1. Who we are
Mahaloka Valley Resort operates this website and the private Mahaloka Social Publishing tool used by authorized resort staff. References to “Mahaloka Valley,” “we,” “us,” or “our” mean Mahaloka Valley Resort in Nusa Penida, Bali, Indonesia.
This policy applies to public website visitors, guests who contact or book with us, and authorized administrators who connect a Google Business Profile or Instagram account to our publishing tool.
2. Information we handle
Information you provide
- Contact details and messages you send through WhatsApp, email, telephone, or another booking channel.
- Reservation and service details such as guest name, contact details, stay dates, travel arrangements, and preferences needed to fulfil a request.
- Payment-confirmation information you choose to share with us. Payment providers process payment credentials under their own policies.
- Administrator account and security information used to protect the private management area.
Technical and interaction information
Our hosting and security providers may process IP address, browser, device, request, and diagnostic information to deliver and protect the website. The public What's New Like feature uses a random first-party browser identifier; its application database stores only an HMAC-derived identifier and does not store raw IP addresses or raw user-agent strings for Likes.
3. Google user data and Business Profile access
Mahaloka Social Publishing requests the Google OAuth scope https://www.googleapis.com/auth/business.manage only after an authorized Mahaloka Valley owner initiates the connection.
Data accessed
The integration may access the Google Business Profile accounts and business locations the authorizing user is permitted to manage, together with the minimum identifiers and post information needed to select the Mahaloka Valley listing and publish updates.
How Google data is used
Google user data is used solely to connect the authorized Mahaloka Valley profile and publish selected Mahaloka Valley What's New articles as Google Business Profile updates. The automated post uses standard business-update content, a public article image, and a Learn More link to the original article.
How Google data is stored
OAuth client credentials, the refresh token, Business Profile account and location identifiers, and operational publication status are stored in private server storage outside the public website. Access tokens are obtained when needed and are not displayed publicly. OAuth state values are one-time, time-limited, and stored only as cryptographic hashes.
How Google data is shared
We do not sell Google user data, use it for advertising, use it to build advertising profiles, or allow humans to read it except when necessary for security, support, legal compliance, or operation of the feature. Data is transmitted to Google only as required to authenticate and perform the publishing action requested by the authorized user, and to infrastructure providers that securely support the service.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
7. Retention, security, and deletion
We keep information only for as long as reasonably necessary for the purpose described, operational records, dispute handling, security, accounting, and legal obligations. Google and Instagram authorization credentials are retained until the connection is replaced, revoked, no longer needed, or a valid deletion request is completed.
We use access controls, private storage, restricted file permissions, transport encryption, authentication, and audit controls appropriate to the service. No internet or storage system can be guaranteed completely secure.
An authorized Google user can revoke access from the Google Account third-party connections page. You may also request deletion of stored integration data by contacting us. Revocation or deletion will stop future automated publishing but will not automatically delete posts already published on external platforms.
8. Your choices and rights
Subject to applicable law, you may ask us to access, correct, or delete personal information we control, object to or restrict certain processing, or withdraw consent. We may need to verify your identity and authority before acting on a request.
If you follow a third-party link or make a reservation through an external provider, direct requests about that provider's data to the provider as well.
9. Children
The website and Social Publishing tool are not directed to children. Guest information about a child should be provided only by a parent, guardian, or authorized adult when needed for a booking or service.
10. Changes to this policy
We may update this policy when our services, integrations, or legal obligations change. The current version and its effective date will remain available at this URL.
11. Contact us
For privacy questions, requests, or Google user-data deletion, contact info@mahalokavalley.com or use our contact page.
Mahaloka Valley Resort
Jalan Crystal Bay, Sakti, Nusa Penida, Bali, Indonesia
4. Instagram publishing
When an authorized owner connects the official Instagram professional account, the integration uses the minimum permissions needed to identify that account and publish selected What's New images and captions. Tokens and identifiers are kept in private storage and are not exposed on public pages.