Privacy Policy

What is collected

When you book: your name, email address, phone number, stay dates, number of guests and pets, and any message you send. Card details are entered directly with Stripe and are never seen or stored on this website.

When you complete guest registration before arrival, for each guest: full name, date of birth, nationality, identity document type and number, and a photo of that document. Optionally an email address, phone number, home address, relationship to the lead guest, and social media handles if you choose to add them.

Automatically: your IP address, used to stop abuse of the booking and signup forms, and cookies as described below.

Why it is collected

• Your booking: to take and manage your booking, arrange your stay and contact you about it — this is necessary to perform our agreement.
• Guest register and tax: Aruban law requires accommodation providers to keep a register of guests for the tourist levy. Holding these records is a legal obligation.
• Verification: knowing who is staying, protecting the property and preventing fraud — a legitimate interest.
• Improving the site: aggregated statistics about which pages and offers work, so the site can be improved. This does not identify you individually.
• Marketing emails: only with your consent, which you can withdraw at any time.

Booking and marketing are kept separate. Booking never adds you to a mailing list: subscribing requires confirming a link sent to your address, and every marketing email carries a one-click unsubscribe.

Who else can see it

No other person reads your information. There are no staff, agents or co-hosts with access — only the owner. Your data is never sold, rented or shared for anyone else’s marketing.

A few service providers process it strictly on instruction, so the site can function: Supabase (database and secure file storage), Stripe (card payments, which they receive directly), Resend (sending emails), Vercel (hosting the website) and Upstash (rate limiting, which briefly sees your IP address). Information may also be provided to the Aruban tax authorities where the law requires it.

How long it is kept

• Identity documents: identity documents and document numbers are deleted automatically 45 days after check-out. This runs as an automated daily job, not a manual promise. Afterwards only a minimal record remains — that the guest was registered — with the image and number permanently removed.
• Booking and payment records: kept for as long as Aruban tax law requires.
• Marketing contacts: kept until you unsubscribe. Your address then stays only on a suppression list, so you are not contacted again by mistake.

How it is protected

• identity data is encrypted where it is stored.
• the database denies access by default and is not readable from the public internet.
• card details never reach this website — Stripe handles them directly.
• all traffic is encrypted in transit using HTTPS.

Cookies

Essential cookies keep you signed in and remember your language, currency and cookie choice; the site cannot work without them. Anything non-essential is asked for first, and you can decline without losing access to any part of the site.

Your rights

If you are in the European Union or the United Kingdom, the GDPR gives you the right to request a copy of your data, to have it corrected, to have it deleted, to receive it in a portable format, to object to certain uses, and to withdraw consent to marketing at any time. These requests are free and are answered within one month.

Write to booking@villa-esmeralda-aruba.com. If you are not satisfied with the response, you have the right to complain to the data protection authority in your country.

Some information cannot be deleted on request where the law requires it to be kept — for example tax records relating to a completed stay.

International transfers

Aruba is outside the European Economic Area, and the providers listed above may process data in the United States and in Europe. Where data is transferred out of the EEA, it is done under the safeguards those providers offer, such as Standard Contractual Clauses.

Changes to this policy

If this policy changes, the updated version appears on this page.