Privacy policy.

Last updated August 31, 2026.

1. Who this is about

MOYA Khaokho, a small hotel in Khao Kho, Phetchabun, Thailand, is the data controller for the information described here. This policy covers information collected through moyakhaokho.com and the booking process — not general web browsing beyond what's described in §5.

2. What we collect

When you make a booking, we collect the details you type into the guest form: full name, email address, phone number, and the billing address fields on that form (kept as part of your booking record, used for the reservation and receipt — not verified or checked against your card). Any special requests you add are stored with your reservation.

We never see or store your full card number, expiry, or CVC — payment is handled entirely by Stripe on its own secure checkout page. Stripe has its own privacy policy governing what it collects to process the charge.

If you email or call us directly, we keep that correspondence like any small business would, to answer you and to have a record of what was agreed.

3. How we use it

• To create and hold your reservation, and to assign a specific room.
• To send your booking confirmation, receipt, and — if applicable — a cancellation notice.
• To contact you about your stay (a question about your arrival time, a change we need to tell you about).
• To keep the accounting/booking records a small hospitality business is expected to keep.

4. Who we share it with

We use a small number of services to run the booking system, each only for what it's named for:

• Stripe — processes your payment. We receive confirmation that payment succeeded and basic transaction details, not your card number.
• Google Calendar — an internal scheduling tool MOYA staff use to see which rooms are booked. A confirmed booking's name, phone, email, dates, and room are written there so staff can manage the property day to day.
• Gmail / Google Workspace — sends your confirmation, receipt, and cancellation emails via SMTP.

We don't sell guest information, and we don't share it with anyone else for marketing purposes.

5. How long we keep it

We keep a guest's contact details (name, email, phone) for 24 months after their most recent checkout. After that window, if there's no more recent or upcoming stay on file, that contact information is anonymized — the underlying reservation record (dates, room, amount paid) is kept for our accounting history, but is no longer linked to an identifiable name, email, or phone number. This is a manual/periodic process on our side (`backend/scripts/purge-old-guest-data.js`, run by staff), not instant on the 24-month mark.

Our own first-party site analytics (§6) is capped and rolling — it isn't tied to a guest identity in the first place, so there's nothing to individually delete there.

6. Cookies & analytics

This site doesn't use advertising or cross-site tracking cookies, and doesn't run Google Analytics or any third-party tracking script. We do run a small first-party pageview/booking-funnel counter (which pages get visited, how many searches/checkouts/confirmations happen) — it records a page path and an event name, nothing that identifies you, and it doesn't use a cookie or any per-visitor identifier. It exists purely to tell us whether the site is working, not to profile visitors.

7. Security

Card payment happens entirely on Stripe's own secure checkout — it never touches our servers. Access to booking records is restricted to a single admin credential held by MOYA staff. As with any small operation, no system is perfectly secure, but we don't store anything more sensitive than we need to run a booking.

8. Your rights

You can ask us what information we hold about you, ask us to correct it, or ask us to delete it (subject to what we're required to keep for accounting/legal reasons) — write to moyavillakhaokho@gmail.com and we'll handle it directly; there's no self-service portal for this yet given the size of the property.

9. Children

This site and booking process are not directed at children, and we don't knowingly collect information about children beyond a guest count on a family booking.

10. Changes to this policy

We may update this page as the property, its tools, or the law change. Significant changes will be reflected here with an updated date at the top.

See also our Booking Terms & Cancellation Policy.