Privacy Policy

Last updated: October 2026

What we collect

The email addresses of hostel owners who submit listings, the contact information they choose to publish (name, address, phone, WhatsApp, email, website, description), the email and message content of contact form submissions, and basic technical data (IP address, timestamps, browser user-agent) for security and abuse prevention.

How we use it

Owner emails are used for sign-in links and listing notifications only - never for marketing. Published listing details (everything you enter into the listing form) are visible to the public on the directory. Contact form messages are sent to the site admin and used to respond to your enquiry. Technical logs are kept for 90 days for security and abuse investigation, then deleted.

Cookies

A session cookie is used during sign-in and contact form submission to prevent cross-site request forgery. We set no advertising cookies and sell no data to anyone.

Analytics

We use analytics to see which pages travellers find useful. Nothing loads until you choose. If you decline, or if your browser sends a Do Not Track or Global Privacy Control signal, no analytics script is requested at all and no analytics cookie is set. Your choice is stored in a first-party cookie named hcl_consent for six months. Clear your cookies to be asked again.

The services in use are:

• Google Tag Manager (Google LLC), which loads our measurement tags. It may set cookies and share data with Google. Google privacy policy.
• Microsoft Clarity (Microsoft Corporation), which records anonymised session replays and heatmaps showing how pages are scrolled and clicked. Keystrokes in form fields are masked. Microsoft privacy statement.

Both process data outside Sri Lanka. We do not use either service to identify individual visitors, and neither is used for advertising on this site.

Third parties

Google reCAPTCHA v3 is used on submission forms for bot prevention - this loads scripts from Google and is subject to Google's privacy policy. We do not share any user data with third parties beyond what is necessary to send notification emails through standard mail infrastructure.

Your rights under PDPA

Under Sri Lanka's Personal Data Protection Act No. 9 of 2022, you can request access to your personal data, correction of incorrect data, or deletion of your data at any time by contacting us at contact@hostel.com.lk. Listing owners can request removal of their listing at any time and we will action this within 7 days.

Data location

All data is stored on web hosting servers operated by our hosting provider. Backups are kept in the same region.

Contact

For privacy questions or data requests, contact contact@hostel.com.lk or write to us at 208, Hill Street, Dehiwela, Sri Lanka. 10350.