Mr. Boarding

Privacy Policy

Last updated 10 August 2026

Mr. Boarding (“we”, “us”) operates a platform connecting boarding-house operators (“operators”) in Sri Lanka with students and other room seekers (“seekers”). This policy explains what personal data we collect through the platform, why, and who it is shared with. It applies to everyone who creates an account — operators, seekers, and platform administrators.

1. Information we collect

  • Account details. Full name, mobile number and/or email address, preferred language, and WhatsApp number (operators).
  • Identity documents (operators only). A photo of the NIC, passport, or driver's licence used to verify who is publishing listings on the platform, collected at operator registration.
  • Occupant records (entered by operators). Tenant/occupant full name, NIC or passport number and photo, student ID and institution, phone number, guardian name and contact number, move-in date, and rent/payment history for the beds they occupy.
  • Listing content. Property name, address, town, map location (a latitude/longitude pin), room and bed details, pricing, house rules, and photos of the property and rooms.
  • Voice recordings (optional). If an operator uses the voice-to-listing feature, we record and temporarily store the audio to transcribe it and extract listing details.
  • Seeker enquiries. Name, phone number, optional email, and any message sent when contacting an operator or favouriting/comparing listings.
  • Account activity. Login sessions, language preference, and basic usage of the platform needed to keep it working (e.g. session cookies).

2. How we use this information

  • To create and secure accounts, and to verify who is publishing listings.
  • To operate the platform: showing listings, handling enquiries and viewings, and tracking rent for beds and occupants that operators manage.
  • To automatically process content operators submit — turning a voice note into a draft listing, and automatically screening uploaded photos before they go live (see Section 3).
  • To show a listing's approximate location on a map, and to let seekers search by proximity to a campus or institution.
  • To communicate with users about their account, enquiries, or listing status.
  • To prevent abuse of the platform — for example, limiting how many drafts an account can create per day, and rejecting audio uploads that exceed the platform's length limit.

3. Who we share it with

We do not sell personal data. We share it only with the service providers needed to run the platform:

  • Amazon Web Services (AWS). All uploaded files (listing photos, identity documents, occupant photos, voice recordings) are stored on AWS S3, and the application itself runs on AWS infrastructure.
  • AI providers (Anthropic, and/or OpenAI for speech-to-text). Voice recordings are sent to a speech-to-text provider to transcribe them, and the transcript is sent to Anthropic's Claude to extract structured listing details. Uploaded listing photos are sent to Anthropic's Claude to automatically screen for inappropriate content before a listing is approved. These providers process the content to return a result to us; they are not used to advertise to users.
  • SMS and email providers. Your mobile number or email address is passed to our SMS gateway (notify.lk) or email provider solely to deliver one-time login codes and account notifications.
  • OpenStreetMap / Nominatim. Place names and addresses you search for are sent to this geocoding service to find map coordinates. This does not include personal data — only the location text being searched.
  • Other operators (occupant reviews, once available). Where a review feature is enabled, a limited review of a former occupant may be visible to an operator that occupant is currently applying to, so operators can make informed decisions — this never includes documents or contact details, only the review itself.

We do not share personal data with advertisers, and we do not sell or rent personal data to third parties.

4. How long we keep it

We keep account and listing data for as long as the account is active. Occupant records are kept for as long as the operator's account retains them, since they form part of the operator's own rent/tenancy records. Voice recordings are kept only long enough to transcribe and extract a draft listing, and are not retained for any other purpose after that. You can ask us to delete your account and associated data at any time (see Section 5).

5. Your rights

You can ask us to access, correct, or delete the personal data we hold about you, or the data an operator has entered about you as an occupant, by contacting us using the details below. We will action reasonable requests promptly, subject to any records an operator or the platform is legally required to keep (for example, tenancy/rent history).

6. Security

  • Identity documents, NIC images, and voice recordings are stored in a private storage bucket that is never publicly reachable — they can only be viewed through a temporary, signed link generated on demand for someone authorised to see them.
  • Listing photos that are meant to be public (property/room photos) are the only files stored in a public bucket.
  • Accounts are protected by one-time passcodes (OTP) rather than passwords, and sessions can be revoked at any time.

7. Contact

Questions about this policy or requests regarding your data can be sent via WhatsApp to the platform's operator support number shown on the For Operators page.