Privacy Policy

When you create an account: your name, email address, phone number, National Registration Card (NRC) number, role (student or landlord), and for students, your campus and city.

When you book: the room and property, your move-in date, the deposit amount, the mobile money number used, the payment method and the payment reference returned by the provider. We never see or store your mobile money PIN.

If you are a landlord: your property address, its geographic coordinates, photos you upload, pricing, availability and payout details.

Automatically: basic technical data needed to serve and secure the site, such as your session cookie and server request logs.

Your password is never stored in readable form. Authentication is handled by Supabase Auth, which stores only a cryptographic hash.

• To run your account and bookings, matching students to rooms, confirming deposits, and showing your dashboard.
• To verify identity and prevent fraud, NRC, phone and email are each unique per account, which stops duplicate and impersonation accounts.
• To take payment, passing the amount and your mobile money number to MTN or Airtel to raise the collection request.
• To keep students safe, maintaining the emergency placement roster described below.
• To send service messages, booking confirmations, and SMS rent reminders before a due date.

We do not sell your personal data. We share it only in these cases:

• The landlord of a room you book, your name, contact number and move-in date, so they can let you in and reach you.
• Your university's off-campus official, a compliance-scoped safety roster containing name, campus, property address, campus proximity, move-in date and an emergency contact number. This roster never includes NRC numbers, payment references or deposit amounts.
• Mobile money providers (MTN, Airtel), the phone number and amount needed to process your deposit.
• Our infrastructure providers, Supabase (database, authentication and file storage) and Vercel (application hosting), who process data on our instructions.
• Law enforcement or regulators, where we are legally obliged to disclose, or where disclosure is necessary to protect someone's safety.

• All traffic is encrypted in transit over HTTPS, and data is encrypted at rest by our database provider.
• Row-level security is enforced in the database, so one user's records cannot be read by another even if the application layer is bypassed.
• Sensitive actions, confirming a payment, moderating a listing, reading the safety roster, are restricted to specific administrative roles rather than “any admin”.
• Payment status is written only by trusted server-side routines, so a student cannot mark their own deposit as paid.

• Account data, for as long as your account is open.
• Booking and payment records, retained after account deletion where we must keep them for financial, tax or dispute purposes.
• Safety roster entries, kept for the duration of the placement and a short period afterwards, then removed.

When you delete your account from your account settings, your profile and personal details are removed and your listings are taken down.

Under the Zambian Data Protection Act No. 3 of 2021 you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased where we have no legal reason to keep it;
• object to or restrict certain processing; and
• complain to the Data Protection Commissioner if you believe we have mishandled your data.

To exercise any of these, email lisheboelvis@icloud.com. We will respond within the period required by law.

We use only the cookies required to run the service, principally a session cookie that keeps you signed in. We do not use advertising or third-party tracking cookies.

If we change how we handle personal data we will update this page and the “last updated” date, and notify you in the app or by email where the change is material.