Dream Stay Bali — Privacy Policy
Effective date 2026-10-15 · Version 2026-10-15
Marketing consent version 2026-10-15
This policy covers membership, website use and the booking information displayed on this website. The separate Bali Shorts TikTok integration has its own policy. This policy describes processing; viewing it or browsing the website is not blanket consent to every use of your data.
1. Data and purposes
| Category | Data | Purpose |
|---|---|---|
| Membership (required) | Email, name, confirmation of age 14+, member identifier, signup and last-sign-in dates, language setting | Email verification, account identification and management, member benefits and service language |
| Mobile number (optional) | Phone number with calling code and selected country code | SMS promotions only if SMS consent is granted; providing a number alone is not marketing consent |
| Security and consent records | Code-request email, IP, request/expiry/use times and failed attempts; sign-in/session times, IP and browser information; consent choices, document version, source and time, IP and browser information | Sign-in, abuse prevention, account security and recording consent or withdrawal |
| Booking lookup | Guest/booking email and relevant reservation code, villa, channel, dates, guest count, booking/stay status, amount/currency and booking date supplied by Hostex | Match bookings to the verified member email and display their reservation history |
| Website use and preferences | Language/currency cookies; analytics cookies and identifiers, page views, link clicks, browser/device information and technical connection data when analytics is enabled | Remember display preferences and understand website use; see the cookies section |
| Enquiries | Name, phone/account and message content you send via WhatsApp, Instagram or email | Responding and booking assistance |
We collect information you submit, records generated during authentication and consent changes, and reservation information supplied by Hostex. For booking lookup, we fetch reservation lists and match the guest email to the verified member email. A co-guest does not see the booker's price or reservation code.
To find a member's reservations, the reservation list of our villas, including bookings by guests who are not members, is processed temporarily. Only the email addresses and the reservation details shown on My Page are kept, for up to five minutes; phone numbers and other guest details are discarded on receipt.
2. Required consent and refusal
The signup form requests consent to membership-related collection and use separately from optional marketing. You may refuse the required consent, in which case account creation and member-only services are unavailable. Public villa information and non-member booking remain available. We refuse membership for children under 14 and do not collect a date of birth to support the age confirmation.
Required membership processing can be withdrawn by account withdrawal. For access, correction, deletion or restriction of processing, contact the address below; a request will be handled under applicable law rather than treated as an automatic waiver of your rights.
Retention and deletion details3. Optional marketing consent
Purpose: sending deals, open-date offers and other promotional information. Data used: your email for email messages, or your phone number and calling/country code for SMS. Choose each channel separately; neither is selected by default.
Promotional messages are marked '(Ad)' and state the sender, contact details and how to opt out. Promotional SMS is not sent between 21:00 and 08:00 in the recipient's local time.
If you consent to SMS, we send one welcome SMS with your member code (coupon) after signup; if you sign up between 21:00 and 08:00 your local time, it is sent at 08:00. To stop SMS, call the free opt-out number 080-600-5653 (from Korea) or change it on My Page.
Use for the selected channel lasts until you withdraw that channel's consent or leave membership. You have the right to refuse; refusal does not affect signup, member benefits or booking. Change or withdraw each channel on My Page at any time. Essential authentication and reservation messages may still be sent. Historical consent records have the separate retention status described below.
Every two years from the day you consented to promotional messages (checked weekly), we email you that you consented; if you do nothing, your consent stays in effect. Each time you give, refuse or withdraw marketing consent, we email you the sender, the date and the result.
Manage marketing choices4. Retention and account withdrawal
| Record | Period and handling |
|---|---|
| Membership profile | While membership is active. At withdrawal, name and phone are deleted immediately and the email is replaced with a non-identifying value. The remaining member identifier, country/language and account dates are destroyed 30 days after withdrawal. |
| Authentication-code records | Codes are valid for 10 minutes. For abuse prevention, request records are deleted by the next daily cleanup after 24 hours from creation. At account withdrawal, code records for that email are deleted. Sent emails have a separate retention period. |
| Sign-in sessions | Sign-in is valid for 30 days. Session records are deleted by the next daily cleanup after 30 days from expiry or revocation. At withdrawal, sessions are revoked and their IP/browser information is removed. |
| Consent and withdrawal history | Consent and withdrawal history (item, document version, time, source, IP, browser information) is kept separately from other member data for 3 years after withdrawal to evidence consent and handle disputes, then destroyed by the daily cleanup. |
| Optional marketing | Use for marketing ends on withdrawal of the relevant channel consent or account withdrawal. Removing a channel consent does not delete the membership email or historical consent records. |
| Enquiries | 12 months after the enquiry is resolved. |
| Booking cache and provider records | Reservation lists are temporarily cached for lookup, with a five-minute reuse window before refresh. Hostex/PayPal transaction records, Gmail sent emails, analytics, hosting logs and backups are kept per each provider's retention settings described in Section 5; database backups are kept for 7 days. |
Code validity is different from record retention. Account withdrawal does not remove all records or erase external booking/payment records. Remaining consent records include IP/browser information and are not described as fully anonymous.
Where a law requires us to keep a record longer, we keep only that record, for the period that law sets, and say which law applies when you ask. Transaction-retention rules are not applied to all membership or consent data.
5. Service providers and overseas transfers
We do not provide member data to third parties. Information you enter in the Hostex booking page or PayPal checkout is collected directly by those companies under their own policies.
To run this website and membership, the operator, established in Indonesia, has the following services process personal data. Some of them process it outside Indonesia and outside Korea.
| Recipient | Country / region | Items | Purpose | When and how | Retention |
|---|---|---|---|---|---|
| Vercel Inc. | United States (functions run in the Washington, D.C., USA region iad1; edge network in Seoul) | Submitted membership and authentication data, IP address, browser information, request logs | Website and API hosting | On every request, over an encrypted network connection | Per Vercel's log retention |
| Google LLC (Gmail) | United States | Recipient email address, login code, content of notice emails | Sending login-code, welcome and consent-notice emails | When an email is sent, over an encrypted network connection | Per Google's mail retention (sent mail stays in the sender mailbox until deleted) |
| Nurigo Co., Ltd. (Solapi) | Republic of Korea | Mobile phone number, message content | SMS delivery (sender of SMS messages) | When an SMS is sent, over an encrypted network connection | Per Solapi's retention policy |
| Google Cloud (Cloud SQL) | Republic of Korea (Seoul, asia-northeast3); backups in the same multi-region as determined by Google Cloud | Member, authentication and consent records | Membership database | Continuously, over an encrypted network connection | As in Section 4; backups 7 days |
| Google LLC (Google Analytics 4) | United States | Cookie identifier, pages viewed, clicks, browser/device data | Usage analytics (in the EEA, UK and Switzerland only after cookie consent) | While you use the site, over an encrypted network connection | Per the Google Analytics data-retention setting |
| Hostex (operator of the Hostex channel manager and booking engine; legal entity as stated in Hostex's privacy policy) | As stated in Hostex's privacy policy | Booker/guest contact details and reservation data | Booking engine and reservation lookup | When you book or look up a reservation, over an encrypted network connection | Per Hostex's privacy policy |
Vercel Inc.
- Country / region
- United States (functions run in the Washington, D.C., USA region iad1; edge network in Seoul)
- Items
- Submitted membership and authentication data, IP address, browser information, request logs
- Purpose
- Website and API hosting
- When and how
- On every request, over an encrypted network connection
- Retention
- Per Vercel's log retention
Google LLC (Gmail)
- Country / region
- United States
- Items
- Recipient email address, login code, content of notice emails
- Purpose
- Sending login-code, welcome and consent-notice emails
- When and how
- When an email is sent, over an encrypted network connection
- Retention
- Per Google's mail retention (sent mail stays in the sender mailbox until deleted)
Nurigo Co., Ltd. (Solapi)
- Country / region
- Republic of Korea
- Items
- Mobile phone number, message content
- Purpose
- SMS delivery (sender of SMS messages)
- When and how
- When an SMS is sent, over an encrypted network connection
- Retention
- Per Solapi's retention policy
Google Cloud (Cloud SQL)
- Country / region
- Republic of Korea (Seoul, asia-northeast3); backups in the same multi-region as determined by Google Cloud
- Items
- Member, authentication and consent records
- Purpose
- Membership database
- When and how
- Continuously, over an encrypted network connection
- Retention
- As in Section 4; backups 7 days
Google LLC (Google Analytics 4)
- Country / region
- United States
- Items
- Cookie identifier, pages viewed, clicks, browser/device data
- Purpose
- Usage analytics (in the EEA, UK and Switzerland only after cookie consent)
- When and how
- While you use the site, over an encrypted network connection
- Retention
- Per the Google Analytics data-retention setting
Hostex (operator of the Hostex channel manager and booking engine; legal entity as stated in Hostex's privacy policy)
- Country / region
- As stated in Hostex's privacy policy
- Items
- Booker/guest contact details and reservation data
- Purpose
- Booking engine and reservation lookup
- When and how
- When you book or look up a reservation, over an encrypted network connection
- Retention
- Per Hostex's privacy policy
These transfers are processing and storage necessary to perform the service contract with you (Korean Personal Information Protection Act Art. 28-8(1)(3); Indonesian Law No. 27 of 2022 on Personal Data Protection Art. 56 for transfers outside Indonesia). To refuse a transfer, contact chris@zion-core.com or withdraw membership; member services will then be unavailable. Google Analytics is not needed to provide the service: you can refuse it at any time in the cookie settings (Section 6) without any effect on the service.
Hostex and PayPal also act as independent controllers for the information you enter in their booking and checkout pages, under their own privacy policies. Refusing optional marketing does not refuse the processing above.
7. Rights, deletion and security
You may request access, correction, deletion, restriction of processing or withdrawal of consent, including through an authorised representative, at the contact below. We may verify identity to protect your information. If the law requires retaining certain records or limits a request, we will explain the reason and scope of handling.
Authentication and session records are removed from the active database on the schedule in Section 4, and profile contact fields are removed or replaced at withdrawal. The remaining member record and the consent history are destroyed by the daily cleanup when their periods in Section 4 end. Copies held by the providers in Section 5 are deleted under their own retention settings; deleting an active record does not immediately erase backups or provider copies.
We use encrypted connections, access restrictions and non-readable authentication-code/session representations to protect membership information. For a suspected leak or unauthorised account use, contact us promptly.
Data due for destruction is deleted irrecoverably; backups are overwritten within 7 days.
You may also contact the Personal Information Dispute Mediation Committee (+82-1833-6972), the KISA Privacy Infringement Report Center (118), or your local data protection authority.
For visitors in the EEA/UK and Indonesia: we process data on the basis of contract (membership, booking lookup), consent (marketing, analytics cookies) and legitimate interest (security, abuse prevention). You have rights of access, rectification, erasure, restriction, portability and objection, and may complain to your local supervisory authority. International transfers are described in Section 5.
8. Contact and policy changes
The data controller is PT Neo Artificial Intelligence (NIB 2402250018359), Pertokoan Sunset Indah, Sanur Kaja, Jl. Sunset Road Kaveling 4, Kuta, Kec. Kuta, Kab. Badung, Bali 80361, Indonesia. The controller is established in Indonesia and processes personal data under Indonesia's Personal Data Protection Law (Law No. 27 of 2022, UU PDP); for users in Korea it also provides the notices required by the Korean Personal Information Protection Act.
- Privacy officer: Song Hoyean (Direktur)
- Email: chris@zion-core.com
- Phone: +62-813-3066-2184
To exercise your rights (access, correction, deletion, restriction, withdrawal of consent, objection or portability), email the privacy officer from your membership email or state it in your request. Marketing choices can be changed and membership withdrawn directly on My Page. We reply without undue delay and within the period the applicable law sets.
Updated policies show a version and effective date. Where a change requires new consent, it is requested separately; old consent records keep the version originally agreed to.