Privacy policy

The booking form asks for your first and last name, email address, phone number and country, and optionally special requests. We also record the stay (property, dates, number of guests, price and currency) and that you accepted the Sumberkima Hill Agreement.

We use this information to make and manage your booking, to contact you about your stay, and for our accounting. Your booking is made in Lodgify, the booking system we use, which also sends the payment page. Card payments are made on that page and handled by Lodgify's payment provider: card details never reach our website or our team.

When you enter your email address and continue to the next step, we save the details you have entered, together with your IP address and browser details, before the booking is made. If you do not finish, we may send you one email with a link to continue where you left off. The link works for 7 days. We also save the identifiers that Google Analytics and Meta stored in your browser, so that when your booking is paid we can tell them which visit and advert it came from (see analytics and advertising).

If you tick the box to receive recommendations, we also add your name and email address to our mailing list, with a record of when and how you agreed. Every email has a link to stop them, or write to sumberkimahill@gmail.com.

The contact form sends your name, email address and message to our team by email so we can answer you. Reviews you send through the review form, with the name, email address, country and stay details you give, are stored and checked by our team before any are published on the website.

If you message us on WhatsApp, WhatsApp's own privacy policy also applies.

If you ask an AI assistant such as Claude or ChatGPT about a stay and it uses our connector, the assistant sends us the dates, number of guests and what you are looking for. It sends your name, email address, phone number and country only if you ask it to fill in the booking form for you. We keep those details for 3 days so the booking form can be filled in, and then delete them automatically.

We record which tools are used, the stay asked about and which assistant asked, without names or contact details, to keep the connector working well. What you say to the assistant is handled by the company that provides it (for example Anthropic or OpenAI) under its own privacy policy; we receive only what the assistant sends to our connector.

When you use the website, we and the services below collect information about your visit: the pages you view, how you arrived (for example from an advert or a search), your device and browser, your approximate location from your IP address, and what you click. We use it to see how the website is used, fix problems, and measure our advertising.

• PostHog (hosted in the EU): website analytics. When we are investigating a problem, it may also record visits to replay them, with what you type hidden.
• Google Analytics and Google Ads: website analytics and measuring adverts. When your booking is paid, we send Google the booking value, a booking reference and the villa, together with your email address, phone number and name in scrambled (hashed) form and your country, so Google can match the booking to an advert you clicked.
• Meta Pixel and Meta Conversions API: measuring adverts on Facebook and Instagram. When your booking is paid, we send Meta the booking value, a booking reference and the villa, together with your email address, phone number, name and country in scrambled (hashed) form and the IP address and browser details from your booking, so Meta can match the booking to an advert you saw.
• Microsoft Clarity: recordings of how visitors scroll and click, used to improve the website.
• Vercel Analytics: page speed and visit counts, without cookies.

Scrambled (hashed) means the details are turned into a code before they leave our server; Google and Meta can only match that code to an account they already know, not read your details from it.

The website stores small files in your browser (cookies and local storage) for these services, to remember how you first arrived (for 90 days) and to show prices in your currency (for 30 days). You can delete or block them in your browser settings; the website still works without them.

We do not sell your information. Besides the services above, these process it for us:

• Lodgify: our booking system and payment pages.
• Website hosting and database providers: host the website and store unfinished bookings, reviews, mailing list consent, copies of bookings, and short-term data such as details an AI assistant hands over (kept 3 days).
• Email providers: send the website's emails and handle our team's email.

Some of these companies store information outside Indonesia, mostly in the European Union and the United States. We may also share information when the law requires it, for example with tax authorities or the police.

• Bookings: as long as needed for your stay and then as long as Indonesian accounting and tax law requires.
• Unfinished bookings and reviews: until you ask us to delete them.
• Mailing list: until you unsubscribe; we keep the record of your consent.
• Details handed over by an AI assistant: 3 days.
• Analytics: as long as each service keeps it under the settings we have chosen.

You can ask us for a copy of the personal information we hold about you, ask us to correct or delete it, withdraw a consent you gave, or object to how we use it. Write to sumberkimahill@gmail.com; we answer within 30 days. We may need to keep some information, such as bookings, where the law requires it. If you are not satisfied with our answer, you can complain to the data protection authority where you live.

When we change how we use personal information, we update this page and the date at the top.