Privacy

Room4Resource is run by Evans AI Labs Ltd, company number 17348239, 128 City Road, London EC1V 2NX. When you use Room4Resource, we are the data controller for the personal data described here. You can reach us about anything on this page at info@room4resource.com.

Last updated 13 October 2026.

The short version

• We hold what you type in, and almost nothing else.
• We do not sell your data, and we do not advertise to you.
• A company only sees a crew's name and contact details after it has unlocked that crew, and that rule is enforced in the database, not just on the screen.
• We do not check anybody's tickets, insurance or right to work. That is between the company and the crew.
• We set no tracking cookies and load no third-party scripts. There is no cookie banner because there is nothing to consent to.

What we hold, and why

If you register a company

Your company name, Companies House number, postcode, the sectors you work in, and a contact name, email address and phone number. Everyone you give a login to is recorded by their email address, along with who invited them.

When you say what resource you need, we hold that: the scope of works, sector, crew types and tickets wanted, the location, a provisional start date, duration and any notes you add. We also hold which crews you unlocked and when, and any reviews you write.

Why: to provide the service you signed up for. In data protection terms the lawful basis is performance of a contract.

If you register as a crew

Your trading name, base town and postcode, how far you will travel, your sector, the crew types you can field, the tickets you say you hold and their expiry dates, your availability, how many operatives you have, years trading, and a contact name, phone number and email.

If you upload photographs of tickets, we hold those too, in private storage. A ticket photo usually carries your name, a card number, an expiry date and often a photograph of you, and sometimes a date of birth. Only you and a company that has unlocked you can see them, and only through a link that expires within minutes.

Why: to match you to work and to let a company judge whether to approach you. The lawful basis is performance of a contract, and for the ticket images we also ask for your consent at sign-up, which you can withdraw by deleting them or asking us to.

If you add people to your gang

A crew leader can list the operatives in their gang: name, phone number, role and tickets.

This is other people's personal data, and you are giving it to us. Before you add someone, tell them you are doing it — they have the same rights over their data as you do over yours. We keep it because you asked us to, so that your gang can be shown as capability rather than as a list of strangers.

A hiring company never sees these names. It sees counts only — how many operatives, how many hold a given ticket. That is enforced by the database: there is deliberately no rule that would let a company read a gang member row at all.

Everyone

• Your email address, which is how you sign in. There is no password unless you choose to set one.
• When you were last active, so a company can judge how current a profile is.
• A record of things that happen — a sign-up, a job posted, an unlock — with your account reference against it, so we can see whether the pilot is working. Why: our legitimate interest in understanding and improving the service. This is first-party and stays with us.
• Messages we have sent you, including the text of the message, so we do not send the same reminder twice.
• Whether you have asked us to stop the occasional emails. Just the address and the date.

What we do not hold

• No rates, invoices or payments. Money is settled between you and the other party, off the platform. We never see it.
• No bank details. Nothing on Room4Resource asks for them.
• No full postcodes for distance. Matching uses the outward code only — CV1, not CV1 2AB — so we never learn where a crew actually is.
• No tracking. No advertising pixels, no third-party analytics, no scripts loaded from anyone else.

Who else processes it

We use a small number of suppliers to run the service. They act on our instructions.

• Supabase — the database, sign-in and file storage. Our data is held in the London (eu-west-2) region. Supabase Inc. is a US company.
• Vercel — hosting and delivery of the site. Vercel Inc. is a US company.
• Resend — sends our emails. Resend Inc. is a US company.
• postcodes.io — turns a postcode area or place name into a location, using Office for National Statistics data under the Open Government Licence. We send it an outward code or a place name. We never send it anything about a person.

Because three of those are US companies, some data may be transferred outside the UK. Where it is, the transfer relies on the UK Addendum to the EU Standard Contractual Clauses or the UK Extension to the EU–US Data Privacy Framework.

We will add a text-message provider later. This page will say so before we do.

How long we keep it

• While your account is open, we keep your profile so it works.
• If you ask us to delete your account, we remove your profile, your tickets and photographs, your gang list and your contact details within 30 days.
• Reviews stay, with your trading name attached, because other companies relied on them. Tell us if you think one is unfair.
• Jobs, unlocks and our record of events are kept for two years so we can answer a dispute about who contacted whom.
• Messages we sent are kept for 12 months.
• Nothing is kept for marketing. We do not have a marketing list, and we never sell or share your details.

We do send a small number of emails, and they divide in two. Because you did something: your sign-in link, a message when a company unlocks your details, a reminder before a ticket expires. Those keep the account working and cannot be switched off without breaking it. Because time passed: at most one a week, always about your own account — a crew that matches a requirement *you* posted, or your own profile having gone out of date. Every one of those carries a link that stops them for good, and your mail app's own unsubscribe button works too. Stopping them never affects the first kind.

Your rights

You can ask us to show you what we hold, correct it, delete it, or give it to you in a portable form. You can object to our use of it, and you can withdraw consent for ticket photographs at any time. Email info@room4resource.com and we will reply within one month.

If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk, or call them on 0303 123 1113.

Cookies

We set one kind of cookie: the one that keeps you signed in. It is strictly necessary for the site to work, so we do not ask for consent to it, and there is nothing else to turn off. We set no analytics or advertising cookies, and we load no third-party scripts.

Keeping it safe

Every table has row-level security on, and the rules that matter are enforced in the database rather than only in the screens: a company can read a crew's contact details only where it has unlocked that crew against its own job, and nobody but you can read your gang. Ticket photographs sit in a private store and are released only through short-lived links.

That is not a promise that nothing can go wrong. If a breach happens and it is likely to be a risk to you, we will tell the ICO within 72 hours and tell you without undue delay.

Changes

If we change this, we will change the date at the top, and if the change matters we will tell you by email rather than hoping you re-read the page.