Privacy

Only what a booking needs. No account is required to book, and browsing records nothing about you personally.

• Your name and email, the dates, and the item booked. You give these at checkout.
• A random identifier stored in this browser, or on your phone if you use our app. It is how your bookings are shown back to you without an account, and it is not linked to you as a person unless you create one.
• Whether a payment succeeded, its amount, and the gateway reference. Card details are never sent to this site; they are entered on the gateway.
• Which pages are visited, without cookies and without cross-site tracking. On the website, Do Not Track and Global Privacy Control are honoured by recording nothing. Our app counts a launch, a search, a page viewed and a booking, with the phone type and app version, under a random number that changes every launch and is not linked to you; you can turn this off in the app under Settings, "Count my visits".
• If you ask the on-site assistant something it cannot answer, the question is kept, with email addresses, phone numbers and long numbers removed first, so the assistant can be taught it. Nothing you type is sent to any outside service.
• A phone number, only if you choose to give one at checkout, so we and the hotel or tour operator can reach you on the day of your trip.

To take and honour the booking, to answer you about it, and to meet the record-keeping a travel operator is required to do. Nothing is sold, and nothing is used for advertising.

These providers process data on our behalf in order to run the service:

• Supabase, for the database and the booking API.
• Vercel, for hosting and delivering the site.
• VNPay, the payment gateway. It receives the amount, a reference and your IP address, and it is where card details are entered.
• The service that sends your confirmation and follow-up email: the email provider (to be supplied)
• Our own mailbox, which receives a copy of each new booking with your name and email so we can act on it.
• OpenStreetMap, which serves the map tiles and the map on each stay page. Loading a map sends it your IP address, as loading any page does.
• Google, for two files only: the Korean typeface when you read the site in Korean, and the decoder for the 3D scenes. Loading them sends Google your IP address. Nothing about you or your booking goes to Google.
• Expo, which delivers app notifications through Apple and Google when you allow them in our app. It receives a push token for your phone, the text of the notification (the trip name and its dates) and a link to the booking that carries its reference, never your name, email or an amount.
• Travelpayouts, which shows what flights to Phú Quốc cost when you search them. Our server sends it an airport code and a month, never your name, email or booking. If you tap a fare, your browser opens the partner's pages (the tp.media affiliate link, then Aviasales), which receive what any website visit sends and set their own affiliate tracking cookies, and anything you book there is with that partner, under its terms. We may earn a commission on that booking.

Booking records are kept for as long as accounting and travel-operator obligations require, then removed. the retention periods (to be supplied)

You can ask what is held about you, ask for it to be corrected, or ask for it to be deleted. A booking still to travel, or one that accounting rules still cover, cannot always be deleted immediately, and we will say so rather than quietly refuse.

Deleting an account removes the account, the notification tokens registered to it and any requests to be told when a room opens that were made with its confirmed address, at once. Bookings made with it are kept as records. One whose trip is over, or which was cancelled, and on which no payment or refund is outstanding has your name, email and phone number removed at the same moment. One still to travel keeps them until the trip has ended. One on which money is still owed, either way, keeps them until it is settled, and never more than 90 days after the trip. If you reviewed a trip, the text of the review stays published as written, under "Guest" instead of your name. Each booking keeps the random device identifier it was made with; once your name, email and phone number are gone, that identifier is not linked to you. The booking reference, dates, amounts and payment records stay, because accounting rules require them.

If you have an account, the sign-in service (Supabase) keeps its own security log of sign-ins, which can include your email address and IP address, and deleting the account does not remove that log.

Write to: a contact address for data requests (to be supplied)

No advertising or tracking cookies are set. The browser stores a random booking identifier and your language choice, and both stay on your device.