1. Who this notice covers
This notice explains how St Francis Bay Holiday Homes processes information when you visit this website, create an account, request or pay for a booking, or communicate with us. Questions and privacy requests can be sent to edwin@cloud-vision.com.
2. Information we collect
- Account information such as your name, email address, mobile number and encrypted password credentials.
- Booking information such as property, dates, guest numbers, messages, approval status and payment status.
- For owner administrators only, security-verification status. SMS codes are handled by the verification provider. Guests do not need email or SMS verification to request a booking.
- Technical and security data such as IP address, browser details, session records, rate-limit records and security logs.
- Communication preferences and a record of transactional or marketing messages sent.
3. Why we use it
We use information to provide and secure the service; assess and fulfil booking requests; communicate about a stay; prevent fraud and double-bookings; process payment; meet legal, tax and accounting duties; improve the website; and, only with the required permission, send marketing.
4. Legal basis and consent
Processing may be necessary to take steps at your request before a booking, perform a booking contract, meet legal duties, or pursue legitimate interests such as security and service administration. Where consent is the appropriate basis—especially optional marketing—you may withdraw it at any time without affecting earlier lawful processing.
5. Service providers
We use carefully selected providers for hosting and database services, payment processing, transactional communications, owner security verification and calendar synchronisation. These may include Heroku/Salesforce, Stripe, Twilio, Vision Studio and booking channels such as Airbnb. They receive only the information needed for their role and process it under their own terms and privacy commitments.
6. Payments
Card details are entered on Stripe’s hosted checkout and are not stored by this website. We retain the payment reference, amount, currency and status needed to administer the booking and reconcile refunds or disputes.
7. Calendar information
We exchange availability-only calendar events with connected booking channels. Public calendar feeds use opaque booking references and do not include guest names, emails, phone numbers or payment information.
8. Analytics, advertising and campaign attribution
Optional Google Analytics, Google Ads and Meta measurement runs only after you make an affirmative choice in the privacy controls and only when those services have been configured. If you consent, we may retain campaign parameters such as UTM values, Google or Meta click identifiers, the landing path and referring website with a booking request so we can understand which campaigns produce genuine bookings. Conversion events contain the property, booking stage, currency and value where applicable; they do not include your name, email address, mobile number or booking message. The site remembers your consent version and date. Use the Privacy choices button at any time to change or withdraw consent; withdrawal clears the optional campaign record and known first-party measurement cookies on this site.
9. Communications and marketing
Booking request, approval, payment, cancellation, password-reset and stay information are transactional messages needed to provide the service. Marketing is kept separate, requires the applicable permission and includes a clear way to unsubscribe. Unsubscribing from marketing does not stop essential booking messages.
10. Retention
We keep account and booking records only for as long as reasonably necessary for the purposes above, including legal, tax, dispute and fraud-prevention needs. Expired verification tokens and sessions are deleted or rendered unusable. Retention may vary where law requires a longer period.
11. Security
Safeguards include encrypted transport, hashed passwords and session tokens, restricted administrator access, rate limits, database constraints, audit records and payment webhooks verified by signature. No internet service can guarantee absolute security; please use a unique password and contact us promptly if you suspect misuse.
12. Your choices and rights
Subject to applicable law, including South Africa’s Protection of Personal Information Act, you may ask to access, correct or delete personal information; object to or restrict certain processing; withdraw consent; or complain to the Information Regulator. Some records may need to be retained to meet legal duties or resolve a dispute.
13. International processing
Some providers may process information outside South Africa. We use providers and arrangements intended to give personal information appropriate protection in the relevant jurisdiction.
14. Changes
We may update this notice as services or legal requirements change. The effective date above identifies the current version. Material changes will be communicated where reasonably required.