Privacy Policy

1. Who We Are

KhmerRooms ("we," "us," or "our") is an online booking platform that connects travelers with hotels, guesthouses, and villas across Cambodia. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our website at www.khmerrooms.com.

This policy applies to all users: guests booking accommodation and hotel owners listing properties on our platform.

2. Information We Collect

2.1 Guests

• Full name, email address, and phone number (provided at registration or booking)
• Booking details: hotel, room type, check-in and check-out dates, number of guests
• Payment reference numbers (we do not store card numbers or full KHQR credentials)
• Reviews and ratings you submit
• Search history and pages visited on our platform

2.2 Hotel Owners

• Full name, email address, and phone number
• Business name, property address, and photos of the property
• Bank account or ABA PayWay payout details for commission disbursements
• Pricing, availability calendars, and cancellation policies you configure
• Identity verification documents (where required for listing approval)

2.3 Telegram Authentication

If you log in or link your account via Telegram, we receive your Telegram user ID, username, first name, last name, and profile photo from Telegram's Login Widget. This data is used solely to authenticate your identity and link it to your KhmerRooms account. We do not access your Telegram messages or contacts.

2.4 Automatically Collected Data

• Browser type, operating system, and device type
• IP address and approximate location (city/country)
• Referring URL and pages visited on KhmerRooms
• Session authentication tokens (stored in secure cookies)

3. How We Use Your Information

• To process bookings and send confirmation emails and receipts
• To facilitate communication between guests and hotel owners regarding a booking
• To process payouts to hotel owners after guest check-in
• To send important account notices, booking updates, or policy changes
• To display your profile information within the platform (e.g., guest name shown to hotel at check-in)
• To detect and prevent fraud, abuse, and security incidents
• To improve our platform, fix bugs, and develop new features
• To comply with applicable Cambodian laws and financial regulations

We do not use your information for third-party advertising or sell your data to data brokers.

4. Information Sharing

4.1 Between Guests and Hotel Owners

When a booking is confirmed, we share the guest's name, contact details, and booking dates with the hotel owner so they can prepare for your arrival. Hotel owners do not receive your payment details beyond confirmation of payment status.

Conversely, when a guest views a hotel listing, the hotel's name, address, photos, pricing, and cancellation policy are displayed. Hotel owners' personal contact information is not publicly visible.

4.2 Service Providers

We share data with trusted third-party service providers who help us operate the platform, including email delivery (booking confirmations), payment processing (ABA PayWay / KHQR), cloud hosting (Vercel, Neon), and error monitoring. These providers are bound by confidentiality agreements and may only use your data to provide services to us.

4.3 Legal Requirements

We may disclose personal data if required by Cambodian law, court order, or to protect the safety and rights of our users or the public.

5. Payment Processing

KhmerRooms uses KHQR (via ABA PayWay) for payment processing. When you pay, your payment is handled directly by ABA PayWay's secure infrastructure — we receive a transaction reference and confirmation status only. We do not store, process, or have access to your full card number, CVV, or bank credentials.

Hotel owners receive payouts to their registered ABA or bank account. We store only the account details necessary for disbursement, protected under our security controls.

6. Cookies and Local Storage

We use cookies and local storage for:

• Authentication: Keeping you logged in securely across sessions
• Preferences: Remembering your search filters, language, and UI settings
• Analytics: Aggregated, anonymous usage data to improve the platform

We do not use cookies for targeted advertising. You can clear cookies via your browser settings, but doing so will log you out of your account.

7. Data Retention

• Active accounts: Data is retained for as long as your account remains active
• Booking records: Kept for a minimum of 7 years for financial and tax compliance under Cambodian law
• Deleted accounts: Your profile and personal details are removed within 30 days of account deletion; anonymised booking records may be retained for compliance
• Telegram login data: Retained as long as the Telegram link is active; removed when you unlink or delete your account
• Analytics logs: Aggregated, anonymised data may be retained indefinitely

8. Data Security

We take reasonable technical and organisational measures to protect your data, including:

• HTTPS encryption for all data in transit
• Passwords hashed with bcrypt — never stored in plain text
• Database access restricted to authorised systems and personnel only
• Session tokens stored in secure, HTTP-only cookies
• Regular security reviews of our infrastructure

No system is completely secure. If you believe your account has been compromised, please contact us immediately at support@khmerrooms.com. In the event of a data breach that affects your rights, we will notify you within a reasonable timeframe as required by applicable law.

9. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Ask us to correct inaccurate or incomplete data
• Deletion: Request that we delete your account and personal data (subject to legal retention requirements)
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to certain processing activities

To exercise any of these rights, contact us at privacy@khmerrooms.com or use the Delete Account option in your account settings. We will respond within 30 days.

10. Children's Privacy

KhmerRooms is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

11. Third-Party Links

Our platform may contain links to third-party websites (e.g., hotel social media pages or Google Maps). We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before sharing any personal information.

12. International Data Transfers

KhmerRooms is based in Cambodia and our servers are operated by Vercel (United States) and Neon (cloud infrastructure). By using our platform, you consent to your data being processed in these jurisdictions. We ensure that any such transfers comply with applicable data protection standards.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes by email or via a notice on the platform at least 14 days before the change takes effect. Your continued use of KhmerRooms after the effective date constitutes acceptance of the updated policy.

14. Contact Us

For privacy questions, data requests, or concerns, please contact: