Privacy policy

What we collect

• Booking details. Name, email address, phone number, party size and travel dates you give us when you request or complete a booking. Phone numbers are normalised to a single international format so we can reach you on the number you gave us.
• Payment information — not card numbers. Card and payment details are entered directly into Stripe or PayPal's own secure, PCI-DSS compliant checkout and never reach Kalena's servers. We retain only the outcome of a payment (amount, currency, status, a processor reference) — never the card number, CVV or full account details.
• Messages. If you message our concierge, an operator, or Kalena support (including by WhatsApp or SMS), we keep a record of that conversation to answer it, hand it to the right person, and resolve any dispute about what was said.
• Account information. If you create an account, we hold your email address and the authentication record needed to sign you back in.
• Analytics — guest-only, no personal identifiers. We record anonymous, aggregate browsing events (pages viewed, searches run, buttons clicked) to understand which pages and listings are useful. This feed deliberately excludes staff and internal-tool traffic, and does not knowingly collect names, emails or payment details as part of an analytics event.
• Cookies. We use functional cookies needed to keep you signed in and to remember basic preferences (currency, country). We do not run third-party advertising pixels without your consent where local law requires it.

How we use it

• To process and confirm your booking, and to pass the details the operator needs to deliver it — no more than that.
• To send booking confirmations, itinerary updates and, where you have opted in, WhatsApp/SMS reminders (for example, transfer pickup times).
• To respond to enquiries sent through the concierge, WhatsApp, email or a contact form.
• To detect and prevent fraud, abuse and payment disputes.
• To understand, in aggregate, how the site is used, so we can fix what is broken and build what is missing.
• To meet our accounting, tax and legal obligations.

We do not sell your personal data, and we do not share it with anyone beyond what is needed to deliver your booking (see below).

Who we share it with

• The operator you booked with — the hotel, tour company or transfer company — receives what it needs to provide the service: your name, contact details, dates, party size and any special requests.
• Payment processors (Stripe, PayPal) handle the transaction directly; see their own privacy policies for how they handle payment data.
• Navicaters Limited staff operating Kalena, on a need-to-know basis, to run bookings, support and payouts.
• We disclose data to a third party beyond the above only where required by law, or with your consent.

AI features

Kalena's trip-planning concierge is an AI assistant and identifies itself as such when you chat with it. Messages you send it are processed to generate a response and are not used to place a booking without your action. Kalena also operates a read-only interface (MCP) that lets third-party AI assistants search our public catalogue and price — see llms.txt. That interface never receives your personal data; it answers questions about published listings and prices, nothing about any individual guest.

How long we keep it

We keep booking and payment records for as long as needed for accounting, tax and dispute-resolution purposes [OWNER TO CONFIRM: exact retention period — no fixed schedule is currently codified]. Message history is kept for as long as your account or an open booking exists, or as needed to resolve a dispute. Aggregate analytics events are not tied to your identity and are kept for trend reporting [OWNER TO CONFIRM: retention window]. You can ask us to delete personal data we hold about you at any time — see Contact below — and we will do so unless we are required to keep it (for example, a completed transaction record).

Security

Card payments are handled entirely by Stripe and PayPal — Kalena never stores your card number. Access to the systems that hold booking and account data is restricted to authorised staff and enforced at the database level. No system is perfectly secure, and we cannot guarantee absolute security of information transmitted over the internet.

Your choices

• You can ask us what personal data we hold about you, correct it, or ask us to delete it, by emailing us (see Contact).
• You can opt out of non-essential messages (marketing, non-booking WhatsApp/SMS) at any time; we will still send booking-critical messages (confirmations, pickup times) for a booking you have made.
• You can decline non-essential cookies in your browser; the site remains usable without them.

Children

Kalena is not directed at children, and we do not knowingly collect personal data from anyone under 16 [OWNER TO CONFIRM: minimum age Kalena wants to state].

Changes to this policy

We may update this policy as Kalena changes. We will update the "Last updated" date above when we do; continued use of the site after a change means you accept the updated policy.

Contact

Questions about this policy, or a request about your data, go to contact@kalena.fun.