Data and purposes
1. Data we collect
- Contact data: name, phone or WhatsApp number, and optional email.
- Booking data: selected property, arrival and departure dates, guest count, and notes.
- Owner applications: area, property type, room count, listing link, and notes.
- Academy applications: country and selected level.
- Inquiries: subject and message.
- Payment proof data: the file, original name, detected type, size, transfer method, and booking reference.
- Limited security and operational data such as submission time, language, originating page, and administrator login records.
2. Why we use it
- Review and follow up booking requests.
- Link payment proof to the correct booking and review it.
- Assess property-management applications and contact owners.
- Review Academy applications and inquiries.
- Protect the Admin Dashboard, prevent abuse, and record status changes.
Storage and access
3. Delivery to administration
Email is not used to deliver public forms or notify administration. Data is stored in the server database and appears in a protected Admin Dashboard. Success is shown only after storage is confirmed.
4. Payment proof files
Payment proofs are stored in a private, non-publicly browsable directory with randomized names. They can be opened only through an authenticated administrator session. Files that fail type or size checks are rejected.
5. Authorized access
Access is limited to four approved administrator accounts that can be disabled. The platform records the administrator responsible for status updates and notes. The selected hosting or infrastructure provider may process data only as needed to operate and protect the service, under its terms and the owner’s configuration.
6. Security measures
- Strong password hashing with no passwords in the public bundle.
- HTTP-only, SameSite-protected administrator sessions.
- Login throttling and security tokens for administrative changes.
- Browser-side and server-side validation.
- Private payment files with format, size, and path restrictions.
- Browser security headers and persistent status history.
Retention and rights
7. Retention
Records are retained only as long as needed to process the request, serve the relationship, and meet applicable legal, accounting, or security obligations. Before commercial launch, the owner must approve a documented retention and deletion schedule for each jurisdiction and record category; this version does not promise an automatic deletion process that is not enabled.
8. Correction and deletion requests
A data subject may use the contact form and quote the reference number to request correction, ask about retention, or request deletion where the law permits. Identity must be verified before action is taken.
9. Cookies and local storage
The public website uses local storage for language and saved-property preferences. The Admin Dashboard uses a necessary protected session cookie. No analytics or advertising tracking is enabled in this release.
10. Hosting, transfers, and review
Storage location and any international transfer depend on the hosting provider selected by the owner at deployment. The provider, data location, and applicable transfer mechanism must be documented, and a qualified lawyer must review this policy before commercial operation.