Mandarin Beach Villa collects only the information needed to answer your enquiry, take and manage your booking, prepare and run your stay, and keep the website working and secure. It sells nothing to anyone, runs no third-party advertising or analytics scripts, and never sees your card details. This policy explains, in order, what is collected at each step, where it goes and how long it is kept. Last updated 15 October 2026.
Who we are
Mandarin Beach Villa is a private beachfront family villa at 57/4 Moo 2, Lipa Noi, Koh Samui, Surat Thani 84140, Thailand. The business responsible for your information is Mandarin Beach Villa FZ Ltd, Dubai, United Arab Emirates. This policy covers mandarinbeachvilla.com, the guest portal, the text and voice concierge, the booking interface made available to AI assistants, and your stay at the villa. For anything about your personal information, write to book@mandarinbeachvilla.com or message the reservations team on WhatsApp +44 7782 911911.
What we collect, and why
When you browse the website
The site uses its own first-party analytics and nothing else. It records the pages you view, the site or campaign link that brought you here, a random session identifier held in your browser for the visit, a visit counter and your acknowledgement of the privacy notice held in local storage, time on page, and what you do in the availability calendar, including the dates, nights, guest numbers and prices you look at. Our server also records your IP address and browser identifier and derives an approximate country from them, using our hosting provider’s country header where present or otherwise a lookup against ip-api.com, to which your IP address is sent for that purpose at most once a week. We use this to understand which villa information families find useful, to support direct-booking enquiries, and for security and fraud prevention.
When you contact us
Messages sent on WhatsApp pass through Meta’s WhatsApp service under its own terms; email passes through our mail provider. We keep what you send us so that we can answer and so that the team knows what has been agreed.
When you use the concierge or the voice assistant
The text of your question is sent to the artificial-intelligence provider that generates the answer, currently Anthropic or OpenAI, together with the villa’s published facts. For the voice assistant your browser performs the speech recognition; the spoken answer is produced by Google’s text-to-speech service. We log the text of each question with a hashed form of your IP address and your approximate country, never the address itself, and we do not store audio.
When you book and pay
To price and book, the site needs your dates, guest numbers, chosen package and payment option. Payment is taken on Stripe’s own secure page: your card details are entered there and never reach our server. Stripe tells us your name, email address and the status and amount of each payment, and we keep the booking record, the amounts and any payment-plan schedule. We email your confirmation and, on a payment plan, the schedule and reminders. The checkout page uses hCaptcha to block automated abuse; hCaptcha may set its own cookies.
Before you arrive: the guest portal
To register your party and prepare the villa we ask for the names and ages of everyone staying, passport details for every guest as required for guest registration in Thailand, your flights and arrival plans, dietary requirements and allergies, and your preferences for rooms, meals, children’s routines, nursery equipment, celebrations and activities. From a passport we keep the name, date of birth, nationality and expiry date; the passport number itself is stored only as a salted fingerprint plus its last characters, never in full, and the passport image is deleted 90 days after your checkout. Allergies and other health information are recorded only with the explicit consent you give on the passport step of the portal; without it a passport cannot be uploaded there.
During your stay: Guest Memory OS™
From 29 days before check-in and throughout your stay, the villa team records the preferences, requirements and service information you share, so that you do not have to tell us twice. Team members may dictate notes; the voice recording is deleted after 90 days and the written note is kept. This information is retained so that you and the people who stayed with you are recognised when you return to the estate, exactly as described in the consent you give in the portal, and it is removed when you ask us to erase it. Guest Memory OS™ is developed by AFG Holdings Ltd and runs on the villa’s own systems in Thailand.
Cameras
Exterior CCTV covers the external areas of the estate 24 hours a day; there is no CCTV inside the villa. A public beach webcam on the villa’s beachfront faces west over the sea and shows the beach and water at a distance; the hourly observation frames that support the published beach record are kept for 30 days by default. People on the public beach may appear in that wide view.
Children
Information about children, including ages, routines, dietary needs and passport details, is given to us by their parents or guardians for the purpose of the stay and is handled in the same way as the rest of the party’s information.
Who else processes your information
- Stripe, for payments and payment-plan instalments.
- Anthropic and OpenAI, for concierge answers (question text only).
- Google, for the voice assistant’s speech synthesis, text translation, map links and web fonts.
- Meta, for WhatsApp messages you choose to send.
- hCaptcha, on the checkout page.
- ip-api.com, for an approximate country from your IP address.
- Cloudflare, which synchronises the villa’s booked dates between calendars; it receives dates, not guest details.
Our systems are hosted in Thailand. The providers above may process information outside Thailand, including in the United States and the European Union, under their own safeguards.
How long we keep it
- Passport images: deleted 90 days after checkout; the registered facts remain on the booking record.
- Voice notes recorded by the team: deleted after 90 days; the written text remains.
- Booking and payment records: 12 months after your stay, unless a longer period is required by law.
- Guest profiles and stay memories: kept so that returning guests are recognised, until you ask for erasure.
- Concierge question logs and visitor analytics: 12 months, after which they are deleted by a daily retention job.
Your rights
You can ask to see what we hold about you, have it corrected, withdraw a consent you gave, object to a use, or have it erased. Erasure is a working procedure, not a promise: it removes your profile, your roster and party records, your passport records and images, and the notes and memories filed under your name; booking records are kept for accounting but are unlinked from you. Thailand’s Personal Data Protection Act applies, and the European and United Kingdom data-protection rules apply where you are protected by them. Requests go to book@mandarinbeachvilla.com.
Cookies and browser storage
The public pages set no tracking cookies. A session cookie is used only when you log in to the guest portal. The site keeps a few small items in your browser’s storage for the session identifier, the visit count, your acknowledgement of the privacy notice and the booking flow. Stripe, hCaptcha, WhatsApp and YouTube set their own cookies on their own pages.
Security
All pages are served over HTTPS. Card details exist only on Stripe. Passport numbers are fingerprinted, not stored. Access to guest information is limited to the villa team members who need it for your stay, and the application’s own logs are not publicly readable.