Privacy Policy

Lodge Vacations (“Lodge”, “we”, “us”) operates a direct-booking marketplace for homestays and guesthouses. This Privacy Policy explains what personal data we collect when you browse our website, make a booking, or create an account, how we use it, who we share it with, and the rights you have over it.

It applies to lodge.vacations and the booking services we provide through it. It does not cover the independent practices of hosts you book with, or third-party sites we link to, which run under their own policies. For questions about your data, contact us at info@lodge.vacations.

Information you give us

• Booking details: your name and email address, the property and dates you book, the number of guests, and any message or request you send to a host. We collect this at checkout, so you can browse and check prices without giving us any of it.
• Account details: if you create a Lodge account, your email address and a password, which we store only as a secure hash, never in plain text.
• Communications: the content of emails or messages you send us, such as a support or cancellation request.

Information we collect automatically

• Usage and device data: if you consent to analytics cookies, we collect pages viewed, actions taken in the booking funnel (searches, listings viewed, checkout started), and technical details such as browser type, device, and referring page, through our analytics provider.
• Approximate location: we read the country your request comes from, taken from your IP address at country level only, to show prices in your local currency. We do not collect precise GPS location.
• Diagnostic data: if a page errors, we may capture technical error details to diagnose and fix the problem.

Information from third parties

• Payment confirmation: when you pay, our payment processor (Stripe) confirms the payment to us and passes back limited details such as the last four digits of your card and the country it was issued in. We never receive or store your full card number.

We use your personal data only where we have a lawful basis to do so. The bases we rely on are set out below.

• Provide your booking. We process your reservation, take payment, send you confirmations, and pass on the details a host needs to host your stay. Basis: performance of our contract with you.
• Manage your account. We authenticate you, keep you signed in, and show your booking history. Basis: performance of our contract with you.
• Communicate with you. We send booking confirmations, check-in reminders, and review requests, and we reply to your enquiries. Basis: our contract with you, and our legitimate interest in supporting your stay.
• Keep Lodge secure and working. We prevent fraud, debug errors, and maintain the service. Basis: our legitimate interest in running a secure, reliable platform.
• Understand and improve the service. We measure how the site is used through analytics. Basis: your consent (see our Cookie Policy).
• Meet legal obligations. We keep records we are required to retain, for example for tax and accounting. Basis: compliance with a legal obligation.

We use a small number of cookies. Cookies that are strictly necessary or that remember your preferences (such as your display currency) are always on. Analytics cookies run only after you accept them. In regions that require prior consent, nothing non-essential loads until you choose to allow it.

You can review or change your choice at any time using the “Cookie preferences” link in our footer. Full detail of every cookie we set is in our Cookie Policy.

We do not sell your personal data. We share it only with the parties below, and only as far as needed for the purposes above.

Hosts

When you book, we share the details a host needs to host your stay: your name, the dates, the number of guests, and any message you sent. Hosts are independent and act as their own data controllers for the information they receive.

Service providers who process data on our behalf

Legal and safety

We may disclose data where the law requires it, or where we need to protect the rights, safety, or property of Lodge, our guests, or our hosts. If Lodge is involved in a merger, acquisition, or sale of assets, we may transfer data as part of that transaction, subject to this policy.

Lodge serves guests and hosts internationally, and some of our service providers (such as our analytics and hosting providers) are based in the United States. This means your data may be processed outside the country you live in, including in countries whose data-protection laws differ from yours.

Where we transfer personal data out of the UK or European Economic Area, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, so your data keeps an equivalent level of protection.

We keep personal data only as long as we need it for the purposes it was collected for, then delete or anonymise it.

• Booking and payment records are kept for the duration of your stay and afterwards for as long as we are required to retain them for tax, accounting, and dispute-resolution purposes.
• Account data is kept while your account is active. If you close your account, we delete or anonymise it, except where we must keep certain records by law.
• Analytics data is retained for a limited period in line with our analytics provider’s settings.

We use technical and organisational measures to protect your data, including encryption in transit, row-level access controls on our database, hashed passwords, and limiting access to the staff who need it. Our PCI-compliant payment processor handles all card data, which never touches our own servers. No system can be made fully secure, but we work to protect your data and to respond without delay if something goes wrong.

Depending on where you live, you have some or all of the following rights over your personal data:

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to correct data that is inaccurate or incomplete.
• Deletion: ask us to delete your data, where we are not required to keep it.
• Restriction and objection: ask us to limit how we use your data, or object to certain uses such as those based on legitimate interests.
• Portability: ask for your data in a portable, machine-readable format.
• Withdraw consent: withdraw your consent to analytics at any time, without affecting processing we have already carried out.

To exercise any of these rights, email us at info@lodge.vacations. We will respond within the time required by law. You also have the right to complain to your local data-protection authority if you are unhappy with how we handle your data.

Lodge is intended for adults. We do not knowingly collect personal data from children under 18. If you believe a child has given us their data, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “last updated” date at the top and, where appropriate, let you know in another way. Please check back periodically.