Version 2026-10-24 · Effective 24 October 2026
Augmetic Infinite LLP (a limited liability partnership registered in India, GSTIN 24ABPFA7903A2ZQ) runs Roomats and roomats.com and decides how the personal data described here is used. Under India's Digital Personal Data Protection Act, 2023, we are the “data fiduciary”; for people in the European Economic Area or the United Kingdom, we are the “controller” under the GDPR and UK GDPR; for people in Canada, we are the organization responsible for your personal information under PIPEDA and the provincial laws that apply (including Quebec's). Roomats is open to people everywhere, and this policy applies wherever you use it. For anything about your data, including complaints, contact our grievance contact — who is also our privacy officer, responsible for protecting personal information — at support@roomats.com.
Account: how you sign in — a mobile number verified with a one-time code, an email and password (we store only a one-way hash of the password, never the password), or your Google account (Google gives us a stable account id, your email and your name) — plus when you joined and whether you use Roomats as a tenant, owner or both. A verified mobile number is required before you post or contact anyone, whichever way you signed in — or, if you're in Canada, a confirmed email address instead. We tell whether you're in Canada from the country your IP address points to (worked out by our hosting provider on each visit; we don't store it).
Profile: the name you show, a photo, a short bio and occupation if you add them, lifestyle answers you choose to give (for example food habits, smoking, work pattern, what you want in a flatmate) with who may see each, your secret-match answers, and the look you pick for your character — the drawing shown instead of your initials (until you pick, one is drawn from your account number; nothing is guessed from your name or photo).
Housing: your listings, homes and rooms — rent, deposit, availability, features, house rules, photos, and the address you enter — plus your budget, move-in date, preferred areas, any searches you save (and whether you want alerts for them) and the listings you save to your shortlist. A lister sees only how many people saved theirs, never who.
Communication: connection requests (including a note you attach when you ask someone to share a place), messages you send and receive, and when you share your contact details with someone.
Sharing a place: if you tap “I'm open to sharing this” on a listing, the other members who did the same for that listing can see your display name, your verification badge, whether the share fits the budget you set, and the lifestyle answers you both gave. Nobody else sees it, and you can withdraw any time.
Reviews: reviews you write — the stars, your words, who they're about and the request they came from — reviews other members write about you, and your replies.
Payments: if you feature a listing — what you paid for, the amount, when, and Razorpay's references for the order and the payment. Razorpay handles your card, UPI or bank details; we never see or store them. Nothing is charged for the Roomats Partner service during the pilot (see “Roomats Partners (India)” below); we will update this policy before that changes.
Trust & safety: reports you make or that are made about you, people you block, documents you submit for verification, and the records of any moderation decision.
Support: what you send us through Help → Contact us — the topic, your message and our replies — and, if you write while signed out, the email address (and name, if you give one) you want us to reply to.
Technical: a record of your sign-ins and sign-outs; when you were last active, for your account and for each device you're signed in on, rounded to the hour (we use it to run the service, and our safety team may see it when reviewing a case); and your IP address, which we use briefly to stop abuse (such as limiting repeated sign-in attempts) and our hosting provider keeps in short-lived request logs. If you turn on push notifications, the push address your browser gives us for that device and a short label like “Chrome on Android”.
Page speed: your browser tells us how fast each page loaded — the page type (like “a listing page”), the timings, and whether it's a phone or computer. Nothing links these numbers to you or your device; we keep them 30 days. Browsers that send “Global Privacy Control” or “Do Not Track” don't send them at all.
Error reports: if something breaks, a technical report — the kind of page, the error and your browser type, with email addresses, phone numbers and ids removed — goes to our error-tracking provider. It never includes who you are, your messages or your contact details.
Security reports: if a page tries to load something our security policy doesn't allow (often a browser extension), your browser may tell us the page type and the blocked address — nothing about you. Kept 30 days.
Location: to suggest places near you, we use the approximate city your IP address points to (our hosting provider works it out for every request); we don't store it. If you tap “Use my current location”, your browser asks you first; your position, rounded to about 100 metres, is used once to find the area you're in and isn't stored — only the area, if you choose it.
We don't collect your contacts or anything from other apps, and we don't ask for sensitive details such as religion, caste, health or financial information.
Where the law asks for a legal basis for each use of your data (the GDPR in the European Economic Area, the UK GDPR, and laws like them), these are ours:
Anyone, including search engines: active listings — title, description, area (never the exact address), rent, availability and the cover photo — and the display name of the person who posted them.
Signed-in members: all listing photos, your profile, the lifestyle answers you've shared with all members — and reviews about you once they're up, with the reviewer's display name and whether they were the owner or the tenant. A review stays hidden, even from you, until you've written yours or 14 days pass; you only see that one is waiting.
Your lifestyle answers, as you choose: for each answer (food, smoking, drinking, pets, age, daily rhythm and so on) you choose who sees it — all members, people you've connected with (anyone you share a conversation with), or only you. Until you choose, answers are seen by your connections, except smoking, drinking, food, age and gender, which start as only you. The same choices apply to the “about you” part of your “looking for” posts, and “in common with you” uses only answers the other person may see. Answers kept to yourself are never shown, with one exception you control: secret match. After you and someone have each sent at least 10 messages in a chat, if you both kept the same answer to yourselves, we ask you both whether to reveal it to each other. We never say which answer — but someone who kept only one answer private could work out that yours is the same. Nothing is revealed unless you both say yes, and then only to each other. It's on unless you turn it off in Settings → Privacy, and your answers to it are deleted with your account.
Only the people you choose: your phone number, and only after you share it in a conversation. Messages are seen only by the people in the conversation — with one exception: if someone reports a message, our safety team may review that message and the messages just before and after it, to decide the report. Only the team member handling the report can open them, and each time they do is logged.
Never shown to other members: your exact address, verification documents, who reported whom, and internal safety records. Our team sees these only when needed to review a case, and their access is logged.
Our team: the people who run Roomats can see your account information — such as your name, account status, sign-in methods, listings and payments — when they need it to run the service, answer you or keep members safe. Your phone number and email address stay hidden from them unless one needs to be shown for a specific reason, and each time it is, that's logged. They never see your private lifestyle answers or secret-match answers, and they can't read your messages beyond a reported one as described above.
People you block can't see your profile or listings.
This applies only where Roomats Partners are offered: some Indian cities, and no other country. If you never apply to be a partner or ask a partner for help, nothing here collects anything about you.
If you apply to be a partner we keep:
How long. The identity files are erased 30 days after the decision on them. We keep the result (the type of document, whether it was approved, and the dates; a PAN's last four digits) for as long as you are a partner and then 2 years for safety and legal reasons. If you delete your account, your name, languages, gender, areas, hours, replies and PAN-derived values are removed and your files are queued for erasure with your other uploads; what is left is a “Deleted partner” record and the audit trail. If we give you notice, you have 14 days and one reply, which we keep with the decision.
If a partner tells an owner they can help. A partner can give us an owner's mobile number to find out whether that owner is on Roomats. The number is kept sealed, only while the request waits, and is erased when the owner answers, the request is cancelled, or it goes unanswered for 7 days. The partner can't tell whether the owner is a member.
If you ask a partner for help we keep your request (the place, the kind of place, the rent or budget, move-in date, language, whether you asked for a woman partner), the fee quote locked for it and the time you agreed, the deal and its steps, visit times, the visit code, check-in and check-out times, the move-in code, your messages in the deal chat, and any safety alert you or others raised. We don't read your location or take a selfie for a check-in: a partner's check-in is a time. Visit and move-in codes are stored only as a keyed hash.
What a partner can and can't see. A partner sees your request (the kind of place, the area, budget and dates), your display name and the deal chat. A partner never sees your phone number or email, your account, your other requests, or your private profile answers (including answers set to “Connections” or “Only me”), and being in a deal chat doesn't make a partner your connection. Contact details can't be sent in a deal chat. After the deal is locked, tenant and owner can share contact details with each other if they both choose; a partner can never share or receive them. You see a partner as a name, a badge and an avatar.
Who sees it on our side. The team members who run the service (offering requests to partners, deals, safety alerts) can see requests, deals and their steps. A safety alert sends a notice with no details to the safety team, who then open it. Their notes about a deal or an alert are internal and are not shown to you.
How long. A finished deal, with its request, offers, visits, move-in record, notes and audit trail, is deleted 2 years after it finished, once no one in it still has an account. A resolved safety alert is deleted 2 years after it was resolved. A deal is completed on its own after 7 days with no dispute. The fee quote locked for a request is kept as a permanent record. If you delete your account, what is unfinished ends, your id is removed from the deal's records, and the other person keeps their copy of the conversation.
While your account is open, we keep your data so the service works. You can edit or remove most of it yourself at any time — including your notification email and push devices, in Settings. Sign-in records are erased 30 days after the session ends. Support conversations are deleted 1 year after they're closed. A review taken down by its author or by moderation is kept for 180 days, in case of a dispute or a report about it, then deleted. Payment records are kept for 8 years after the payment, as tax and accounting law requires — even if you delete your account (then without your name).
When you delete your account (Settings → Your data):
Roomats is only for people aged 18 or over. We don't knowingly collect data about anyone younger; if we learn an account belongs to a child, we close it and delete its data.
All traffic uses HTTPS, and our providers encrypt stored data. Sessions can be revoked from Settings at any time. Only team members who need it can see private data, and administrative actions are recorded. If a breach affecting your data happens, we'll tell you and the authorities as the law requires.
We'll publish any update here with a new version date, and show you a notice in Roomats summarising what changed until you've seen it. See also our Terms of Service.