Privacy Policy

1. Who we are

RentMySpace.LK (“we”, “us”) is an online marketplace in Sri Lanka that connects people who list spaces for rent (“hosts”) with people looking to rent them (“renters”). RentMySpace.LK is operated by L. Mahagamage, Maharagama, Sri Lanka, who is responsible for the personal data described in this policy.

You can reach us about anything in this policy at rentmyspacelk@gmail.com.

2. Personal data we collect

Depending on how you use the site, we collect and store the following:

• Account details: your name, email address, phone number, and a password (stored only as a one-way hash — we cannot read it). We also store your account role (renter, host or administrator), sign-in times and whether your email is verified.
• Google sign-in: if you choose “Continue with Google”, Google gives us your name, email address and profile photo, together with the sign-in tokens needed to link your Google account. We never see your Google password.
• Profile details (optional): bio, address, city, WhatsApp number, and — for hosts who choose to provide them — bank account details used for payouts or payment instructions. Hosts decide whether bank details are shown publicly on their profile.
• Listings: titles, descriptions, addresses, map coordinates, pricing, capacity, amenities, availability and the photos you upload.
• Messages and enquiries: messages you send to hosts or renters through the platform, and the details you share when you contact a host (for example through the WhatsApp button, which opens WhatsApp with a pre-filled message).
• Bookings and receipts: booking dates and times, price, status, billing name and email, and receipt records.
• Reviews: your rating, comment and the name you submit with it. Reviews are shown publicly only after an administrator approves them.
• Wishlist: the spaces you save.
• Usage counts: we count how many times a listing is viewed and how many times its WhatsApp and reserve buttons are tapped, so hosts can see how their listing performs. These counts are attached to the listing, not to your identity.
• Payment records: when a listing fee is paid, we record the amount, currency, status, the payment provider’s order and transaction references, and the IP address from which the payment was made. We do not receive or store your full card number.
• Technical data: our hosting provider automatically records standard server logs, such as IP address, browser type and the pages requested.
• Contact: anything you send us by email.

3. How we use your data

We use your data for the purposes below. We rely on your consent (for example when you register or sign in with Google), on performing our contract with you (running your account and bookings), on our legitimate interests in keeping the platform safe, and on legal obligations. We do not sell your personal data, and we do not use it for advertising.

• To create and secure your account, sign you in and verify your email (we send one-time codes by email).
• To publish listings and let renters and hosts find and contact each other.
• To process bookings, listing fees and receipts.
• To send service emails such as verification codes, booking confirmations, receipts and new-message notifications.
• To review listings and reviews, prevent fraud and abuse, and enforce our Terms of Service.
• To give hosts basic performance figures for their listings.
• To comply with legal obligations and respond to lawful requests.

4. Who we share data with

Other users: your name, listing content and approved reviews are visible to other visitors. If you contact a host or message a user, they receive the details you send. A host’s WhatsApp number and, if the host enables it, bank details are shown on their listing.

Service providers (processors) that handle data on our behalf:

• Vercel — website hosting and server logs.
• Supabase — our database and file (photo) storage.
• Resend — sending transactional emails.
• Google — optional sign-in with Google.
• PayPal — payment processing if a listing fee applies to your listing (see “Payments” below). We may add a Sri Lankan gateway such as PayHere later, and will update this policy if we do.
• OpenStreetMap — map tiles are loaded from OpenStreetMap servers when a host places a listing on the map picker, which means your browser’s IP address is visible to them.
• WhatsApp (Meta) — if you tap a WhatsApp button, you are taken to WhatsApp, which handles your message under its own policy.

5. Where your data is processed

Your data may be processed outside Sri Lanka. In particular: Supabase stores our database and uploaded files in South Korea; Vercel hosts the website on a global network; Resend sends our emails; Google handles sign-in with Google; and OpenStreetMap serves map tiles. We choose providers with appropriate security measures and share only the data each service needs.

6. Payments

Hosts may be asked to pay a listing fee when the fee is switched on for the platform. If so, the payment is made through PayPal. PayPal collects and handles your card or account details; we never receive or store your full card number. We keep a payment log with the amount, currency, status, PayPal’s order and transaction references, and the IP address from which the payment was made, so we can confirm payments and investigate fraud or disputes.

Payments for rentals are arranged directly between hosts and renters and are not processed on the site. If we add other payment methods in future (for example PayHere), we will update this policy.

7. Cookies and tracking

RentMySpace.LK uses only the cookies needed to keep you signed in and to protect sign-in: a session cookie (which holds your login session and lasts up to 30 days, or 24 hours if you did not tick “remember me”), plus short-lived security cookies used by our sign-in system (a CSRF token and a redirect cookie).

We do not use analytics or advertising trackers. If you pay a listing fee, PayPal may set its own cookies on its payment form under its own policy.

8. How long we keep your data

• Account, profile and listing data: for as long as your account is active, and deleted when your account is deleted (see below).
• Booking, receipt and payment records: kept for as long as Sri Lankan tax and accounting law requires.
• Email verification codes: expire after a short period and are overwritten or removed once used.
• Logs and backups: our hosting and database providers keep short-term logs and backups for a limited period; deleted data is removed from backups as they expire.

9. Your rights

Under Sri Lanka’s Personal Data Protection Act No. 9 of 2022 you have the right to:

• Access the personal data we hold about you.
• Have inaccurate or incomplete data corrected.
• Have your data erased, in the circumstances the Act allows.
• Withdraw consent you have given, at any time, without affecting processing already carried out.
• Object to or ask us to restrict certain processing, and ask for an explanation of decisions made about you.
• Complain to the Data Protection Authority of Sri Lanka if you believe your rights have been infringed.

10. Exercising your rights and deleting your account

To access, correct or delete your data, or to withdraw consent, email rentmyspacelk@gmail.com from the address registered on your account. We may ask you to verify your identity first. We will respond within the period required by law.

To delete your account, email us at the address above. We will delete or anonymise your data, except records we must keep by law.

11. Security

Passwords are stored as salted hashes, traffic is encrypted with HTTPS, and access to administrative tools is restricted to authorised staff. No online service is perfectly secure, so please use a strong, unique password. If a breach affects your personal data, we will notify you and the authorities where the law requires it.

12. Children

RentMySpace.LK is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The “Last updated” date above shows the latest version, and for significant changes we will take reasonable steps to notify you, for example by email or a notice on the site.

14. Contact

Questions or requests: rentmyspacelk@gmail.com.