Your trip details are for running your trip.

Booking details such as your name, email, phone number, country, travel date, party size, pickup area, hotel information you choose to provide, traveler ages where relevant, add-ons, and notes about the trip.

The current booking-request flow does not collect payment. If online payment is enabled later, we may keep records such as the amount, currency, payment provider, provider transaction identifier, and payment status. Card or banking credentials would be entered with the hosted payment provider; BaliXperience does not receive or store raw card numbers.

Messages and support information you send by email, WhatsApp, or through a booking form, plus technical records needed to secure and operate the website, such as IP address, timestamps, browser information, and rate-limit events.

We use personal information to answer enquiries, check availability, create and manage bookings, coordinate pickup and suppliers, verify payment status, send confirmations and service updates, provide support, prevent abuse and fraud, keep required transaction records, and improve the reliability of the service.

Depending on where you live and what the law requires, we process this information because it is needed to take steps at your request or perform the booking contract, because we have legitimate operational and security needs, because the law requires it, or because you have given consent.

We share only what is reasonably needed with drivers, guides, activity operators, attractions, restaurants, or other suppliers involved in your booked day. For example, an activity operator may need traveler names, date, party size, and relevant age or safety information.

We also use service providers to run the business: Midtrans for hosted payment and payment status, Supabase for database infrastructure, Vercel for website hosting and operational logs, Resend for transactional email, Cloudflare Turnstile for booking-form abuse prevention, and WhatsApp/Meta when you choose to message us there. Those providers handle data under their own terms and privacy notices.

Information may also be disclosed where required by law, to protect safety or legal rights, or in connection with a genuine business reorganization. We do not sell personal information or provide it to data brokers.

You may be visiting from another country, and our technology and supplier providers may process information in Indonesia and other regions where they operate. We use established providers and take reasonable steps to protect information when it is processed across borders, as required by applicable law.

We keep booking, payment-status, and communication records only as long as reasonably needed to provide the trip, handle support or disputes, prevent fraud, and meet accounting, tax, and legal obligations. When information is no longer needed, we delete it or remove identifying details. A legal requirement or active dispute may require a longer period.

We use access controls, environment-managed secrets, hosted payment entry, and other technical and organizational safeguards appropriate to a small booking operation. No internet service can promise absolute security. Please do not send card details, passport scans, or unnecessary sensitive information through WhatsApp or email.

Subject to applicable law, you may ask whether we hold personal information about you, request access or correction, ask for deletion or restriction, withdraw consent, object to certain uses, or request a portable copy. Some requests may be limited where records must be retained for a booking, legal obligation, fraud prevention, or a dispute.

You can also complain to the relevant data protection authority. Contact us first if you can—we would like the opportunity to understand and resolve the concern.

The public website does not use advertising cookies. Essential cookies or similar storage may be used for security, administration login, and core site operation. Vercel provides aggregate pageview and website-performance measurements and may process standard request information as our hosting provider.

We also count a small set of first-party actions—such as tour searches, tour views, checkout starts, booking requests, and WhatsApp clicks—to understand whether the website is useful. Those event records do not contain your name, email address, phone number, IP address, cookie identifier, or browser identifier. Personal details submitted with a booking are stored separately for operating that booking.

Bookings must be made by an adult. We collect a child's age or other limited details only when needed for transport, pricing, entry, or activity safety. Do not send additional information about a child unless it is necessary for the booking.

When you open WhatsApp, a payment page, or another external site, that service receives information according to its own privacy notice. WhatsApp conversations may include booking details, so use the same care you would with email and avoid sending payment credentials or unnecessary identity documents.

We may update this notice when the website, suppliers, or legal requirements change. The latest version will remain on this page with its updated date. Material changes affecting an active booking will be communicated where appropriate.