Privacy Policy

1. Information we collect

We collect information that you provide directly, information collected automatically when you interact with our website, and information from trusted third parties acting on our behalf.

1.1 Information you provide

• Identity & contact data: full name, email address, phone number, postal address, and country of residence, collected through our inquiry form, booking flow, and customer correspondence.
• Reservation data: arrival and departure dates, number of guests, room or experience selections, dietary restrictions, accessibility needs, and any other notes you share to help us tailor the stay.
• Payment data: we do not store full payment card numbers on our servers. Card details are entered directly into our PCI-DSS Level 1 payment processors (Stripe and PayPal); we receive only a token plus the last four digits, expiration month, and a truncated authorization response for our records.
• Identity verification: for select bookings we may request a copy of a government-issued ID at check-in to comply with French Polynesia hospitality registration requirements. Copies are retained no longer than legally required.

1.2 Information collected automatically

• Device & usage data: IP address, approximate location (city or region only), browser type, operating system, referring URL, pages visited, session duration, and aggregated interaction data.
• Cookies & similar technologies: first-party cookies for essential site functions and consented third-party cookies for analytics and marketing. See Section 4 below.

1.3 Information from third parties

When you book through a partner channel (such as Airbnb or Vrbo) and later interact with us directly, we may receive the contact and booking information that channel shared with us, strictly for the purpose of servicing your reservation.

2. How we use your information

We use the information we collect to:

• process bookings, deposits, balances, and refunds;
• communicate confirmations, pre-arrival logistics, and on-property updates;
• provide concierge services and coordinate experiences with our partners;
• respond to inquiries submitted through the contact form;
• improve the website, content, and offers based on aggregated analytics;
• send transactional and, where permitted, occasional marketing emails;
• prevent fraud, abuse, and unauthorized access;
• comply with our legal, tax, and accounting obligations.

3. How we share information

We do not sell your personal information in the conventional sense. Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), certain analytics or advertising cookie data may be treated as a “sale” or “share”; California residents may opt out at any time (see Section 6.4 below).

We disclose information to a limited number of trusted third parties:

• Stripe, Inc. — payment processing. Stripe's privacy practices are available at stripe.com/privacy.
• PayPal, Inc. — alternative payment processing. See paypal.com/us/legalhub/privacy-full.
• Resend, Inc. — transactional email delivery (booking confirmations, password resets, contact-form notifications).
• Vercel, Inc. — website hosting, edge functions, and content delivery. Server logs may include truncated IP addresses.
• Sanity.io — headless CMS hosting editorial content. Visitor data is not stored in Sanity.
• Google LLC (Google Analytics 4). — aggregated web analytics. IP anonymization is enabled.
• Hotjar Ltd. — session replay and heatmaps, configured to mask personal data fields by default.
• On-island experience partners. — when you book a snorkeling tour, sunset cruise, or private chef dinner we share your first name, party size, dietary notes, and arrival point with the relevant operator, and only what is strictly needed to deliver the experience.
• Professional advisors (lawyers, accountants, auditors) and government authorities when required by law, subpoena, or to enforce our Terms of Service.

3a. Affiliate links

Our Getting Here page includes a flight search tool that hands you off to Skyscanner in a new tab. When you book a flight after clicking that link, we may earn a small commission from Skyscanner at no extra cost to you. We do not load Skyscanner's tracking scripts on our own pages, and clicking the link is the moment you choose to share data with them — at which point their own privacy policy applies.

4. Cookies and similar technologies

We use four categories of cookies:

• Strictly necessary: required for the site to function (language preference, cart contents, fraud detection). These cannot be disabled.
• Preference: remember your locale, currency display, and cookie consent decision.
• Analytics: set only with consent — used to measure traffic and improve the site (Google Analytics 4, Hotjar).
• Marketing: set only with consent — used to measure the effectiveness of paid campaigns (Meta Pixel, Pinterest Tag).

You can adjust cookie preferences at any time via the “Cookie preferences” link in the website footer. Disabling analytics or marketing cookies will not impact your ability to make a booking.

5. Data retention

We keep personal information only as long as necessary to fulfil the purpose for which it was collected and to comply with our legal obligations. As a guide:

• booking records: 10 years (French Polynesia commercial code);
• marketing email subscriber data: until you unsubscribe, plus 30 days;
• analytics data: 14 months at most (Google Analytics 4 default);
• customer service correspondence: 3 years from the last contact.

6. Your rights

Depending on where you live, you may have the following rights:

6.1 Right to know and access

You may ask us to confirm whether we process personal information about you and to provide a copy in a portable format.

6.2 Right to correction

You may ask us to correct inaccurate or incomplete information we hold about you.

6.3 Right to deletion

You may ask us to delete personal information, subject to legal retention requirements (e.g., tax records).

6.4 California-specific rights (CCPA / CPRA)

California residents have additional rights, including the right to opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising, the right to limit the use of sensitive personal information, and the right to non-discrimination for exercising any of these rights. You may exercise these rights through the “Do Not Sell or Share My Personal Information” link in the website footer, or by emailing the address in Section 9.

6.5 Authorized agents

You may designate an authorized agent to submit a request on your behalf. We will require written verification of the agent's authority and may contact you to confirm the request.

7. Children's privacy

Our website is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA). If you believe a child has provided us with personal information, please contact us at the address in Section 9 and we will delete it promptly.

8. International data transfers

Villa Paradise Tahiti operates from French Polynesia. Several of our service providers are located in the United States and the European Union. By using our website or booking a stay, you understand that your personal information will be processed in jurisdictions outside your country of residence. Where required, we rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms to provide an adequate level of protection.

9. How to contact us

For any privacy-related question or to exercise the rights described above, please write to:

Villa Paradise Tahiti — Privacy
Email: villaparadisetahiti@gmail.com
Postal: Punaauia, Tahiti, French Polynesia

We will respond within 45 calendar days of receiving a verifiable request, as required by the CCPA. Complex requests may be extended by an additional 45 days with notice.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The revised version will indicate a new “Last updated” date at the top of the page; material changes will be flagged with a notice on the homepage for at least 30 days.