GerBnB — Privacy Policy
Data controller: Bolor khelterhii solutions LLC ("GerBnB", "we", "us") State registration number: 7293673 Registered address: Ulaanbaatar, HUD 18 khoroo, 221, 17041, Mongolia Privacy contact: privacy@mail.gerbnb.mn · +976 94012654 Effective date: 11 July 2026 · Version: 0.3
1. About this policy
1.1. This policy explains what personal data GerBnB collects, why, how long we keep it, who we share it with, that we transfer it to service providers outside Mongolia, and the rights you have. It applies to gerbnb.mn and our related apps.
1.2. We are the data controller for the personal data described here. Our contact details are above.
1.3. We ask for your consent before we collect and process your personal data, as required by the Law on Protection of Personal Data. You give consent through a clear, unticked checkbox when you create an account and when you book. You can withdraw it at any time (see §8).
2. The purposes for which we process your data
We process personal data only for these defined purposes:
- to create and manage your account;
- to operate the Platform and show listings;
- to process the 10% booking deposit and any deposit refund;
- to enable messaging between Guests and Hosts;
- to reveal the exact camp location to a Guest with a confirmed upcoming stay about 48 hours before arrival, and to send it by email or SMS (the public map shows only an approximate location — see §3);
- to confirm camp locations (the 48–72h pre-arrival check) and support safe stays;
- to vet Hosts and maintain trust and safety;
- to provide customer support and send service messages;
- to understand and improve the Platform through product analytics, error tracking, and session recordings (see §3 and §6);
- to comply with Mongolian tax, accounting, and other legal obligations; and
- to detect and prevent fraud and misuse.
3. The personal data we collect
| Category | What it includes |
|---|---|
| Account data | Name, email address, phone number, password (stored hashed), preferred language. |
| Host identity data | For Hosts: civil registration number or business registration details, needed to identify you as the accommodation provider. |
| Booking data | Dates, pricing tier, number of guests, add-ons (e.g. breakfast), booking history, the booking amount and the 10% deposit paid. |
| Communications | Messages exchanged between Guests and Hosts through the Platform, and any support correspondence with us — including in-app Support chat messages (and optional name/email you provide there) processed via PostHog (see §6). |
| Location data | Host camp GPS coordinates (provided by the Host). The public map shows only an approximate, deliberately offset location. The exact coordinates are disclosed only to a Guest with an upcoming or active booking about 48 hours before arrival, and may be sent to that Guest by email or SMS. We do not request, store, or use a Guest's device location. |
| Deposit / payment data | The 10% booking deposit is processed by our payment provider Bonum (QPay, cards, and other rails at checkout). We receive confirmation and limited transaction details. We do not store full card numbers. The remaining price of the stay is paid directly to the Host off-platform and is not processed or recorded by us as a payment. |
| Technical, usage & product-analytics data | IP address, device and browser type, language, log data, cookie identifiers, in-product events and error logs, and session recordings with sensitive content masked (via PostHog — see §6). |
We do not intentionally collect "sensitive personal data" (such as data on health, religion, ethnicity, or biometric data). Please do not send such data through the Platform.
4. The legal basis for processing
We rely on:
- your consent, given as described in §1.3 (the primary basis under the Law on Protection of Personal Data);
- performance of a contract — processing necessary to deliver a booking you have made; and
- legal obligation — where Mongolian law requires us to keep records (e.g. tax and accounting).
5. Who we share your data with
5.1. With the other party to your booking. When you book, we share the booking details and the contact information needed to complete the stay with the relevant Host (and the Host's details, including the exact location about 48 hours before arrival, with the Guest). Hosts and Guests must use this only to fulfil the booking.
5.2. With our service providers (processors / sub-processors). See §6. They may only process data on our instructions and to provide their service.
5.3. With authorities where we are legally required to, or to protect rights, safety, or prevent fraud.
5.4. We do not sell your personal data.
6. International transfer of your data
6.1. To run the Platform we use service providers whose servers are located outside Mongolia. This means your personal data is transferred abroad. Under Article 14 of the Law on Protection of Personal Data, we make this transfer on the basis of your consent, which you give when you accept this policy.
6.2. The recipients of cross-border transfers, the data they receive, and their role are:
| Provider | Role | Data transferred | Location |
|---|---|---|---|
| Supabase | Database, authentication, image/file storage | Account, host, booking, message, and uploaded content data | Singapore |
| Vercel | Website and app hosting / content delivery | Technical & usage data, content served to your browser | Outside Mongolia (global edge) |
| Resend | Transactional & service emails (incl. sending exact location) | Name, email address, message content of service emails | Outside Mongolia (US) |
| PostHog | Product analytics, error tracking, session recordings (sensitive content masked), and in-app customer Support chat | Technical & usage data, in-product events, error logs, masked session recordings, cookie identifiers; Support ticket messages and optional name/email; session/page context linked to tickets | Outside Mongolia (US) |
| Twilio | SMS notifications (incl. sending exact location by SMS) | Phone number and SMS message content | Outside Mongolia (US) |
6.3. Our payment provider Bonum processes the 10% deposit; QPay and card networks (e.g. Visa, Mastercard) may process some transaction data abroad to complete your deposit payment.
6.4. By accepting this policy you consent to these transfers. If you do not consent, we cannot provide the Platform, because it cannot operate without these providers. We choose reputable providers and require them to protect your data.
7. How long we keep your data
| Data | Retention |
|---|---|
| Account data | While your account is active, then up to 12 months after closure. |
| Booking & deposit records | For the period required by applicable Mongolian tax and accounting law. |
| Messages | While your account is active, then 6 months. |
| Support correspondence | 24 months. |
| Technical & log data, analytics, session recordings, cookies | Up to 12 months. |
When a retention period ends, we delete or anonymise the data.
8. Your rights
8.1. Under the Law on Protection of Personal Data you may:
- give or withdraw consent to processing (withdrawal does not affect processing already done);
- access the personal data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete your data (subject to legal retention duties);
- object to or restrict certain processing; and
- ask for a portable copy of data you gave us.
8.2. To exercise any right, contact us at privacy@mail.gerbnb.mn. We will respond within a reasonable time.
8.3. If you believe we have mishandled your data, you may complain to the National Human Rights Commission of Mongolia (NHRC) or another authorised body.
9. Security and breach handling
9.1. We use reasonable technical and organisational measures to protect your data (including access controls and encryption in transit). No system is perfectly secure.
9.2. We keep an internal record of our processing activities and of any data-breach incidents, in line with the Law on Protection of Personal Data.
10. Children
The Platform is for users 18 and over. We do not knowingly collect data from children. Where a user is a minor or legally incapacitated, consent must be given by their legal representative. If you believe a child has given us data, contact privacy@mail.gerbnb.mn and we will delete it.
11. Cookies
We use a small number of cookies and similar technologies, including for the analytics and session recording described above. See the separate Cookie & Consent Notice for details and how to control them.
12. Changes and contact
12.1. We may update this policy and will post the new version with a new effective date; we will tell you about material changes.
12.2. Privacy contact: privacy@mail.gerbnb.mn · +976 94012654 · Ulaanbaatar, HUD 18 khoroo, 221, 17041, Mongolia.