Privacy Policy

1. Introduction

This Privacy Policy explains how [LEGAL ENTITY NAME] ("LendNest", "we", "us", or "our") collects, uses, stores, and protects information when you use our website, services, and neighbourhood marketplace platform.

We believe privacy is fundamental to neighbourhood trust. We only collect information necessary to facilitate safe community exchanges and never monetize personal data.

2. Information We Collect

We collect and store only the data genuinely required to operate the platform:

• Account & Profile Information: Full name, email address, password credentials (stored securely as cryptographic hashes by our authentication provider), and city.
• Community Membership & Verification Details: Your selected residential community, verification method, and any administrative verification notes or proof submitted for membership approval.
• Listing Details: Item titles, descriptions, categories, condition ratings, replacement valuations, daily/weekend rental prices, and uploaded item photographs.
• Borrow Requests & Transactions: Requested rental dates, request messages, agreed pickup locations and schedules, confirmation timestamps, and loan status events.
• Give Away Interests & Handovers: Interest messages sent to giveaway owners, recipient selection status, and arranged handover details.
• Support Inquiries: Name, email address, topic category, and message text submitted via our Contact Us form.

3. How We Use Your Information

Your information is used strictly to:

• Authenticate your account and maintain secure sessions.
• Verify residential membership to maintain a trusted community ecosystem.
• Display marketplace listings to relevant neighbours and across city-wide views.
• Enable owners and borrowers/recipients to coordinate borrow lifecycles and free giveaway handovers.
• Protect community safety by detecting and preventing abuse, fraud, or spam.
• Respond to inquiries, reports, or feedback sent to our support team.

4. Public vs. Private Information Boundary

Specific pickup instructions (e.g., "Meet by clubhouse reception desk at 6 PM") are accessible only to the confirmed owner and confirmed borrower or recipient after an exchange request is accepted.

5. Community Verification Data Processing

When you request to join a residential community, your verification notes and details are reviewed exclusively by authorised, active Community Administrators for the sole purpose of approving or rejecting residency.

Non-admin users and regular community members have zero access to other members' verification records or notes.

6. Data Sharing & Third Parties

We do not sell, rent, monetize, or trade your personal data.

We share data only with essential infrastructure service providers necessary to deliver the LendNest platform:

• Supabase: Managed PostgreSQL database hosting, file storage, and authentication services with strict Row Level Security (RLS) enforcement.

We do not integrate third-party advertising brokers, behavioral ad networks, or data brokers.

7. Cookies & Session Tracking

LendNest uses only essential first-party authentication cookies required to keep you signed in securely and protect against cross-site request forgery (CSRF).

With your permission, we use Google Analytics 4 to understand which pages people find rooms through. We ask before it loads, and if you decline, it is never loaded at all — no analytics script is fetched and no analytics cookie is written.

We send only non-identifying facts about a listing: city, locality, flat size and room type. We never send your name, email, phone number, exact address, flat number, what you wrote in an application, or anything you told us about how you live.

We do NOT use advertising cookies, Meta Pixels, or any other third-party tracking pixel.

8. Data Retention & Deletion

We retain your account data and transaction history for as long as your account remains active. If you wish to delete your account or remove personal data, you may submit a request through our Contact Us page.

9. Security Measures

We employ defence-in-depth security architecture:

• Database-level PostgreSQL Row Level Security (RLS) ensuring users can only read and mutate authorised records.
• Server-side validation for all state transitions, borrowing actions, and giveaway handovers.
• Encrypted HTTPS communication in transit and encrypted data storage at rest.

10. Your Rights & Choices

You have the right to access, update, correct, or request the deletion of your personal account information at any time. You can edit your profile details or reach out to our team for administrative assistance.

11. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect improvements to the platform. Any changes will be posted on this page with an updated "Last updated" date.