HomeLoginSign up
LacaStay Legal

Privacy Policy

How LacaStay collects, uses, stores and protects data.

VIEN
This document clarifies the rights and responsibilities of LacaStay, business accounts using the software, and their customers across data, payments, integrations and liability limits. It does not replace legal advice for specific jurisdictions.

1. Scope

This Policy explains how LacaStay collects, uses, stores, shares and protects data when you visit LacaStay.com, create an account, use the LacaStay software platform, branded booking websites, payment integrations, notifications, AI or related services.

2. Data roles

For LacaStay user account data, LacaStay decides how the data is used where appropriate. For customer data entered, collected or synced by business accounts, the business account decides how that customer data is used and LacaStay handles it only as needed to provide the service.

3. Data we collect

We may collect account information, name, email, phone number, business details, subdomain, settings, bookings, rooms, services, staff, invoices, transactions, support history, device logs, IP address, browser data, cookies, security events and data generated when using AI or third-party integrations.

4. Business customer data

Business accounts may store customer data such as names, phone numbers, emails, bookings, notes, preferences, payment history, service requests, reviews or messages. Business accounts are responsible for notifying customers and having a lawful basis to collect and use this data.

5. Purposes of use

LacaStay uses data to create accounts, operate the booking engine, display branded booking websites, process OTPs, send notifications, support payments, secure the platform, prevent fraud, provide support, back up data, analyze performance, improve the product, personalize experience and comply with legal obligations.

6. Cookies and similar technologies

We may use cookies, local storage, session storage, logs and analytics tools to keep users signed in, remember language, measure performance, detect errors, prevent abuse and improve the product. You can control cookies in your browser, but some features may not work fully.

7. Sharing data

We do not sell personal data. Data may be shared with infrastructure, email, SMS, payment, storage, analytics, security, AI, technical support providers, professional advisers, authorities when legally required, or a successor in a business restructuring.

8. Payments and third parties

When business accounts enable PayOS, Stripe, PayPal, Zalo, Meta, email, SMS, OTAs or other services, necessary data may be sent to that provider. The provider’s own policies govern its processing.

9. AI and conversation data

If AI features are used, prompts, conversation history, booking context or related data may be processed to generate responses, summaries or automation. Business accounts should avoid unnecessary sensitive data and review outputs before using them with customers.

10. Security

LacaStay applies reasonable measures such as access controls, business-account permissions, HTTPS transmission, logic checks, logging, backups and separation between business accounts. No system is perfectly secure, but we work to reduce risk and respond to incidents.

11. Retention and deletion

We retain data as needed to provide the service, comply with law, resolve disputes, maintain backups, audit, prevent fraud and enforce terms. Business accounts may request export, correction or deletion subject to technical feasibility and legal duties.

12. User rights

Depending on applicable law, you may have rights to access, correct, delete, restrict processing, object, withdraw consent, request portability or complain. Customers of a business account should contact that business first; LacaStay will assist the business account with appropriate requests.

13. International transfers

Data may be processed on servers, cloud services or providers located in countries different from where you live. We use reasonable safeguards for cross-border processing and transfers.

14. Children

LacaStay is not directed to children. Business accounts must not knowingly collect children’s data without a lawful basis, required consent or legitimate operational need.

15. Changes

We may update this Privacy Policy as the product, law or risks change. The new version will be posted at LacaStay.com/privacy and will apply from the effective date shown on the page.

16. Contact

Privacy requests may be sent to [email protected] or the support channel shown inside your LacaStay account.

17. United States and California privacy rights

If California or similar U.S. state privacy laws apply, you may have rights to know categories of data collected, sources, purposes, recipients, access, deletion, correction, limits on sensitive-data use and non-discrimination for exercising privacy rights. LacaStay does not sell personal data in the ordinary sense. If future activity is considered selling or sharing under California law, LacaStay will update notices and opt-out controls.

18. EU, EEA, Swiss and UK privacy rights

Where GDPR, UK GDPR or similar laws apply, LacaStay processes data based on contract, legitimate interests, legal obligations, consent or legal claims. Individuals may have rights to access, correct, delete, restrict processing, object, withdraw consent, request portability and complain to a data-protection authority.

19. Cookies, tracking and user choices

LacaStay may use cookies, local storage, session storage, logs, pixels and analytics tools to keep users signed in, remember language, measure performance, detect errors, prevent abuse and improve the product. If advertising, remarketing or advanced tracking is introduced, LacaStay will add consent or opt-out controls where required by law.

20. International transfers

Data may be processed on servers or by providers located in countries different from where you live. Where required by law, LacaStay will use reasonable safeguards such as contractual terms, vendor review, access limits, encryption in transit and appropriate internal controls.

21. Data incidents and notice

If LacaStay detects an incident likely to materially affect personal data, it will assess scope, reduce risk and notify business accounts or authorities where required by law. Business accounts are responsible for notifying their own customers where required and where the incident relates to data they decide how to use.

22. Sensitive data and regulated industries

LacaStay is not designed by default to store protected health information, highly sensitive financial data, national identification numbers, children’s data or regulated-industry data unless separately agreed. Business accounts in healthcare, finance, insurance, children’s education or regulated sectors must assess their own obligations and sign additional terms where needed.