Privacy Policy

Bali Travel Now is a Bali-based travel discovery and concierge platform operating at www.balitravelnow.com. For data-protection purposes, Bali Travel Now is the data controller for personal information collected through our website and account features.

When you book a tour, the booking transaction and payment are processed by a globally trusted travel marketplace partner. The partner acts as an independent data controller for the booking transaction itself; their privacy notice applies to data you enter into their checkout (see Section 5).

We collect data in four buckets:

• Run your account: Sign-in, profile, password reset, email verification.
• Show your trips: Display bookings, voucher links, and trip reminders in your Profile.
• Personalize: Remember your wishlist, recently viewed, and currency preference across devices.
• Concierge support: Help you via WhatsApp or email when you ask for it.
• Marketing (opt-in): Send Bali tips and offers only if you subscribe. One-click unsubscribe in every email.
• Improve the product: Aggregate analytics on which tours travelers find useful.
• Legal compliance: Meet Indonesian tax and consumer-protection rules.

• We never sell, rent, or trade your personal data.
• We never run third-party ad pixels that profile you across the web.
• We never store your payment card details on our servers.
• We never email you marketing content unless you opt in.

We use the following partners — each with a narrow, named purpose:

• Booking & payment partner: A globally trusted travel-marketplace platform that handles your reservation, payment, and refund. Card details are entered into their PCI-DSS-compliant checkout, never on our servers.
• Sign-in providers: If you sign in with Google, your email and avatar are received via OAuth — only what Google's consent screen shows.
• Email delivery: A transactional-email provider sends booking confirmations, password resets, and trip reminders.
• Analytics: Aggregated, IP-anonymized analytics for understanding which pages and tours are useful. No cross-site profiling.
• AI assistant: Your chat input is sent to a language-model provider to generate the response. Not used for ad targeting; not stored long-term against your identity.
• Cloud storage: Tour photos, review photos, and avatars are served from a cloud object store with signed URLs.

We share only what each partner needs to do its job. We do not provide blanket data access.

When you book a specific tour, the operator running that tour receives the minimum information needed to deliver it: lead-traveler name and contact, party size, pickup info if applicable, and any tour-specific answers you provided at checkout. Operators cannot browse other travelers' data.

• Account data: Kept while your account is active. Delete on request.
• Booking records: Kept ~5 years for tax and consumer-protection compliance.
• Recently-viewed: Auto-deleted after 24 hours.
• Wishlist & saved travelers: Kept until you remove them or delete your account.
• Email subscriptions: Until you unsubscribe.
• Single-use tokens (verify, password reset): Cleared as soon as used.
• Payment-flow tokens (snapToken, idempotencyKey): Cleared once a booking is confirmed.
• Logs: Aggregated technical logs retained ~30 days.

• HTTPS / TLS 1.2+ encryption on every page
• Bcrypt password hashing
• Login lockout after repeated failed attempts
• Card details handled exclusively by our PCI-DSS-compliant payment partner — never stored on our servers
• Quarterly access review and least-privilege engineering
• Secrets stored in encrypted environment, not source code

No system is 100% impenetrable; use a strong unique password and enable Google sign-in if available.

You can ask us to:

• Access: Send you a copy of the data we hold about you.
• Correct: Fix any inaccurate or incomplete details.
• Delete: Remove your account and personal data (booking records may be retained for legal-compliance reasons; we will tell you what stays and why).
• Port: Receive your data in a portable format.
• Opt-out: Unsubscribe from marketing instantly.
• Withdraw consent: For anything you previously opted into.

Email info@balitravelnow.com with your request. We respond within 14 days.

We use the minimum cookies needed:

• Essential: Sign-in session, security, CSRF protection. Cannot be disabled.
• Analytics: Aggregated, IP-anonymized usage measurement. Disable via your browser if you prefer.

We do not run third-party advertising cookies.

Our services are not directed to children under 16. Bookings should be made by an adult; child participants are listed under the lead traveler.

Some of our service partners (e.g. cloud storage, email, the booking marketplace) operate outside Indonesia. Data is transferred under standard contractual safeguards and encrypted in transit.

We may update this Privacy Policy. Material changes are reflected in the "Last updated" date. Continued use after a change indicates acceptance of the updated policy.

For privacy questions, data requests, or concerns: