Privacy policy

This policy explains what personal information we collect through devroom.uk, why we collect it and what rights you have. We keep it short because we collect very little.

devroom is a trading name of YIOSHI LTD, registered in England and Wales, company no. 13736463. YIOSHI LTD is the data controller for the information described here.

1. Visiting the website

You can read this website without telling us who you are.

• No analytics or advertising. We do not use analytics, tracking pixels, advertising networks or social media plug-ins.
• No cookies for visitors. The public pages set no cookies. The only cookie we use is for signed-in accounts (see section 3).
• Server logs. Our hosting provider records standard request logs (IP address, browser type, page requested, time) to run and protect the service. These logs are kept for a short time and are not used to profile you.
• Fonts and scripts are served from our own domain. Your browser does not contact third parties to show the site.

2. Contacting us

If you email us at info@devroom.uk, we receive your name, email address and anything you include in your message. We use it only to reply and to deal with your enquiry or tender. We do not add you to a mailing list and we do not send newsletters.

Our lawful basis is our legitimate interest in responding to you, or taking steps at your request before entering into a contract.

3. Timesheet accounts

People who work with us can have an account at devroom.uk/login to record timesheets. For these accounts we hold:

• username, full name and your devroom.uk email address. You sign in with your devroom.uk Google account, so we hold no password
• an optional email address for timesheet reminders
• clients, timesheet entries and notes, and the name and email address of each client’s timesheet approver
• sign-in records needed for security, such as active sign-in sessions

A single cookie, ts_session, keeps you signed in. It is strictly necessary, it is only set when you sign in, and it expires after 30 days or when you sign out. While you sign in, a second cookie, ts_google, holds a one-time security value for up to 10 minutes.

Our lawful basis is the performance of our contract with you and our legitimate interest in billing our clients accurately.

4. Who processes data for us

We do not sell or rent personal information. We use these providers to run the service, each under a data processing agreement:

• Vercel hosts the website. Signed-in requests are handled in London.
• Supabase stores timesheet account data in Ireland (EU).
• Google confirms who you are when you sign in. We receive only your email address and whether Google has verified it.
• Resend sends timesheet reminder emails.

If a provider processes data outside the UK, the transfer is covered by UK adequacy regulations or the UK International Data Transfer Addendum. We may also share information when the law requires it.

5. How long we keep it

• Enquiry emails: for as long as needed to deal with the enquiry and any contract that follows.
• Timesheet records: while the account is active and then for up to six years, because they support invoices that we must keep for tax purposes.
• Expired sign-in sessions are deleted or made unusable automatically.

6. Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal information we hold about you
• correct information that is wrong
• delete your information, unless we must keep it by law
• restrict or object to how we use it

To make a request, email info@devroom.uk. We will reply within one month.

If you are not happy with how we handle your information, you can complain to the Information Commissioner’s Office. We would like the chance to put it right first.

7. Security

Data is encrypted in transit (HTTPS). Timesheet data can only be reached through our own server, never directly from the browser. We work to ISO/IEC 27001:2022 for information security.

8. Changes to this policy

When we change how we handle personal information, we will update this page and the date at the top.

9. Contact

For any question about this policy, email info@devroom.uk.