Privacy notice
Notice version: v3-2026-10-19 · Updated October 19, 2026
This is a plain-language project notice for the DormFinder school-project MVP. It explains how information is used in this build. It is not legal advice or a substitute for a complete privacy policy reviewed before public launch.
What information may be collected?
- Account details such as name, email address, owner username and contact number, account role, policy acceptance records, and login-related records.
- Student email-verification tokens and confirmation timestamps. Student ID uploads and manual student document review are not required.
- Owner verification documents: Government ID and Business Permit, plus property-specific verification documents.
- Property applications, categorized dorm/room/bathroom photos, property-specific Government ID and Business Permit, and optional ownership/authorization, FSIC, or sanitary permit documents.
- Dorm listing details, addresses and coordinates, messages exchanged through DormFinder, reservation requests, and payment transaction references/statuses.
- If you start in-site navigation, your device location is sent to the public OSRM foot-routing service to calculate and update a route. DormFinder does not persist your live location.
- Basic security and audit details such as action timestamps and IP address recorded by the application.
Why does DormFinder use this information?
Information is used to manage accounts, review eligibility, reduce misleading listings, help seekers find accommodation, allow seekers and owners to communicate, manage reservations, support transaction status tracking, and investigate misuse or technical problems.
Who can see verification documents?
Verification files are stored in a private directory outside the normal public web directory. Account-verification documents are accessible to the account owner and authorized administrators. Property-specific verification documents are accessible only to authorized administrators. Property photos are separate from documents, stored in a web-protected path, and may be displayed with an approved, paid public listing. Administrators should access private documents only when needed for review and should not download, copy, or share them unnecessarily.
What does “verified” mean?
Automated checks validate basic file type, size, and integrity. An administrator then reviews readability, information matching, current validity, and visible inconsistencies. “Verified by DormFinder Administration” records a review decision; it does not guarantee that a document is authentic or replace checks with the issuing authority.
External services
The homepage uses Leaflet with OpenStreetMap map tiles. When you start live navigation, your current location is sent to the public OpenStreetMap routing service; the service is shared, has no service guarantee, and may process request data under its own policies. Other address-search features may use Google Maps Platform when configured. New checkout flows use Xendit test mode only when explicitly configured; available payment methods, including any over-the-counter method, depend on the merchant configuration. Old PayMongo reservation records remain supported. Do not use real personal or payment information in development tests.
Storage, access, and retention
New document submissions record the privacy-notice version and the time consent was submitted. The current MVP does not yet implement an automatic document-retention/deletion scheduler or a self-service data deletion workflow. Before production deployment, the project owner must define a lawful retention schedule, access-control procedure, incident response, and process for privacy/data requests; then have these reviewed by an appropriate privacy/legal professional.
Safe testing
Use synthetic sample documents during development whenever possible. Never commit IDs, permits, API keys, passwords, or private uploads to a source repository. If you believe a document was exposed or accessed improperly, restrict access immediately, preserve relevant security logs, and notify the responsible project administrator.