Privacy notice

Last updated 3 September 2026

This notice explains what we do with your personal information when you book a stay, send us an enquiry, or use medusabungalow.com. It describes what actually happens — not a template.

Who is responsible

Hasitha Dias, sole proprietor trading as Medusa Bungalow
Business registration no. 1/16/85/2021-03-08/59
Akmeemana, Galle, Sri Lanka
bungalowmedusa@gmail.com · +94 77 770 5398

What we collect, and why

When you book. Your name, email address, the number of guests, your arrival and departure dates, any extras you choose, the currency you pay in, and the date and time you accepted our cancellation policy. We need all of it to hold the villa for you and to prove what was agreed. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

When you send an enquiry. Your name, email address, your message, your phone number if you give one, and the dates you asked about. Legal basis: steps taken at your request before entering a contract (Art. 6(1)(b) GDPR).

When you pay. Card payments are handled by Sampath Bank on the bank’s own secure page. We never see your card number, and it is never stored on our systems. What we keep is the amount, the currency, whether the payment was approved or declined, and the bank’s transaction reference — enough to match a payment to a booking and to refund you if you cancel. Legal basis: performance of a contract, and our legal obligation to keep accounting records (Art. 6(1)(b) and (c) GDPR).

When we write to you. We send booking confirmations, cancellation notices and replies to enquiries by email, through Google’s mail service. If you message us on WhatsApp we reply there, using the WhatsApp Business platform operated by Meta. We also read booking-notification emails sent to us by Airbnb and Booking.com so that reservations made there appear in our calendar.

When you visit the website. Our hosting provider records ordinary server logs, including your IP address, for security and to keep the site working. We limit how often a single address can submit the booking form, to prevent abuse. Legal basis: our legitimate interest in keeping the site secure and available (Art. 6(1)(f) GDPR).

Cookies and tracking

This website sets no cookies on your device, and we use no analytics or advertising trackers. There is nothing here to consent to and nothing to opt out of. Two small exceptions, for accuracy:

• The language switcher loads flag images from flagcdn.com, which — like any image request — means that service can see your IP address. No cookie is set.
• If you are staying with us and use the in-house guest page from the QR code in the villa, your browser stores a single conversation identifier locally so your message thread survives a page reload. It stays on your device and is not shared.

If you sign in to the site as a member of staff, WordPress sets a login cookie. That does not apply to guests.

Who else sees your information

We use a small number of service providers, each only for the purpose named:

Several of these providers operate outside Sri Lanka and outside the EEA, which means your information is transferred internationally when we use them. We rely on the standard data-protection terms those providers offer, where they offer them. We do not sell your personal information, and we do not share it for advertising.

Our calendar sync — what it does not share

We keep our availability in step with Airbnb and Booking.com by exchanging calendar files. The calendar we publish contains only dates and the word “Unavailable”. It carries no names, no reservation numbers, no email addresses and no booking details of any kind. Nothing identifying you leaves our systems through this route.

AI assistance

We use an AI assistant to help answer guest questions on the website and on WhatsApp. Your message is processed by Anthropic to produce the reply. It is not used to train anyone’s models. A person reviews and sends anything that involves prices, changes to a booking, refunds or cancellations — those are never answered automatically.

How long we keep it

We keep your booking and payment records for as long as we need them for your stay, and for as long as we are required to keep accounting records by law. Enquiries that do not lead to a booking, and message threads, are kept while they remain useful and are then deleted. Server logs are kept for a short period — typically weeks — and then discarded. If you want to know how long we hold something in particular, ask us and we will tell you.

Your rights

You can ask us for a copy of the information we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and ask for it in a portable format. If you are in the EU or UK you also have the right to complain to your national data protection authority. Write to bungalowmedusa@gmail.com and we will answer within one month.

Some information we cannot delete on request — a paid booking has to stay in our accounting records for as long as the law requires.

Changes

If we change this notice we will change the date at the top. Material changes affecting existing bookings will be sent to you by email.