Privacy Policy

This policy explains how 2nd Home Rooms ("we", "us") handles personal information when you visit our website, create an account, list a property, or contact us. It should be read with our Terms of Service.

We are the controller of the information described here. Our contact details are at the end of this policy.

Information you give us

• Account details: your name, email address and a password. Passwords are stored only as a one-way hash.
• Google sign-in: if you sign in with Google we receive your name, email address and profile picture from Google.
• Host and business details: business name and address, city, contact number, photos, Google Maps or Google Business links, location guide, and the listings and packages you publish.
• Reviews you write, including the name shown with them.
• Messages you send us, and what you tell us when you ask for help or for host access.

Information collected automatically

• Activity on listings: when a property or host page is viewed, or a guest taps to contact a host. We record this against a random visitor key, not your name, so hosts can see how their listings perform.
• Technical data such as browser type, device, pages visited and approximate region, collected through our hosting provider and privacy-friendly analytics.
• Security data such as sign-in attempts and one-time verification and password-reset tokens.

Calls or messages you make to a host happen between you and the host. We do not see them, and we do not receive your details unless you send them to us.

• To create and secure your account, verify your email and reset your password.
• To show listings, reviews and host details, and to let guests reach hosts.
• To review and approve hosts, properties and packages.
• To respond to your questions and support requests.
• To understand how the Platform is used, fix problems and improve it, including giving hosts view and contact counts for their own listings.
• To prevent fraud, abuse and misuse, and to enforce our Terms.
• To meet legal, tax and regulatory obligations.

We do not sell personal information. We share it only in these situations:

• Publicly: reviews, and host profile and listing details including the business contact number a host chooses to publish, are visible to anyone visiting the Platform.
• Service providers who help us run the Platform, under appropriate safeguards. These include website hosting and analytics (Vercel), image storage and delivery (Cloudinary), Google (sign-in and maps), our database provider, and email delivery for verification and password-reset messages.
• Authorities, advisers or courts when the law requires it, or to protect the rights, safety and property of our users, the public or us.
• A successor business, if 2nd Home Rooms is ever merged with or acquired by another organisation. We would tell you if your information became subject to a different policy.

• Sign-in cookie: a secure session cookie keeps you signed in. It is essential, so the Platform can't work for signed-in users without it.
• Saved stays and preferences: stays you save are kept in your own browser's local storage on that device, not in your account. Clearing site data removes them.
• Analytics: we use Vercel Web Analytics, which measures visits without tracking you across other sites.

We do not use advertising cookies. You can block or delete cookies in your browser settings, but you may then be unable to sign in.

We keep personal information for as long as your account is active and as long as needed for the purposes above. After that we delete or anonymise it, except where we must keep it for security, dispute resolution, or legal and tax reasons.

One-time verification and password-reset tokens expire quickly and are stored only as hashes. Reviews and listing content may be removed with your account, or kept in anonymised form if needed for the integrity of the Platform.

We use technical and organisational measures appropriate to the risk. These include hashed passwords, encrypted connections, expiring single-use tokens, role-based access so staff and hosts only see what they need, and review of host and listing submissions.

No online service can promise perfect security. Please use a strong, unique password, and tell us straight away if you suspect your account has been compromised.

You can update your name, password and host details from your account. Subject to applicable Sri Lankan law, including the Personal Data Protection Act, No. 9 of 2022, you may also ask us to:

• Give you a copy of the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your information or close your account.
• Stop or limit certain uses, or withdraw consent you have given.

To make a request, contact us from the email address on your account so we can confirm it is you. We aim to respond within a reasonable time, and will explain if we are unable to meet a request in full.

The Platform is for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

Some of our service providers store or process data outside Sri Lanka. Where that happens we take steps to make sure your information remains protected.

We may update this policy from time to time. We will change the date at the top of the page, and for significant changes we will take reasonable steps to let you know.

For privacy questions or requests, email hello@wigerlabs.com or use our contact page. You can also write to us at 40/2, Rathnapura Road, Munagama, Horana.