Privacy Policy

1. Who we are

Sunsational Tobago Ltd, Room 1, English Plaza, Northside Rd, Mason Hall, Mason Hall, Tobago, Trinidad and Tobago. For any privacy question or request, email reservations@sunsationaltobago.com or call 1 (868) 782-5152.

2. Information we collect

• Booking requests and Instant Book reservations: your name, email, phone/WhatsApp number, chosen villa and room configuration, dates, number of guests and anything you write in the message box.
• Property owner enquiries: your name and contact details, and the details you give us about your property.
• Guest registration (before you arrive): the names and ages of everyone staying, your arrival and departure times, your address, a photo of your passport, driver's permit or national ID, and, if you choose a bank transfer, the bank account your damage deposit should be returned to. We need the ID to know who is staying in the villa, and the bank account only to send your deposit back.
• Payments: we record the amount, date and reference of the bank transfers you make to us. We never collect or store card numbers on this website.
• AI concierge chat: the questions you type into “Ask Sunsational AI”. Please don't share sensitive personal information in the chat.
• Website usage: anonymous, aggregated visit statistics (pages viewed, country, device type), and, only if you accept analytics cookies, Google Analytics data and which villas you look at (linked to a random ID, never your name), so we can suggest villas you may like. See our Cookie Policy.

3. How we use it

• To check availability, confirm and manage your booking, send invoices, receipts and pre-arrival reminders, and arrange check-in (to perform our contract with you).
• To respond to questions and to property management enquiries (our legitimate interest in running our business, or steps you asked us to take before a contract).
• To keep financial records we are required to keep by law.
• To understand how the website is used so we can improve it (with your consent where cookies are involved).

We do not sell your personal information, and we do not use it for automated decision-making.

4. Who we share it with

Only with service providers who help us run the business, under their own privacy and security terms:

• Our website host (Vercel) and database provider (Supabase), which store the information above.
• Google (Gmail) to send booking emails, and Google Analytics if you accept analytics cookies.
• Anthropic, which powers the AI concierge and processes the questions you type into it.
• Our workflow automation tool (n8n), which may be used to notify our team and send WhatsApp updates about your booking.
• The owner of the property you book, where needed to manage your stay, and our housekeeping staff (arrival details only).
• Intuit (QuickBooks Online), our accounting software, which holds the booking, invoice and payment records we are required to keep (your name, contact details, stay dates and amounts).
• Authorities, if the law requires it.

Some of these providers process data outside Trinidad and Tobago (for example in the United States). Where they do, we rely on their contractual and security commitments to protect it.

5. How long we keep it

Booking and payment records are kept for as long as we need them for accounting, tax and legal purposes (normally seven years). Enquiries that don't lead to a booking are deleted when no longer needed, and in any case within two years. Your photo ID is deleted automatically 30 days after you check out. The bank account for your deposit refund is deleted automatically 14 days after your deposit is settled, and in any case 90 days after you check out.

6. Security

The website is served only over encrypted HTTPS connections. Staff access our booking system with individual, role-based accounts and two-step sign-in, and each person only sees what their role requires. Your photo ID and bank details are encrypted before they are stored, with a key kept separately from the database, so a copy of the database alone would not reveal them. Only management can open them, and every time they do is recorded. We never ask for card numbers, PINs or online banking passwords.

7. Your rights

You can ask us for a copy of the personal information we hold about you, to correct it, to delete it (where we don't need to keep it by law), to restrict or object to how we use it, or to withdraw any consent you gave. Email reservations@sunsationaltobago.com and we'll respond within 30 days. If you're unhappy with our response you can complain to the Office of the Information Commissioner in Trinidad and Tobago or, in the UK/EU, your local data protection authority.

8. Changes

We'll post any changes to this policy on this page, with a new “last updated” date.