Privacy Policy
Last updated: 15 July 2026
This Privacy Policy explains how RehearsalRooms ("we", "us", "our") collects, uses, and protects personal data across our website and our rehearsal room booking platform (together, the "Service"). We are committed to protecting your privacy and handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are and our role
RehearsalRooms provides a booking platform that rehearsal spaces and studios (each a "Business") use to manage rooms, take bookings, and accept payments from their customers. Because of this, our role under data protection law depends on whose data is involved:
- We are the "controller" for personal data about our website visitors, people who register their interest, the account holders who use the platform (Business staff and administrators), and end customers in respect of operating and securing the platform itself.
- We act as a "processor" for personal data about a Business's own customers that we store and handle on that Business's behalf (for example, a customer's booking history with a particular studio). In that context the Business is the controller and decides how that data is used. Separate data processing terms govern this relationship (see section 7).
If you have any questions about this policy or how we handle your data, contact us at privacy@rehearsalrooms.co.uk.
2. Information we collect
Registering your interest
When you register interest through our website, we collect the email address you provide, and optionally your name, business name, and region.
Account and profile information
When you create an account or are invited to the platform, we collect your email address, first and last name, phone number, and a securely hashed version of your password. We record which Business you belong to and your role (for example customer, manager, administrator, or platform administrator).
Booking information
When you make or receive a booking, we process details such as the room and studio booked, start and end times, occupancy, price, booking status, and any notes added to the booking. Guests who book without an account provide their name, email, and phone number to complete the booking.
Payment information
Payments are handled by third-party payment providers (Stripe and PayPal). We do not receive or store your full card number, CVV, or bank card details — these are entered directly with the payment provider. We store a payment reference (such as a payment intent ID) linked to your booking, and, where a Business offers bank transfer, that Business's own bank details and any account credit or wallet balances and transactions associated with a user.
Integrations you enable
If a Business connects Google Calendar, we store the connecting Google account email and encrypted access tokens so we can add bookings to that calendar (see section 6).
Technical and usage data
We store an authentication token in your browser's local or session storage to keep you signed in, and (on our website) collect limited, anonymised analytics (see section 5). We also keep activity logs recording significant actions on the platform (such as sign-ups and key account changes) for security and audit purposes.
3. How we use your information and our legal bases
| Purpose | Legal basis |
|---|---|
| Notifying you about our launch after you register interest | Consent |
| Creating and managing your account and authenticating you | Contract |
| Processing bookings and payments, and sending related confirmations and reminders | Contract |
| Sending booking notifications to Business staff and administrators | Legitimate interests / processing on a Business's behalf |
| Securing the platform, preventing fraud and abuse, and keeping audit logs | Legitimate interests / legal obligation |
| Understanding and improving how our website is used (anonymised analytics) | Legitimate interests |
| Complying with legal, tax, and accounting obligations | Legal obligation |
Where we rely on consent, you can withdraw it at any time (see section 9). Where we rely on legitimate interests, we have balanced those interests against your rights.
4. When a Business is the controller
When you book with a particular studio or rehearsal space, that Business is the controller of your booking and contact details for its own purposes (running its business, contacting you about your bookings, and meeting its legal obligations). We process that data on the Business's behalf as its processor. For questions about how a specific Business uses your data, please contact that Business directly; you may also contact us and we will help where we can.
5. Cookies, local storage, and analytics
Authentication: when you sign in, we store an authentication token and basic account details in your browser's local storage or session storage. This is strictly necessary to keep you signed in and is not used for tracking or advertising.
Analytics: our public website uses a privacy-focused, self-hosted analytics tool (Matomo) that is configured to respect "Do Not Track" and does not use cookies. We do not use it to identify individuals, and we do not sell or share analytics data with advertisers. We do not use third-party advertising or tracking pixels.
6. How we share your information (sub-processors and third parties)
We do not sell your personal data. We share it only with service providers who help us run the Service, and only as necessary:
- Stripe and PayPal — to process payments.
- Resend — to send transactional emails (booking reminders, staff notifications, and invitations).
- Google — where a Business enables Google Calendar sync, we add booking details (such as customer name and times) to that Business's calendar.
- Matomo (self-hosted) — website analytics only, as described above.
- Hosting and infrastructure providers — who securely store and run the platform on our behalf.
We may also disclose data where required by law, to protect our rights, or in connection with a business transfer. These providers are bound to keep data secure and to use it only as instructed by us.
7. Data processing terms for Businesses
Where we act as a processor for a Business, our processing of that Business's customer data is governed by the data processing terms in our Terms of Service. Businesses remain responsible, as controllers, for having a lawful basis to collect their customers' data, for providing their own privacy information to their customers, and for the accuracy of that data.
8. International transfers
Some of our providers (including Stripe, PayPal, and Google) may process data outside the UK. Where personal data is transferred internationally, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses to protect it.
9. Data retention
We keep interest-registration details until you ask us to delete them or they are no longer needed to contact you. We keep account, booking, and payment records for as long as your account is active and as needed to provide the Service, resolve disputes, and meet legal, tax, and accounting obligations, after which they are deleted or anonymised.
10. Your rights
Under UK data protection law, you have the right to:
- Access the personal data we hold about you.
- Ask us to correct inaccurate or incomplete data.
- Ask us to delete your data ("right to erasure").
- Object to or restrict how we process your data.
- Request portability of data you provided to us.
- Withdraw consent at any time, where we rely on it.
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any of these rights, contact us at privacy@rehearsalrooms.co.uk. Where a Business is the controller of your data, we may direct your request to that Business or assist them in responding.
11. Security
We take appropriate technical and organisational measures to protect personal data, including hashing passwords, encrypting sensitive credentials at rest (such as payment-provider and integration secrets), restricting access by role, and isolating each Business's data. No system is completely secure, and we cannot guarantee absolute security, but we work to protect your data and to respond promptly to any incident.
12. Children
The Service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us so we can remove it.
13. Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date.
14. Contact us
If you have any questions about this Privacy Policy or our handling of your data, email us at privacy@rehearsalrooms.co.uk.