Privacy Policy

Who we are

Mu Living runs designer villas in Canggu, Bali, Indonesia. We are responsible for the personal data you share with us through this website, by email or on WhatsApp. You can reach us about privacy at stay@mulivingbali.com.

What we collect

• Booking details — your name, email, WhatsApp number, country, travel dates, number of guests and any message you send with your request.
• Messages — emails and WhatsApp messages you exchange with our team, and any files you send us (for example a payment receipt).
• Identity documents — at check-in we may ask for a copy of your passport or ID, because accommodation providers in Indonesia must register foreign guests with the authorities.
• Technical data — the IP address of requests to our booking form, kept in our security logs to prevent abuse.

Why we use it

• To handle your booking: checking availability, confirming your stay and preparing for your arrival.
• To talk to you about your stay — on WhatsApp if you choose that option, otherwise by email.
• To meet legal duties, such as guest registration and keeping financial records.
• To keep our systems and guests safe, for example by blocking fraudulent or spam requests.

Your choices

When you book you agree to us using your details to handle the booking. Messaging you on WhatsApp is a separate choice — you can untick it, and you can ask us to stop at any time by replying “stop” or emailing us.

We do not send marketing without your permission and we do not use advertising or tracking cookies.

Who we share it with

We never sell your data. It is only seen by:

• Our team, each with access limited to what their role needs.
• Cloudflare, which hosts our website, booking system, file storage and email on our behalf.
• Meta (WhatsApp), only if you choose to hear from us on WhatsApp.
• Indonesian authorities, where the law requires it (such as guest registration).

Where it is stored

Our systems run on Cloudflare’s network, so your data may be stored or processed outside Indonesia. We only use providers that protect personal data to a standard at least as high as Indonesian law requires.

How we protect it

All connections are encrypted (HTTPS). Every member of our team has a personal login protected by two-step verification (2FA): signing in on a new device needs their password plus a one-time code sent to their email or shown in an authenticator app. Staff only see what their role allows, and identity documents, receipts and emails are encrypted with our own key before they are stored — so only our booking system can read them. Every view of a document is logged. If a data breach ever affects you, we will let you and the authorities know as the law requires.

How long we keep it

We keep booking records, messages and documents for as long as we need them to look after your stay, for our records and to meet our legal obligations. You can ask us to delete your data sooner where the law allows.

Your rights

Under Indonesia’s Personal Data Protection Law (Law No. 27 of 2022) you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct anything that is wrong or out of date;
• delete your data, or stop or limit how we use it;
• withdraw a consent you gave, such as WhatsApp messages.

Email stay@mulivingbali.com and we will reply as quickly as we can, within the time the law requires. You can also complain to the Indonesian data protection authority.

Changes

If we change this policy we will update the date below. Each booking records the version you agreed to.