Privacy Policy

1. Who we are

The Black Orchid Oasis, LLC, a Washington (USA) limited liability company, operates the private beachfront villa Black Orchid Oasis at Secret Beach, Parcel 8647, San Pedro, Ambergris Caye, Belize (“we,” “us,” or “the Villa”). We are the controller of the personal information described in this policy. This policy covers blackorchidoasis.com and our direct-booking site, stay.blackorchidoasis.com. If you book through Airbnb, Airbnb’s privacy policy also applies to the information you give Airbnb.

2. Information we collect

We collect information you provide directly when you book a stay, verify your identity, complete the guest register, complete our “Curate Your Stay” pre-arrival form, contact us, or place an order, including:

• Contact details — your name, email address, and phone/WhatsApp number.
• Booking details — arrival and departure dates, number of guests, booking reference, how you heard about us, and any arrival or transfer information you give us.
• Identity verification (lead guest) — the lead guest verifies a government-issued ID through Stripe Identity. The images of your ID document are captured, processed, and stored by Stripe, not by us. We receive and keep only the verification result (verified, needs review, or failed), the name and address extracted from the document, and the document type. We do not receive or keep a copy of the document image.
• Guest register details (every guest, requested) — full name, nationality, passport number, and home address for each member of the party, which Belize’s Hotels and Tourist Accommodation Act requires us to record. We request these details but do not require them to confirm a stay. Passport numbers are encrypted at rest in our systems. Guests may optionally give an email address.
• Order details — the meals, beverages, and experiences you select, headcount, and the cardholder name.
• Health and dietary information you choose to share — allergies, dietary restrictions, or medical notes relevant to your stay.
• Payment information — processed directly by Stripe. We do not receive or store your full card number, bank account number, expiry, or security code; we receive only a confirmation of payment, the billing name and address, and a secure token used for the scheduled balance charge, authorized onsite charges, and charges for incidentals or damage (the card on file) described in our Terms of Service.
• Marketing preference — whether you (or another guest in your party) have agreed to receive offers from us.
• Agreement records — when you accept our Terms we record the date and time, your IP address, and the version accepted.

We also automatically collect limited technical and usage data (such as device, browser, IP address, and pages viewed) through cookies, sign-in links, security checks, and analytics, as described in Section 5.

3. How we use your information

• To take, confirm, and manage your reservation, including the scheduled balance charge, charges to the card on file, cancellations, refunds, and date changes.
• To verify the identity of the lead guest and cross-check it against the payment card holder, to prevent fraud and protect the property.
• To keep the guest register required by Belize law and, where required, provide it to Belize authorities.
• To process and confirm your orders and payments, and to email you receipts and confirmations.
• To prepare for and provide your stay, including catering to dietary needs and allergies and scheduling your complimentary chef meal.
• To communicate with you about your booking, order, or questions by email or WhatsApp.
• To settle authorized onsite charges and recover costs for damage, as set out in our Terms of Service.
• To send you a thank-you, a review request, and a returning-guest offer after your stay, and other offers only if you have consented.
• To keep our accounts and tax records.
• To operate, secure, and improve our websites, including protecting our forms from automated abuse.
• To comply with legal obligations and to establish, exercise, or defend legal claims, including payment disputes.

4. How we share your information

We do not sell your personal information. We share it only with service providers who help us run the villa and our websites, and only as needed:

• Stripe — payment processing, secure storage of your payment method, and identity verification through Stripe Identity. Stripe processes and stores your ID document images under its own policy. See the Stripe Privacy Policy.
• Our reservation system provider — the software that holds our calendar and reservation records. It receives your name, contact details, booking dates, and party size so that availability and reservations stay in sync across the channels we sell on.
• QuickBooks (Intuit) — our accounting software, which receives your name and the amounts invoiced, paid, refunded, or charged for damage. See the Intuit Privacy Statement.
• Google — Google Analytics (website usage), Google Ads (advertising measurement, only with your consent; see Section 5) and Google Workspace / Apps Script (to send and log your confirmations, receipts, and booking emails). See the Google Privacy Policy.
• Cloudflare — Cloudflare Turnstile, which checks that our booking and sign-in forms are being used by a person and not a bot. See the Cloudflare Privacy Policy.
• WhatsApp (Meta) — if you contact us or agree to be contacted on WhatsApp, your messages and phone number are processed by WhatsApp under its own policy. We may also share arrival details with our villa team through WhatsApp. See the WhatsApp Privacy Policy.
• Our villa staff and trusted contractors — only the details needed to prepare and deliver your stay (names, arrival details, dietary needs, celebrations, and orders). They do not receive passport numbers or payment details.
• Belize authorities — guest register information where the Hotels and Tourist Accommodation Act or other Belize law requires it.
• Banks and card networks — the record of your acceptance of our Terms and relevant booking details if you dispute a charge.
• Authorities or advisors — where otherwise required by law or to establish, exercise, or defend legal claims.

5. Cookies, analytics & advertising measurement

Both of our websites set a small number of cookies and similar technologies. A banner asks for your choice the first time you visit; Accept allows the analytics and advertising-measurement cookies below, Decline keeps only the strictly necessary ones. You can change your mind at any time through the Cookie settings link in the footer of every page. Your choice is stored in a cookie named boo_consent for 12 months and applies to blackorchidoasis.com and stay.blackorchidoasis.com together.

• Strictly necessary. The guest portal at stay.blackorchidoasis.com has no passwords. When you request access, we email you a one-time “magic link”; opening it sets a secure session cookie that keeps you signed in to your reservation. The cookie holds only a signed session identifier and expires automatically. Without it, the portal cannot work. Stripe sets its own cookies on our checkout for fraud prevention, and Cloudflare Turnstile checks that our booking, group-link, and sign-in forms are used by a person and not a bot; it may set a cookie and collects limited technical data about your browser to make that decision. The boo_consent cookie records your cookie choice. These do not need consent.
• Analytics (Google Analytics 4). With your consent we use Google Analytics to understand how visitors use our websites (pages viewed, device and browser type, approximate location, how you reached us). Google sets the cookies _ga and _ga_*, which last up to 2 years. Google Analytics 4 does not log or store full IP addresses. You may also opt out with Google’s opt-out browser add-on.
• Advertising measurement (Google Ads). We advertise the villa on Google Search. With your consent, when you arrive from one of our ads Google sets the cookies _gcl_aw and _gcl_au (90 days) that hold a click identifier, and if you then complete a booking on stay.blackorchidoasis.com we tell Google that a booking happened, its total value, and our internal booking reference. We never send Google your name, email address, phone number, or payment details for this purpose. We use this only to measure whether our advertising works. We do not use remarketing or personalised advertising: ad personalisation is switched off in our Google tag, and Google may not use this data to build an advertising profile of you. See the Google advertising technologies page and Google Ads Settings.
• Other advertising partners. If we advertise on other platforms (for example ChatGPT, through the OpenAI Ads measurement pixel), their measurement works the same way and loads only with your advertising consent. No such pixel is active unless it is listed here.
• Campaign attribution. Our own script keeps the campaign parameters from the link that brought you here (such as utm_source or an advertising click identifier) in your browser’s local storage for 90 days and passes them to our booking site so we know which campaign a booking came from. It stores only those campaign values, never your details, and only with your consent.
• Global Privacy Control. If your browser sends the Global Privacy Control signal, we treat it as an opt-out of advertising measurement automatically, whatever you choose in the banner.

6. International transfers

We are a U.S. company operating a villa in Belize, so your information is processed in both countries. Our service providers (such as Stripe, Google, Intuit, and Cloudflare) process data on servers located in the United States and other countries. Where we transfer your information internationally, we rely on these providers’ safeguards and applicable contractual protections.

7. Data retention

• Identity verification. We ask Stripe to redact your verification session, including the document images it holds, 30 days after your check-out (or 30 days after cancellation). We keep only the verification result and the extracted name and address with the booking record.
• Guest register. Names, nationalities, passport numbers, and addresses are kept encrypted for as long as Belize law requires hotel guest registers to be retained, then deleted.
• Booking, order, and payment records. Retained for the period required by Belize and U.S. tax and accounting law, and for as long as needed to resolve any dispute or chargeback.
• Terms acceptance records. Retained with the booking record for the same period.
• Marketing. Your email address is kept on our offers list until you unsubscribe or ask us to remove it.
• Saved payment methods. The Stripe token for your card or bank account is kept only until any onsite balance and any charge for incidentals or damage have been settled after your stay, after which it is detached.

When information is no longer needed, we delete or anonymize it.

8. Your choices & rights

• You may ask us to access, correct, or delete the personal information we hold about you. Some information (such as the guest register and accounting records) must be kept for the period required by law even if you ask us to delete it.
• You may withdraw marketing consent at any time by using the unsubscribe link in any offer email or by contacting us. Booking-related emails (confirmations, receipts, reminders, and hold notices) are not marketing and will still be sent.
• Guests in your party who gave an optional email address may withdraw their consent in the same way.
• You may ask us to stop contacting you on WhatsApp.
• Cookies. Use the Cookie settings link in the footer of any page to accept or decline analytics and advertising-measurement cookies at any time. Declining also removes the Google cookies already set by our sites.
• California residents. We do not sell personal information. Advertising measurement with Google may count as “sharing” under the California Consumer Privacy Act; you can opt out through Cookie settings (Decline) or by turning on Global Privacy Control in your browser, which we honour. You also have the right to know, correct, and delete the personal information we hold, and we will not treat you differently for exercising these rights.
• Canada. We rely on your consent for analytics and advertising-measurement cookies, and on your express consent for marketing email. Our sites ask for consent before setting those cookies for visitors in Canada. You may withdraw consent as described above; residents of Quebec may also contact us about the personal information we hold.
• European Economic Area, United Kingdom & Switzerland. We process your information to perform our contract with you (booking and stay), to comply with law (the guest register, tax records), for our legitimate interests (security, fraud prevention, defending claims), and with your consent (non-essential cookies, marketing). Our sites ask for consent before setting non-essential cookies. You may withdraw consent at any time, object to processing based on legitimate interests, ask for your data in a portable format, and lodge a complaint with your local data protection authority.

To make a request, contact us using the details below. We will respond within a reasonable time and in accordance with applicable law.

9. Security

We use reasonable technical and organizational measures to protect your information. Payment data is handled by Stripe’s PCI-compliant infrastructure and never touches our servers. ID document images are held by Stripe, not by us. Passport numbers in the guest register are encrypted at rest, portal access uses expiring one-time links and signed session cookies, and our forms are protected against automated abuse. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. Children

Our websites and services are intended for adults making travel arrangements. We do not knowingly collect personal information directly from children. Where a booking includes minors, the lead guest (or another adult in the party) provides their guest register details on their behalf. We do not send marketing to children.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “last updated” date and version above show when it was most recently revised. Significant changes will be reflected on this page.

12. Contact us

For any privacy question or request, contact The Black Orchid Oasis, LLC at owner@theblackorchidoasis.com or via WhatsApp at +1 (206) 948-9731.