Who we are
Book My Room is operated by Rhubarb Press, based in London, United Kingdom. If you have any questions about this policy, contact us at enquiries@rhubarbpress.com.
Data we collect
Account data
- Email address
- Display name (first name and last name)
- Job title (optional)
- Authentication provider used (email/password, Google, Apple, or Microsoft)
Organisation data
- Organisation name, address, phone number, and logo URL
- Senior staff names and titles
- Organisation settings (working hours, booking approval mode, colour scheme)
- Join codes for member invitations
Booking data
- Room name and identifier
- Booking date, start time, and end time
- Booking status (confirmed, pending, cancelled)
- Purpose of booking (optional)
- Number of attendees (optional)
- Recurrence details for repeating bookings
Calendar data (optional)
- If you connect your Microsoft 365 Outlook calendar, confirmed bookings are added as calendar events via the Microsoft Graph API
- We store the Outlook calendar event ID to manage (create/delete) events on your behalf
- We do not read or access any existing calendar events
How we collect it
- Account creation (email/password, Google Sign-In, Apple Sign-In, or Microsoft Sign-In)
- Organisation setup and administration by your organisation's admin
- Booking activity within the app
- Optional Outlook calendar connection (OAuth2 with your explicit consent)
Authentication providers
We use Firebase Authentication to manage sign-in. You may authenticate via Google Sign-In, Apple Sign-In, Microsoft Sign-In, or email and password. We receive only the information necessary to create and manage your account.
Why we use your data
- Account management and authentication
- Providing the room booking service within your organisation
- Managing organisation membership (join codes, approval workflow)
- Syncing bookings to your Outlook calendar (if connected)
- Displaying non-personalised advertising (free tier only)
Legal basis for processing
- Contract — processing necessary to provide the room booking service you signed up for
- Legitimate interest — analytics, security, and fraud prevention
- Consent — creating your account and agreeing to this policy; connecting your Outlook calendar
Third-party processors
| Processor | Purpose | Data shared |
|---|---|---|
| Firebase / Google Cloud | Infrastructure, authentication, database | All app data (encrypted in transit and at rest) |
| Microsoft Graph API | Outlook calendar sync (optional) | Booking details (title, time, date) — only when you connect your calendar |
| Google AdMob | Advertising (free tier) | Non-personalised ads only |
Multi-tenant data isolation
Book My Room is a multi-tenant application. Each organisation's data (rooms, bookings, members, settings) is stored separately in its own namespace within our database. Members of one organisation cannot access data belonging to another organisation.
Children
Book My Room requires users to be aged 13 or older. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, please contact us at enquiries@rhubarbpress.com and we will delete the account promptly.
Data retention
Your personal data is retained for as long as your account is active and you remain a member of an organisation. If an admin removes you from an organisation, your membership record is deleted. If you delete your account, your personal data is permanently removed. Booking records may be retained in anonymised form for organisational reporting purposes.
Your rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Request portability of your data
- Object to processing based on legitimate interest
- Withdraw consent for optional features (e.g. Outlook calendar sync)
- Lodge a complaint with the ICO (UK) or your relevant data protection authority
To exercise any of these rights, email enquiries@rhubarbpress.com.
Local storage
Book My Room uses AsyncStorage on your device to persist authentication tokens and user preferences. We do not use tracking cookies. No data is stored on your device for advertising purposes.
Advertising
The free tier of Book My Room displays non-personalised advertisements via Google AdMob. We do not use behavioural targeting, and we do not collect or share your Identifier for Advertisers (IDFA). Paid tiers are ad-free.
Security
- All data is transmitted over HTTPS/TLS
- Database data is encrypted at rest by Google Cloud
- Passwords are hashed by Firebase Authentication — we never store plaintext passwords
- Outlook calendar tokens are stored securely on your device and are not sent to our servers
International data transfers
Our infrastructure is provided by Google Cloud, which may process data in data centres outside the UK and EEA, including in the United States. Where this occurs, appropriate safeguards are in place, including standard contractual clauses.
Changes to this policy
We may update this privacy policy from time to time. The “last updated” date at the top of this page will be revised accordingly. Material changes will be notified to you within the app. Continued use of Book My Room after changes constitutes acceptance of the updated policy.