Privacy Policy

CampusNest collects information you provide directly when you register an account, create listings, submit reviews, report advertisements, or contact our support team. The information collected depends on your role on the platform:

• Students: When registering as a student, you must provide your full name, academic email address (which must belong to a recognized Sri Lankan higher education institution, such as *.ac.lk or *.edu), university name, faculty or campus area, and a secure password. As you use the platform, we also record your email verification status, 6-digit one-time password (OTP) verification codes, bookmarked/saved boarding listings, 1–5 star reviews with optional written feedback, and any listing dispute reports you submit (including the selected reason and detailed description).
• Boarding Owners: When registering as a property owner or manager, you provide your title (Mr, Mrs, Ms, Dr), full name, primary contact phone number, optional secondary contact phone number, email address, and password. When creating property advertisements, you provide detailed accommodation data including the property title, physical address, distance to university in kilometers, student capacity, monthly rental price (in LKR), key money / security deposit amount (in LKR), gender preference (Male Only, Female Only, or Any), accommodation description, selected amenities and facilities (such as Wi-Fi, attached bathroom, kitchen, separate entrance, etc.), and uploaded photographs of the premises. Additionally, we record transaction identifiers, PayHere order IDs, payment amounts, and payment statuses for advertisement publishing fees.
• Support Inquirers & Visitors: When you submit an inquiry through our public contact form at /support, we collect your name, email address, inquiry subject, and message content to assist you and maintain customer support records.

When you access and navigate CampusNest, our servers and application runtime automatically log certain technical and analytical metadata to ensure platform security, stability, and diagnostic logging:

• Device and Network Information: We log your Internet Protocol (IP) address, browser type and version, device operating system, language preferences, and hardware specifications.
• Usage and Interaction Patterns: We collect timestamps of requests, referring URLs, pages visited, search criteria (such as university filter, distance, price range, and gender preference), and listing view counts.
• External Typography Delivery: CampusNest uses Google Fonts to deliver consistent typography. When loading font stylesheets and font binaries, your browser connects directly to Google servers, which may log your IP address according to Google's standard network operational logging.

CampusNest processes your personal data strictly for legitimate educational marketplace purposes, including:

• Facilitating Student Accommodation Discovery: Displaying verified boarding listings, property details, amenities, location relative to Sri Lankan universities, and owner contact numbers to prospective student tenants.
• Academic Domain Verification: Validating that student registrants possess genuine Sri Lankan higher education email addresses, ensuring that community reviews and reports originate from real students.
• Algorithmic Suitability Scoring: Evaluating property attributes (rent competitiveness, proximity to campus, facility completeness, photo availability, contact completeness, and freshness) to compute an objective 100-point Suitability Score that helps students compare options.
• Payment Processing & Verification: Facilitating the payment of owner advertisement listing fees (LKR 1,000 per ad) through our payment gateway partner PayHere, verifying cryptographic payment signatures, and generating digital receipts.
• Community Safety & Moderation: Enabling verified students to submit dispute reports against inaccurate, fraudulent, or unavailable listings, and allowing administrators to investigate, resolve, or take down non-compliant advertisements.
• Transactional Communications: Dispatching essential system emails via our email infrastructure (Resend / SMTP), including 6-digit OTP account activation codes, password reset links, email change confirmations, listing deactivation notices, and payment receipts.

CampusNest respects your digital privacy and does not employ invasive third-party tracking cookies or behavioral advertising trackers. Instead, our web application utilizes client-side web storage APIs:

• Session Storage (sessionStorage): We store your cryptographically signed JSON Web Token (JWT), user role (student, owner, or admin), full name, login state, and email verification status in your browser's sessionStorage. This data is required to maintain your authenticated session as you navigate the platform. Because it is stored in session storage, your credentials and session state are automatically purged when you close your browser tab or window.
• Local Storage (localStorage): We use localStorage solely for functional client-side performance and deduplication—specifically to remember which boarding advertisements you have already submitted a report for (campusnest_reported_boardings), preventing accidental duplicate report submissions.
• No Third-Party Advertising Cookies: We do not place advertising cookies, tracking pixels, or cross-site tracking scripts on your device. You may clear your browser's local and session storage at any time via your browser settings.

CampusNest collects and processes personal data in strict compliance with the Personal Data Protection Act No. 9 of 2022 (PDPA) of the Democratic Socialist Republic of Sri Lanka. Our lawful bases for processing include:

• Consent: You provide clear, affirmative consent when registering an account, verifying your institutional email, uploading property photos, posting a review, or submitting a dispute report.
• Performance of a Contract: Processing is necessary to provide you with CampusNest platform services, manage your account, publish advertisements, and deliver customer support under our Terms of Service.
• Compliance with Legal Obligations: Retaining financial transaction audit logs and company records as mandated by Sri Lankan tax, commercial, and electronic commerce laws.
• Legitimate Interests: Protecting the integrity and safety of our student community, verifying academic affiliation, preventing fraudulent or predatory accommodation listings, and maintaining network and information security.

We partner with reputable third-party infrastructure providers to operate the platform. All third-party processors are bound by strict data protection agreements and are permitted to process your data only as directed by CampusNest:

• PayHere (Pvt) Ltd: Our payment gateway provider for processing boarding owner listing fees in Sri Lankan Rupees (LKR). PayHere is a Central Bank of Sri Lanka approved, PCI-DSS Level 1 compliant payment processor. When you pay a listing fee, your payment card or mobile wallet details are submitted directly to PayHere; CampusNest never handles, collects, or stores your credit or debit card numbers, CVV codes, or bank credentials.
• Cloudflare R2: An S3-compatible, high-performance cloud object storage service used to store, serve, and cache property images uploaded by boarding owners. Images uploaded to Cloudflare R2 are publicly accessible to allow prospective students to view accommodation facilities.
• Resend / Transactional SMTP: Cloud email delivery infrastructure used to transmit critical system notices, including 6-digit OTP verification codes, password reset instructions, ad moderation alerts, and payment invoices.
• Google Fonts: Typography services loaded from Google's content delivery network.

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law:

• Active Accounts: User account profiles, saved boardings, published listings, and reviews are retained while your account remains active.
• User Self-Deletion: You have the right to delete your account at any time via your Account Settings. When you initiate account deletion, CampusNest performs a soft-deletion (deleted_at = NOW()) that immediately revokes your login credentials, anonymizes your active profile, deactivates all owned boarding advertisements (marking them as Removed), and unpublishes your active listings from search results.
• Financial and Audit Records: Payment transaction logs (order IDs, amounts, PayHere transaction references, and timestamps) are retained for a minimum statutory period (typically 5 to 7 years) to comply with Sri Lankan tax, accounting, and financial reporting regulations.
• Pending Registrations: Unverified registration attempts and temporary OTP codes stored in our pending registrations table expire automatically within 10 minutes and are purged periodically.

CampusNest implements robust technical, cryptographic, and organizational safeguards to protect your personal data from unauthorized access, loss, misuse, or alteration:

• Encryption in Transit: All communications between your web browser and our Next.js frontend and PHP REST API backend are encrypted using Transport Layer Security (HTTPS/TLS).
• Cryptographic Password & OTP Protection: All user passwords are encrypted using one-way BCrypt hashing with a cost factor of 12. Six-digit email verification OTP codes are similarly hashed with BCrypt prior to database storage, preventing exposure even in the event of a database dump.
• Stateless HMAC-SHA256 JWT Authentication: API authorization is governed by cryptographically signed JSON Web Tokens (JWT) with strict expiration limits and subject role claims.
• SQL Injection Prevention: 100% of database interactions are executed using PHP Data Objects (PDO) with parameterized prepared statements and disabled emulated prepares, eliminating SQL injection vulnerabilities.
• Role-Based Access Control (RBAC): Administrative endpoints, financial ledgers, and moderation tools are restricted to authorized administrators, strictly segregated from student and owner access tiers.

Under the Personal Data Protection Act No. 9 of 2022 of Sri Lanka, you are entitled to specific rights regarding your personal data:

• Right of Access: You have the right to request confirmation of whether we process your personal data and to obtain a copy of the data we hold about you.
• Right to Rectification: You may correct inaccurate or incomplete profile data (such as your contact number, name, or institutional details) directly through your Account Settings or by contacting us.
• Right to Erasure (“Right to be Forgotten”): You may request the permanent deletion of your personal data by using the Delete Account feature in your dashboard or by emailing our support team.
• Right to Restrict Processing: You have the right to request that we limit the processing of your data under certain circumstances, such as while the accuracy of your data is being contested.
• Right to Object: You may object to the processing of your personal data where such processing is based on legitimate interests.
• Right to Withdraw Consent: Where processing is founded on your consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Information on Automated Processing: You have the right to understand how our algorithmic Suitability Score works. The score is a deterministic, heuristic ranking calculated transparently from rent, distance, facilities, photos, contact completeness, and listing freshness. It is not used to make legal or binding determinations.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data under the PDPA, please reach out to our team:

• Email: support@campusnest.lk / contact@manuja.dev
• Phone: +94 11 234 5678
• Support Portal: campusnest.lk/support
• Location: Colombo, Western Province, Sri Lanka