send to Sublettors or Renters through the App, including your name and contact details shared in those messages.
Communication data: messages exchanged with our Renter Concierge team via WhatsApp, SMS, in-app messaging, email, or phone, including call recordings where you are informed at the start of the call.
Feedback and reviews: ratings, reviews, testimonials, App Store reviews, and feedback you provide through the App or to our team.
Onboarding data: how you heard about ZoomyRoom (acquisition source), collected during signup.
Verification data: any identity documents or proof of right to sublet that you voluntarily provide.
Payment data: if and when we introduce paid features, payment card details or payment account information processed by our third-party payment provider (we do not store full card numbers ourselves).

2.2 Data We Collect Automatically

When you use the App, we automatically collect:

Device data: device type, model, operating system version, unique device identifiers (including advertising identifiers such as IDFA and GAID), App version, and mobile network information.
Usage data: screens viewed, features used, search queries, Listings viewed, Listings saved or liked, messages sent, buttons tapped, time spent on each screen, and interaction patterns within the App.
Location data: approximate location based on your IP address. We do not collect precise GPS location data unless you explicitly enable location services for the App in your device settings. If you grant location permission, we use it to show you nearby Listings and personalise search results.
Log data: IP address, access times, App crashes, error logs, and referring sources.
Analytics data: aggregated and anonymised data about how the App is used, collected via analytics SDKs embedded in the App (see Section 10).

2.3 Data from Other Sources

Publicly available Listing data: we may collect property information (descriptions, photographs, approximate location, pricing) from publicly available sources on other platforms to create pre-populated Listings in the App, as described in our Terms and Conditions.
Social login data: if you register or sign in using Apple, Google, or another social login provider, we receive basic profile information (name, email) as permitted by that provider and your privacy settings.
App Store data: download and review data provided by Apple and Google in aggregate form.

3. How and Why We Use Your Data

The table below sets out each purpose for which we process your personal data, the categories of data involved, the legal basis under UK GDPR, and how long we keep it.

Purpose	Data Used	Legal Basis	Retention
Create and manage your Account	Account data, profile data	Contract (Art. 6(1)(b))	Duration of Account + 2 years
Display Listings in the App and enable enquiries	Listing data, profile data, enquiry data	Contract (Art. 6(1)(b))	Duration of Listing + 12 months
Publish Listings as public URLs accessible outside the App (see Section 4)	Listing data including address, photos, descriptions, pricing	Consent (Art. 6(1)(a)) and Legitimate interest (Art. 6(1)(f))	Duration of Listing + 12 months
Personalise search results and show nearby Listings	Search preferences, location data, usage data	Contract (Art. 6(1)(b))	Duration of Account
Send personalised Listing alerts and re-engagement messages	Search preferences, contact details, interaction history	Consent (Art. 6(1)(a))	Until consent withdrawn
Renter Concierge service (onboarding, support, recommendations)	Name, contact details, search preferences, communication data, acquisition source	Legitimate interest (Art. 6(1)(f))	Duration of Account + 2 years
Landlord/Sublettor outreach and activation	Publicly available listing data, contact details from public sources	Legitimate interest (Art. 6(1)(f))	7 days if unclaimed; 2 years if activated
Marketing, advertising, and promotional campaigns (see Section 5)	Listing data, photos, reviews, testimonials, aggregated usage data	Consent (Art. 6(1)(a)) and Legitimate interest (Art. 6(1)(f))	See Section 5
App analytics and improvement	Usage data, device data, log data, analytics data	Legitimate interest (Art. 6(1)(f))	26 months (anonymised indefinitely)
Review solicitation	Name, contact details, interaction history	Legitimate interest (Art. 6(1)(f))	Duration of Account
Fraud prevention, safety, and abuse detection	Account data, usage data, IP address, device identifiers	Legitimate interest (Art. 6(1)(f))	Duration of Account + 2 years
Legal compliance and dispute resolution	All categories as required	Legal obligation (Art. 6(1)(c))	As required by law

Where we rely on legitimate interest as the legal basis, we have carried out a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You can request a copy of our legitimate interest assessments by contacting us. You have the right to object to any processing based on legitimate interest at any time (see Section 9).

Where we rely on consent, you can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. Public Listing URLs and Indexing

To maximise the visibility of Listings and help Sublettors find Renters, we may make Listing content publicly accessible via individual web URLs (for example, zoomyroom.com/listing/12345). These public Listing pages may include:

The Listing description, photographs, and videos provided by the Sublettor.
The property location (area and postcode, but not the full street address unless the Sublettor has chosen to display it).
Room pricing, availability dates, and house rules.
The Sublettor’s display name and profile photograph (but not their email address, phone number, or other private contact details).

These public URLs may be:

Shared on social media platforms (Instagram, TikTok, Facebook, LinkedIn, X/Twitter, and others) by ZoomyRoom as part of marketing campaigns, or by Users themselves.
Indexed by search engines (such as Google, Bing, and others), making Listings discoverable via web search.
Included in email marketing, newsletters, paid advertising campaigns, and programmatic SEO pages operated by ZoomyRoom.
Embedded in or linked from third-party websites, blogs, and property aggregator services.
Used in retargeting and geo-targeted advertising campaigns across third-party ad networks.

By creating a Listing on the App (or by claiming a pre-created Listing), you consent to that Listing being published as a public URL and shared as described above. This consent is given at the point of Listing creation or activation and forms part of the service we provide.

You can control the visibility of your Listing at any time:

You can pause or remove your Listing through the App, which will remove the public URL and de-index it from search engines (though cached versions may persist temporarily on third-party services outside our control).
You can contact us at privacy@zoomyroom.com to request removal of any specific public URL.

Pre-created Listings that have not been claimed are not published as public URLs. They are visible only within the App during the 7-day activation window.

4.2 Renter Data on Public Pages

Public Listing URLs do not display any Renter personal data. The number of interested Renters may be shown in aggregate form (for example, “12 people interested”) but individual Renter names, contact details, and search preferences are never published on public pages.

5. Marketing, Advertising, and Promotional Use of Your Data

As set out in our Terms and Conditions (Section 11.3), by using the App you grant us a licence to use your data for marketing and promotional purposes. This section explains how we exercise that licence and your rights in relation to it.

5.1 What We May Use

Listing photographs, descriptions, and pricing in social media posts, paid ads, email campaigns, print materials, outdoor advertising, video content, and any other marketing channel.
Aggregated and anonymised data (such as average room prices in Hackney, number of active Listings, user activity metrics) in press releases, investor materials, blog posts, case studies, and public communications.
User reviews, ratings, and testimonials in App Store descriptions, website content, advertising materials, and social media.
Public Listing URLs in programmatic advertising, retargeting campaigns, social media promoted posts, and SEO content.
Derivative content (graphics, videos, infographics, case studies) created from your Listing data or aggregated App data.

5.2 Third-Party Marketing Partners

We may share your data with third-party advertising platforms, marketing service providers, and media partners solely for the purpose of executing marketing campaigns on ZoomyRoom’s behalf. These partners include:

Social media advertising platforms (Meta/Facebook, Instagram, TikTok, Google Ads, LinkedIn).
Email marketing and CRM service providers.
Analytics and attribution providers.
Programmatic advertising and retargeting networks.

All third-party marketing partners process data under data processing agreements that require them to protect your data and use it only for purposes we specify. We do not sell your personal data to third parties.

5.3 Direct Marketing Communications

We may send you marketing communications by email, SMS, WhatsApp, push notification, or in-app messaging. These may include:

New Listing alerts matching your search preferences.
Promotional offers and feature announcements.
Blog content, area guides, and rental market insights.
Requests for reviews or referrals.

For electronic marketing communications (email, SMS, WhatsApp), we rely on your consent, which we collect during registration or through the App. You can withdraw consent and opt out at any time by:

Adjusting your notification settings in the App.
Tapping “Unsubscribe” in any marketing email.
Replying STOP to any SMS or WhatsApp marketing message.
Contacting us at privacy@zoomyroom.com.

Push notifications can be controlled through your device’s notification settings.

5.4 Retention of Marketing Data

User Content incorporated into published marketing materials (such as a social media post featuring your Listing photo) at the time of Account deletion or Listing removal may remain in circulation. Upon request, we will make commercially reasonable efforts to remove your identifiable content from future marketing materials, though we cannot guarantee removal from third-party platforms or cached content.

Anonymised and aggregated data used in marketing does not constitute personal data and may be retained and used indefinitely.

We do not sell your personal data. We share data with the following categories of recipients, only to the extent necessary for the purposes described in this policy:

6.1 Other App Users

When a Renter enquires about a Listing, the Sublettor sees the Renter’s name and message. Renters see Listing details and the Sublettor’s display name and profile photo. Only information necessary for the enquiry process is shared between Users within the App.

6.2 The Public (via Public Listing URLs)

As described in Section 4, certain Listing data is published on public URLs accessible outside the App, indexable by search engines, and shareable on social media and third-party websites.

6.3 Our Operations Team

Our growth team and Renter Concierge team, including team members who may be based in various locations, have access to relevant User data as necessary to perform their roles. This includes Listing management, Sublettor outreach, Renter onboarding, and concierge support. All team members are bound by confidentiality obligations and receive data protection training.

6.4 Service Providers

We use third-party service providers who process data on our behalf under data processing agreements. The categories of providers we use, and examples of the types of services they provide, include:

Cloud hosting and infrastructure: services such as Amazon Web Services (AWS), Google Cloud Platform, or Microsoft Azure to host the App, store data, and run our backend systems.
App analytics and performance monitoring: services such as Google Analytics for Firebase, Mixpanel, Amplitude, or Crashlytics to understand how Users interact with the App, track feature usage, identify bugs, and monitor App performance and stability.
Attribution and install tracking: services such as AppsFlyer, Adjust, or Branch to measure which marketing campaigns and channels drive App downloads, and to attribute installs and in-app events to specific campaigns.
Communication and messaging platforms: email delivery services (such as SendGrid, Mailgun, or Amazon SES), SMS gateway providers (such as Twilio), and the WhatsApp Business API to send transactional messages, Listing alerts, and Renter Concierge communications.
Push notification services: Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) to deliver push notifications to your device.
Customer support and CRM tools: services such as Intercom, Zendesk, or HubSpot to manage User enquiries, support tickets, and Renter Concierge workflows.
Search and content delivery: content delivery networks (CDNs) and search infrastructure to serve Listing images, public Listing pages, and App content quickly and reliably.
Payment processors: when payment features are introduced, services such as Stripe or PayPal to process transactions securely. We will not store full payment card numbers ourselves.
Marketing and advertising platforms: social media advertising services (Meta, TikTok, Google Ads, LinkedIn), programmatic ad networks, and retargeting platforms. See Section 5.2 for full details.
Mapping and geolocation services: services such as Google Maps or Mapbox to display property locations, calculate distances, and power location-based search features within the App.

We regularly review our service providers and their data processing practices. All providers are contractually required to process your data only on our instructions, implement appropriate security measures, and not use your data for their own purposes beyond what is necessary to provide the service to us.

6.5 App Stores

Apple and Google receive certain data in connection with your download, installation, and use of the App, in accordance with their respective developer terms and privacy policies.

6.6 Legal and Regulatory

We may disclose your data where required by law, regulation, court order, or governmental request, or where reasonably necessary to protect the rights, property, or safety of ZoomyRoom, our Users, or the public. This includes sharing data with law enforcement, regulatory bodies, or legal advisers.

6.7 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your data may be transferred to the acquiring entity. We will notify you of any such transfer and any changes to this Privacy Policy.

7. International Data Transfers

Your personal data may be transferred to and processed in countries outside the United Kingdom where our operations team and service providers are based.

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place as required by UK GDPR, including:

UK International Data Transfer Agreements (IDTAs) or UK Addendums to EU Standard Contractual Clauses, as approved by the Information Commissioner’s Office (ICO).
Data processing agreements with all recipients.
Supplementary technical and organisational measures, including encryption in transit and at rest, access controls, and regular security audits.

You may request a copy of the safeguards we use by contacting us at privacy@zoomyroom.com.

8. Data Retention

We keep your personal data only for as long as necessary for the purposes set out in Section 3, or as required by law. Our specific retention periods are:

Active Account data: retained for the duration of your Account and for 2 years after Account deletion or deactivation to handle any post-closure enquiries or disputes.
Listing data: retained for the duration the Listing is active in the App, plus 12 months after removal or deactivation.
Public Listing URL content: removed when the Listing is removed from the App (subject to third-party caching outside our control).
Pre-created Listing data (unclaimed): deleted within 30 days of auto-unlisting.
Communication records (messages, call logs, WhatsApp/SMS history): retained for 2 years from the date of the communication.
Analytics and usage data: retained in identifiable form for up to 26 months, then anonymised. Anonymised data may be retained indefinitely.
Marketing consent records: retained for the duration of your Account plus 2 years (to evidence consent if challenged).
Legal compliance data: retained for the period required by applicable law (typically 6 years for contractual records).

When personal data is no longer needed, we securely delete or irreversibly anonymise it.

Under the UK GDPR, you have the following rights. You can exercise any of them by contacting us at privacy@zoomyroom.com.

Right of access (Article 15): You can request a copy of all personal data we hold about you. We will provide this in a commonly used electronic format within one month.

Right to rectification (Article 16): You can ask us to correct any inaccurate or incomplete data. You can also update most of your data directly through the App settings.

Right to erasure (Article 17): You can ask us to delete your personal data. We will do so unless we have a legal obligation or legitimate reason to retain it. Deleting your Account through the App will trigger erasure of your data in accordance with our retention schedule.

Right to restrict processing (Article 18): You can ask us to restrict the processing of your data in certain circumstances, such as while we verify the accuracy of your data or assess an objection you have raised.

Right to data portability (Article 20): You can request a copy of the data you provided to us in a structured, commonly used, machine-readable format (such as JSON or CSV), and you can ask us to transmit it to another controller where technically feasible.

Right to object (Article 21): You can object to processing based on legitimate interest (including profiling) at any time. You can also object to direct marketing at any time, and we will stop immediately.

Right to withdraw consent: Where we process your data based on consent (such as marketing communications or public Listing URLs), you can withdraw consent at any time through the App settings or by contacting us. Withdrawal does not affect processing that took place before withdrawal.

Rights related to automated decision-making (Article 22): We do not currently make any decisions based solely on automated processing that produce legal or similarly significant effects on you. If this changes, we will update this policy and provide appropriate safeguards.

We will respond to your request within one month. If your request is complex or we receive a large number of requests, we may extend this by up to two further months, and we will inform you of the extension and the reasons for it.

We may ask you to verify your identity before processing your request to protect your data from unauthorised access.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Cookies, SDKs, and Tracking Technologies

10.1 In the App

The App uses software development kits (SDKs) and similar technologies to collect usage data. These include:

Analytics SDKs: to understand how Users interact with the App, measure feature adoption, track crashes, and improve performance.
Advertising SDKs: to deliver and measure the effectiveness of advertising campaigns, including retargeting.
Push notification SDKs: to deliver push notifications to your device.
Attribution SDKs: to understand which marketing channels drive App downloads and engagement.

You can limit tracking through your device settings:

On iOS: Settings > Privacy & Security > Tracking. You can also enable “Limit Ad Tracking” or decline the App Tracking Transparency prompt.
On Android: Settings > Privacy > Ads. You can opt out of ad personalisation or reset your advertising ID.

10.2 On Our Website

Our website (including public Listing pages) uses cookies and similar technologies:

Essential cookies: Required for the website and public Listing pages to function. These cannot be disabled.

Analytics cookies: Help us understand how visitors use our website, which pages are popular, and how Users find us. We use Google Analytics 4 for this. Analytics cookies are only set if you accept them through the cookie consent banner.

First-party usage measurement: We also record basic usage events (pages viewed, buttons clicked, the campaign link that brought you here, and a random per-visit identifier that expires when you close the tab) directly to our own systems. No cookies and no third parties are involved, and the data cannot identify you. A longer-lived random identifier, stored in your browser's local storage so we can recognise return visits, is only created if you accept analytics through the cookie consent banner.

Marketing cookies: Used to deliver relevant advertising, measure campaign performance, and enable retargeting. These may be set by third-party advertising partners.

You can manage cookie preferences through the cookie consent banner on our website, or by adjusting your browser settings. Disabling certain cookies may affect website functionality.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Encryption of data in transit (TLS 1.2+) and at rest (AES-256 or equivalent).
Access controls: role-based access ensuring team members can only access data necessary for their role.
Secure authentication: password hashing, session management, and support for multi-factor authentication.
Regular security assessments and penetration testing.
Mandatory data protection training for all team members, including remote operations staff.
Incident response procedures: documented processes for detecting, reporting, and responding to data breaches.
Secure development practices: security reviews as part of our App development lifecycle.

Despite these measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we will notify you and the ICO without undue delay if a data breach occurs that poses a high risk to your rights and freedoms, as required by UK GDPR.

12. Children’s Privacy

The App is not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from anyone under 18, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@zoomyroom.com.

13. Third-Party Links and Services

The App may contain links to third-party websites, services, or applications (such as WhatsApp, mapping services, or social media). These are governed by their own privacy policies, not ours. We encourage you to review the privacy practices of any third-party service before providing them with your data. We are not responsible for the privacy practices of any third party.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the App (for example, via a push notification or in-app banner) and, where required by law, seek your renewed consent before processing your data in new ways.

The “Effective Date” at the top of this policy indicates when it was last updated. We encourage you to review this policy periodically. Your continued use of the App after a material update constitutes acceptance of the revised policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data:

Red Software Development Ltd, trading as ZoomyRoom

Address: 124 City Road, London, EC1V 2NX
Email: privacy@zoomyroom.com
Support: support@zoomyroom.com

To exercise your data rights or make a complaint, you may also contact the ICO:

Information Commissioner’s Office

Website: ico.org.uk
Telephone: 0303 123 1113
Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF