Privacy notice

Last updated 1 November 2026

This notice explains what personal information Nextroom collects, why we use it, who we share it with, how long we keep it and the rights you have over it.

Who we are

Nextroom is run by its founders in the United Kingdom (“we”, “us”). We are the controller of your personal information, which means we decide how it’s used and we’re responsible for looking after it.

Because Nextroom is run from the UK, UK data protection law applies: the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you live in the European Economic Area, the EU GDPR gives you the same rights. You may also have rights under the privacy law of the country where you live.

What we collect

Your account: your email address and password. Your password is stored by our sign-in provider in a scrambled form that nobody, including us, can read.
Your age confirmation: that you confirmed you’re 18 or over, and when. We don’t ask for your date of birth.
Your profile: display name, bio, country, business stage, skills, interests and what you’re looking for.
Your profile photo, if you add one. It’s optional. Your browser crops it to a square and makes it smaller before it’s sent, and we remove the information cameras and phones store inside photos, such as where and when it was taken.
What you post and send: posts, comments, introductions and private messages.
Safety records: who you’ve blocked, reports you make or that are made about you, and any action we take, such as hiding content or suspending an account.
Technical information: your IP address, browser type and the times you sign in. We use these for security, to stop abuse and, if it’s switched on, to run the bot check on sign-up and log-in.
What you send us: if you email us, your email address and what you write.

Your email address is never shown to other members. Please don’t put sensitive information, such as health details, in your profile or posts.

Why we use it, and our lawful basis

UK data protection law says we need a lawful basis for each use of your information. Ours are:

To run Nextroom for you: your account, profile, posts, comments, introductions, messages and the emails that confirm your account or reset your password. Lawful basis: contract, because we need it to provide the service you signed up for.
To keep Nextroom safe: bot checks, daily limits on posting and messaging, reviewing reports, moderation, blocking and security records. Lawful basis: legitimate interests, in protecting members and keeping the service secure.
To meet our legal duties: for example under the Online Safety Act 2023, and to respond to lawful requests from the police or courts. Lawful basis: legal obligation.
To answer you when you contact us. Lawful basis: legitimate interests, in replying to you.

We don’t sell your information, use it for advertising, use it to train AI models, or make decisions about you using automated means alone.

Who can see it

Other members see your profile, including your photo, and what you post and comment. They don’t see your email address. Photos are only shown to signed-in members, through links that stop working after an hour, and never to people you’ve blocked or who have blocked you.
Private messages can be read only by the two people in the conversation. We read a message only if someone reports it.
Introductions are seen only by the person you send them to. If they decline, you aren’t told.
Nobody can see who you’ve blocked or who reported them.

Who we share it with

These companies run parts of Nextroom for us. They may use your information only to provide their service to us, under data processing agreements:

Supabase: our database, file storage (for profile photos) and sign-in system. Your information is stored in their London data centre.
Vercel: hosts the website. The pages that use your information run in London.
Cloudflare: runs our domain name, passes on emails sent to our address, and, if it’s switched on, runs the bot check (Turnstile) on sign-up, log-in and password reset.
An email delivery service: sends account emails, such as email confirmation and password resets.

Emails you send to admin@nextroom.club are passed on to an inbox run by Google (Gmail), where we read and keep them. Google looks after that inbox under its own terms and privacy policy.

Some of these companies are based in the United States, and their staff or systems may access information from outside the UK, for example to provide support or keep their service secure. When that happens, it’s protected by the safeguards UK law requires, such as the UK–US “data bridge” or the international data transfer agreements in their contracts.

We may also share information if the law requires it, for example with the police or Ofcom, or to protect someone from serious harm.

Cookies

We only use cookies that are needed to keep you signed in and keep the site secure. We don’t use advertising or analytics cookies. The cookies page lists each one.

How long we keep it

Your account, profile, posts and comments: until you delete them or your account.
Your profile photo: until you remove or replace it, or delete your account. The old photo is deleted straight away. We also remove photos that break the community guidelines.
Introductions and messages: until either person in the conversation deletes their account.
When you delete your account, your profile, photo, posts, comments, introductions, conversations, messages and blocks are deleted straight away.
Reports and moderation records: for as long as we need them to deal with repeated or serious problems, and no longer than two years after the report is closed, unless we need them for a legal claim or the police ask us to keep them. Reports you made are kept without your name once you delete your account.
Security logs, such as sign-in times and IP addresses: up to 90 days.
Emails you send us: up to two years after we’ve finished dealing with them.
Backups: deleted information can stay in our database provider’s backups for up to 30 days before it’s overwritten.

Your rights

You have the right to:

be told how your information is used, which is what this notice is for
get a copy of your personal information
have it corrected if it’s wrong. You can change your profile yourself in Settings
have it deleted. You can delete your account yourself in Settings
restrict how we use it, or object to how we use it for our legitimate interests
receive the information you gave us in a format you can take elsewhere

To use any of these rights, email admin@nextroom.club from the address on your account. We’ll reply within one month. Using your rights is free.

Complaints

If you’re unhappy with how we’ve handled your information, please tell us first at admin@nextroom.club. We’ll acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay. The contact and complaints page explains how.

You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live outside the UK, you can complain to the data protection authority where you live.

Under-18s

Nextroom is only for people aged 18 or over. If we find that an account belongs to someone under 18, we’ll delete it and everything in it.

Changes to this notice

If we make important changes, we’ll tell members by email or on the site before they take effect. The date at the top shows when this notice was last updated.