Privacy policy

Who we are

Spacious Bali manages private villas across Bali, Indonesia. This policy explains what personal data we collect through spaciousbali.com, why we collect it, and the choices you have.

Spacious Bali is a trading name of a company registered in Indonesia and is the controller of the personal data described here. Our registered address is Jl. Pemelisan Agung, Tibubeneng, Kec. Kuta Utara, Kabupaten Badung, Bali 80361, Indonesia. Full company registration details are available on request.

For anything about your data (a copy of what we hold, a correction, deletion, or withdrawing a consent you gave us), write to hello@spaciousbali.com. We answer within 30 days.

What we collect

Booking details. When you book one of our villas, whether directly, through Airbnb, or through Booking.com, we receive the reservation details we need to host you: your name, contact details, party size and stay dates. This flows through Hostaway, the booking platform we use to manage reservations.

Reviews. If you review your stay on Airbnb or Booking.com, we may quote that review on this site, along with the villa, when you stayed and your first name, sometimes followed by the first letter of your surname. To have your review taken off this site, email the address above.

Messages you send us. If you use a contact or villa registration form on this site, we keep what you submit: typically your name, email address, phone or WhatsApp number, and your message.

We also note how you found us: the page you first landed on, the page you were on just before the form, the website that sent you (its name only, such as google.com), any campaign tags in the link you followed, and whether you used the profit calculator. The villa registration form also has an optional question about how you heard of us. We store this with your message and use it only to see which of our efforts reach people.

Taps on WhatsApp and booking buttons. When you tap a WhatsApp button, or a button that opens our booking site at book.spaciousbali.com, we record which button it was, the villa or service it relates to, the time and basic technical details of your browser. We also store a one-way scrambled code made from your IP address (the address itself is not stored), which lets us tell automated traffic from real visitors. For a concierge request we also record the reservation it belongs to. Taps that open the booking site or our WhatsApp contact links are recorded whatever you choose in the cookie bar. That record uses no cookies and holds no name or IP address. The conversation itself happens on WhatsApp under WhatsApp's own terms, and a booking is governed by the terms shown at checkout.

Supplier applications. If you apply to become a concierge supplier, we keep what you submit: your business and contact name, WhatsApp number, email, website, the services and areas you cover, your prices, the agreement you sign (including your typed signature and the IP address it was signed from), and any brochures or price lists you upload.

Spam checks. When you send our contact form, villa registration form or supplier application (including any files you upload with it), Cloudflare Turnstile checks that the form came from a person using a browser. To do this, Cloudflare processes your IP address and technical details of your browser and device, but not what you type into the form or the files you upload. Nothing goes to Cloudflare until you start filling in one of these forms. Turnstile sets no cookies on this site, and we receive only the result of the check. The check runs whatever you choose in the cookie bar, because it protects the forms from spam. Cloudflare also uses these details to improve its bot detection, as its Turnstile privacy addendum explains.

Cookies. If you arrive through a link in a booking message, we set a small cookie so your concierge requests connect to your stay. Because guests often book months ahead, it lasts 400 days, and using the concierge renews it. If you scan the code at your villa, a separate cookie links your requests to that villa for 30 days. Staff who sign in to our admin area get a session cookie. With your agreement we also use Google Analytics 4 to understand how the site is used; it sets its own cookies and Google processes that data under its own privacy terms. Analytics only loads if you accept, and you can change your mind at any time (see “Your cookie choice” below).

We also count page visits, and a few clicks such as opening the booking site, with Vercel Web Analytics. It sets no cookies and uses no personal identifiers. It records the page, the website that sent you, your country, and your browser and device type. If you decline analytics, this counting stops too.

Ahrefs Web Analytics counts visits too, so we can see which websites and searches bring people here. It also sets no cookies and uses no personal identifiers. It records the page and its title, the website that sent you, the links you click on our pages, your country and language, and your browser, device and screen size. It never receives the reservation number in a booking link, and it stops if you decline analytics.

We measure how fast our pages load with Vercel Speed Insights. It records the load times, the page address without its query, and your device and browser type. It sets no cookies, and it runs whatever you choose in the cookie bar.

Technical logs. Like any website we process the IP address and browser details of requests, which we use to keep the site available and to limit abuse of our forms. These logs are short-lived and are not used to build a profile of you.

Your cookie choice

Essential cookies always run: without them the site cannot connect your concierge request to your stay or keep staff signed in. Analytics is optional. Google Analytics stays off until you accept it, and if you turn analytics off later, it stops straight away and its cookies are deleted from this browser. You can change your choice here at any time, and this browser remembers it.

How we use it

To host your stay, arrange the services you ask for, respond to your messages, meet our legal obligations as an accommodation provider in Indonesia, and improve the site. We do not sell your data, and we do not send marketing you have not asked for.

Who we share it with

Only what a job requires. Our drivers and service suppliers get the details needed to deliver what you booked, such as a name and pickup time. Our systems run on established providers (Hostaway for bookings, Supabase for our database, Vercel for hosting, cookie-free visit counts and page speed measurement, Ahrefs for cookie-free visit counts, Resend for the emails we send, Cloudflare for the spam check on our forms, and Google Analytics if you accept analytics cookies), each bound by their own data protection terms. Booking platforms such as Airbnb and Booking.com process your data under their own policies when you book through them. We share data with authorities only where the law requires it.

Where your data is processed. These providers operate outside Indonesia, so your personal data is stored and processed abroad, including in the United States and the European Union. We only use providers that commit to protecting it under their own data protection terms, and we do not transfer your data anywhere else without a legal basis.

How long we keep it

Booking records are kept as long as accounting and legal rules require. Form submissions, concierge request logs and the record of button taps are kept while they are useful for running the business, then removed.

Your rights

You can ask us what personal data we hold about you, ask us to correct it, or ask us to delete it where we have no legal duty to keep it. Email hello@spaciousbali.com and we will respond within 30 days. Depending on where you live, these rights may be backed by Indonesia's Personal Data Protection Law, the GDPR, or similar laws.

Changes

If this policy changes, the date at the top changes with it. Significant changes will be flagged on this page. For anything this page does not answer, contact us.