Privacy Policy

This Privacy Policy applies to the online marketplace available at https://camporastudent.com (the "Platform" or "Website"), operated under the brand name Campora.

Operator Status: Campora is an independent digital student accommodation marketplace owned and operated by an individual operator based in Bhubaneswar, Odisha, India. Campora is currently not incorporated or registered as a company (private limited, LLP, or corporation) under the Companies Act, 2013.

Throughout this Privacy Policy, the terms "Campora", "we", "us", or "our" refer to the individual operator of the Platform. The terms "you", "user", "student", or "property owner" refer to any individual who accesses, browses, registers with, or utilizes our Platform.

We collect personal data strictly necessary to facilitate the student housing search, account administration, communication between prospective student residents and property owners, and platform integrity.

We clearly distinguish between information required for basic account operation and optional details provided voluntarily:

A. Information Collected from Students

• Account Registration Data (Required): Full name, valid email address, mobile phone number, and account password. Password storage and hashing are handled natively by Supabase Authentication; Campora does not store or see plaintext passwords.
• Student Profile Information (Required for Bookings): College or university name, academic course/degree, and enrollment year to verify student affiliation for student-only accommodations.
• Optional Profile Details: Profile picture/avatar, preferred move-in date, room sharing preference (single, double, triple), budget range, and emergency contact details.
• Accommodation Enquiries & Booking Requests: Dates of scheduled property visits, stay duration preferences, and text messages exchanged with property owners through the Platform.

B. Information Collected from Property Owners

• Owner Identity & Contact Information (Required): Full name of the property owner or authorized facility manager, primary email address, mobile phone number, and optional WhatsApp contact availability.
• Property Listing Details (Required): Property name, accommodation category (PG, hostel, flat), gender policy (boys, girls, co-ed), precise physical address (street, locality, city, state, postal PIN code), nearby university landmarks, distance to campus, room configurations, monthly rental rates, security deposit amount, notice period, and house rules.
• Property Photographs & Media: Visual media of rooms, common areas, bathrooms, dining facilities, and exterior facades uploaded by the owner to depict the accommodation.

C. Technical Information & Operational Logs

When you access our Website, certain technical information is recorded automatically through our hosting and database infrastructure:

• Network & Device Identifiers: Internet Protocol (IP) address, browser type and version, device operating system, language preferences, and screen resolution.
• Usage & Interaction Logs: Pages viewed, referring URLs, timestamps of requests, button interactions, and error telemetry.

Campora provides two authentication mechanisms for user account creation and sign-in:

1. Email & Password Authentication: Processed through Supabase Auth. Passwords are mathematically hashed using modern salted one-way hash functions (bcrypt). Plaintext passwords are never accessible to Campora or saved in our database.
2. Google Sign-In (OAuth 2.0 / Google Identity Services): If you choose to register or log in using your Google account, Google provides a secure identity token containing your verified name, primary email address, and profile photo URL. Campora does not receive access to your Google account password, Google Drive, private messages, or contacts.

Role-Based Access: During registration, you select whether you are creating a Student account or a Property Owner account. Account roles govern permissions across our database using PostgreSQL Row-Level Security (RLS).

We believe in complete transparency regarding client-side data storage:

• Essential Local Storage (Browser localStorage): Campora uses browser `localStorage` to store authentication session keys (`sb-...-auth-token`) generated by Supabase. This keeps you logged in across browser refreshes and tab reloads. Without this storage, you would be logged out on every page reload.
• Technical Cookies & Edge Headers: Essential infrastructure cookies and HTTP headers may be set by our cloud hosting provider (Vercel) to deliver cached web assets, route traffic through optimal Content Delivery Network (CDN) nodes, and protect against Distributed Denial of Service (DDoS) attacks.
• No Third-Party Advertising Trackers: Campora does not deploy third-party advertising cookies, Facebook/Meta tracking pixels, retargeting ad networks, or commercial behavioral tracking scripts. We do not sell your web browsing history to data syndicators.

You can clear or block cookies and local storage through your browser settings. However, clearing local storage will terminate your active session and require you to sign in again.

Personal information is processed strictly for legitimate operational purposes directly tied to the student accommodation marketplace:

• Platform Operation: Publishing verified PG listings, enabling multi-attribute search (by college, city, price, and gender eligibility), and displaying accommodation features.
• Facilitating Enquiries: Transmitting student visit requests and booking inquiries to the relevant property owner.
• Account Administration: Authenticating logins, issuing password reset links, maintaining user preferences, and displaying booking histories.
• Row-Level Security Enforcement: Enforcing strict database access controls so that students can only view their own private communications and owners can only manage their own properties.
• Community Safety & Moderation: Reviewing property listings for misleading claims, preventing spam or deceptive duplicate entries, and protecting students from fraudulent representations.
• Compliance with Indian Law: Fulfilling obligations under the Information Technology Act, 2000, Consumer Protection (E-Commerce) Rules, 2020, and applicable provisions of the Digital Personal Data Protection Act, 2023.

Campora does not sell, rent, monetize, or trade your personal information. We disclose data solely in the following defined circumstances:

A. Bilateral Disclosure Between Marketplace Users

When a student submits an inquiry or booking request for a PG or hostel, the student's name, college, contact phone number, and stay preferences are shared with the property owner to allow the owner to contact the student and arrange a physical visit. Conversely, verified property owner contact details and property addresses are displayed to registered students.

B. Actual Third-Party Infrastructure Providers

Campora relies on the following third-party technical infrastructure providers to operate the Platform:

C. Legal, Regulatory & Law Enforcement Disclosures

We may preserve or disclose your information if required to do so by applicable Indian law, judicial summons, court order, or written request from authorized law enforcement authorities or government agencies in India investigating alleged fraud, cyber offenses, or safety incidents.

How Payments Work:

• Campora does not collect, hold, process, or transmit your credit card numbers, debit card numbers, CVVs, net banking passwords, or UPI PINs.
• All financial transactions—including initial token amounts, monthly room rent, utility reimbursements, food mess fees, and security deposit payments—are handled directly between the student (or student's parents) and the property owner via direct offline or peer-to-peer methods (such as direct UPI transfer, bank account deposit, or cash).
• Campora does not hold funds in escrow and cannot issue refunds on behalf of individual property owners. Always obtain a written receipt from the property owner for every payment made.

We implement rigorous technical safeguards to protect your personal information against unauthorized access, loss, or misuse:

• PostgreSQL Row-Level Security (RLS): Our database utilizes database-enforced RLS policies. Each database query is validated against the authenticated user's session ID and role, preventing users from viewing or altering another user's records.
• Encryption in Transit: All communications between your browser and Campora are encrypted using Transport Layer Security (TLS 1.2 / TLS 1.3) over HTTPS.
• Secure Cloud Storage: Uploaded property photographs and student profile pictures are stored in access-controlled Supabase Storage buckets.

Data Retention: We retain your personal data only for as long as your account remains active, as required to provide accommodation marketplace services, or as necessary to comply with applicable statutory record-keeping and fraud-prevention requirements under Indian law.

Your Right to Account & Data Deletion: You have the right to request the permanent deletion of your Campora account and associated personal data at any time.

Procedure to Request Data Deletion:

1. Send an email from your registered Campora email address to: info@camporastudent.com.
2. Include the subject line: Data Deletion Request - [Your Full Name].
3. Specify whether you are requesting complete account termination, deletion of uploaded property media, or deletion of specific profile attributes.
4. Upon verifying your account identity, we will permanently purge or anonymize your profile information from our active database within 30 days, except for minimal transaction logs that we are legally required to retain under Indian law.

In accordance with the principles of the Digital Personal Data Protection Act, 2023 (DPDPA 2023) and applicable Indian regulations, you are entitled to the following rights regarding your digital personal data:

• Right to Access Information: You may request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Updating: You may update or correct incomplete, inaccurate, or outdated personal information via your account profile settings or by contacting us.
• Right to Withdraw Consent: Where data processing is based on your consent, you may withdraw your consent at any time. Withdrawal of consent does not affect processing undertaken prior to the withdrawal, but may prevent you from utilizing certain marketplace features.
• Right to Grievance Redressal: You have the right to readily available grievance redressal mechanisms regarding our personal data handling practices.
• Right to Nominate: You may nominate an individual who, in the event of your death or incapacity, shall exercise your rights under applicable law.

Campora is designed and intended for college and university students, typically individuals aged 18 years or older, and adult property owners.

If an individual under the age of 18 (a minor) utilizes the Platform to discover student accommodation, such use must occur strictly with the involvement, guidance, and consent of a parent or lawful legal guardian. We do not knowingly collect personal data from children under 18 without parental consent. If we become aware that personal data of an unassisted minor has been collected, we will take immediate steps to delete such information.

We may periodically revise or update this Privacy Policy to reflect enhancements to our Platform, changes in our data handling practices, or amendments in applicable Indian statutes and regulations.

When updates occur, we will refresh the "Last Updated" date displayed at the top of this page. Substantial changes will be communicated via an announcement banner on the Website or by direct email notice to registered users. Continued access or use of Campora following the publication of revised terms constitutes your acknowledgment and acceptance of the updated policy.

If you have questions, feedback, concerns, or grievances concerning this Privacy Policy or our personal data handling practices, please contact our designated Grievance Contact: