1. Introduction
This Privacy Policy explains what information Villa Homiti collects through its website and direct booking service, how it is used, and how it may be processed by service providers.
Acknowledging this Privacy Policy is separate from agreeing to Booking Policies & Terms. It is not consent to marketing.
2. Who Is Responsible for Your Information?
Villa Homiti is operated by Comercializadora e Inversiones Sylvie Carrere Icka EIRL, a business established in Chile, registered under RUT 77.131.068-0, with its registered address at Tu'u Koihu s/n, Isla de Pascua (Rapa Nui), Región de Valparaíso, Chile.
The accommodation is hosted by Sylvie Carrere Icka.
For privacy-related inquiries, please contact contact@homitivilla.com.
3. Personal Information We Collect
- Booking contact details entered in checkout: name, email address, and country; phone number is optional.
- Reservation and quote details: check-in and check-out dates, nights, quoted amounts, currency, payment status, reservation reference, and related booking status.
- Payment records needed by the booking engine: PayPal order/capture identifiers and verified payment status. The booking engine does not request or store full card numbers or card security codes.
- Essential technical data: a PHP session identifier in a cookie, session-scoped checkout recovery and idempotency values in browser sessionStorage, and hashed IP-derived rate-limit keys in MariaDB.
- Web server access logs may contain connection and request metadata such as IP address, requested path, time, and user-agent. Log contents and retention depend on the web server and hosting configuration.
4. How We Use Your Information
- To check requested dates and configured rates, prepare a quote, create and manage a booking request, and contact the guest about that request.
- To secure availability, verify a payment, maintain reservation and payment records, and prevent duplicate or abusive requests.
- To protect the website and diagnose service failures using limited operational and security records.
- The current booking flow has no analytics tags, advertising pixels, or marketing opt-in. It does not use booking contact details to send marketing through this checkout.
5. Payments Through PayPal
When PayPal checkout is enabled, PayPal’s payment interface and services process payment information. Villa Homiti’s server sends the amount, currency, and a booking reference to PayPal and receives order, capture, and payment-status information for verification. The booking database does not store full card numbers or card security codes.
When the website is running in its testing environment, PayPal Sandbox transactions are test transactions and do not collect real payments. PayPal’s own privacy notice and terms apply to information PayPal processes.
6. Accommodation Availability and Google Calendar
The availability integration requests free/busy information from Google Calendar to identify occupied dates. A booking request that passes availability checks may create a Villa Homiti calendar event containing the stay dates, the summary “Reserva HOMITI”, and an internal booking reference. Guest name, email, phone, and country are not included in that event payload.
Google processes calendar requests under its own service terms and privacy notice. Processing locations depend on Google’s service and account configuration.
7. Cookies and Essential Website Technologies
- The site uses the essential “homiti_session” cookie to maintain a server-side session and CSRF protection. It is session-only, HttpOnly, SameSite=Lax, and Secure when the request is served over HTTPS.
- The checkout uses browser sessionStorage for short-lived checkout recovery secrets and idempotency keys. This is browser session storage, not a marketing cookie; it is used only by the checkout flow.
- The site currently has no analytics or advertising cookie tools. PayPal’s SDK is loaded only on checkout when payment is configured and the legal checkout gate is satisfied.
8. Sharing Information With Service Providers
Information is shared only as needed to operate the requested booking and website: with Google Calendar for availability and booking-event operations, with PayPal for payment processing when enabled, and with the hosting/database operator needed to run the site.
Hosting and database providers may process the technical and booking information needed to operate the website and store its records. Information is not sold. No analytics or advertising provider is configured in the website.
9. International Processing
Google and PayPal may process information in countries outside Chile when their services are used. Processing locations can vary according to each provider’s services and account configuration. Those providers apply their own terms and safeguards to their processing.
10. Data Retention
The booking application has no configured automatic deletion schedule for checkout sessions, guest contact details, reservation records, or payment history. Expired quotes and holds can cease to be active without the associated historical records being deleted.
Rate-limit records are cleaned after one day. PHP session files are handled by PHP session garbage collection. Web server logs and infrastructure backups follow the retention settings of the environment in which the website is hosted.
11. Information Security
The application uses HTTPS when deployed with TLS, HttpOnly and SameSite session-cookie settings, CSRF checks on state-changing requests, server-side authorization for checkout access, hashed access secrets and idempotency keys, and restricted administrative routes. Google OAuth credentials are encrypted before storage.
These controls reduce risk but cannot guarantee absolute security. Infrastructure, database-at-rest protection, backups, and access to operational systems also depend on the hosting environment.
12. Your Privacy Rights
You may contact Villa Homiti to ask about personal information associated with your booking or to request a correction or other action available under applicable law. Requests can be sent to contact@homitivilla.com.
Requests will be handled under the privacy rules applicable in Chile. Villa Homiti may ask for information reasonably needed to verify the requester and locate the relevant booking.
13. Children’s Information
The direct booking form collects contact details from the person making the booking and does not ask for children’s personal information. Please do not enter children’s information into the guest contact fields. If you believe a child’s information was submitted, contact Villa Homiti so the request can be reviewed.
If you believe a child’s information has been submitted, contact Villa Homiti using the details in Section 16 so the information can be reviewed.
14. Third-Party Services and Links
The website links to WhatsApp for guest-initiated contact and may load PayPal’s payment SDK during an enabled checkout. Google Calendar is called by the server for availability and booking-event operations. These services have their own privacy notices and terms; Villa Homiti does not control their independent processing.
No analytics or advertising service is configured in the website. Third-party services may update their own processing practices independently.
15. Changes to This Privacy Policy
This Privacy Policy is version 1.1 and is effective October 20, 2026. A material update will be published as a new version. The version accepted for an existing checkout remains recorded with its content hash and immutable content snapshot.
16. Contact
Villa Homiti is operated by Comercializadora e Inversiones Sylvie Carrere Icka EIRL, RUT 77.131.068-0, registered at Tu'u Koihu s/n, Isla de Pascua (Rapa Nui), Región de Valparaíso, Chile. The accommodation is hosted by Sylvie Carrere Icka.
For privacy-related inquiries, email contact@homitivilla.com or contact Villa Homiti on WhatsApp at +56 9 39 05 13 82.
contact@homitivilla.comWhatsApp: +56 9 39 05 13 82
★★★★★
★★★★★
★★★★★
★★★★★