Privacy Policy

1. Controller identity & contact

The data controller is Kaania. For ARCO rights, questions, or withdrawal of consent for secondary purposes: privacidad@kaania.com. For booking matters: reservas@kaania.com.

2. Personal data we collect

Depending on the channel (website, booking, portal, or app), we may collect:

• Identity & contact: full name, email, phone, country of residence
• Stay details: suite type, check-in/out dates, guest count, trip comments
• Tax data (only if you request an invoice): RFC, CFDI use, billing email
• Payment: card data processed by Stripe; Kaania does not store full card numbers or CVV
• Portal/app access: booking email and one-time OTP codes sent by email
• Communications: guest-chat messages with the Kaania team
• Technical data: IP address, device/browser type, language, cookies or similar identifiers needed for security and basic analytics

3. Purposes of processing

Primary purposes (necessary for lodging and the digital service):

• Process, confirm, and manage reservations
• Calculate rates/taxes and collect payment via Stripe
• Send confirmations, reminders, check-in instructions, and operational messages
• Enable guest-portal and app access via email verification (OTP) or confirmation code
• Handle date-change requests, support, and chat
• Issue invoices when requested
• Prevent fraud/abuse and secure the platform
• Comply with applicable Mexican legal, tax, and lodging obligations

Secondary purposes (optional): site/app improvement and aggregated usage statistics. You may object to secondary purposes by emailing privacidad@kaania.com without affecting your booking.

4. Website, bookings, portal & app

kaania.com and the mobile app (which may embed the site or guest portal) process data to show availability and rates and to complete bookings. The “My bookings” portal lets you view stays, payments, and messages after signing in with your booking email and a temporary code. Using the app involves the same processing described here for data you enter or that already exists from your reservation.

5. Transfers & processors

We do not sell your data. We may share it only with processors or third parties needed to provide the service: payment processor (Stripe), transactional email (e.g. Resend or equivalent), hosting/deployment for the site/API, and competent authorities when required by law. Those parties process information under their policies and the Controller’s instructions where applicable.

6. ARCO rights & withdrawal

You may Access, Rectify, Cancel, or Oppose processing of your personal data (ARCO rights), and limit use or withdraw consent for secondary purposes, by emailing privacidad@kaania.com with your name, contact method, and a clear request. We will respond within LFPDPPP timeframes. Cancellation or limitation cannot prevent compliance with legal duties or an already contracted stay.

7. Retention

We keep data as long as needed for the purposes above and applicable legal duties. Booking and invoicing records are retained at least for the Mexican tax retention period (commonly referenced as 5 years). OTP codes are deleted or invalidated after use or expiry (typically minutes).

8. Cookies & similar technologies

We use essential cookies for site operation (session, language preference, security) and, where enabled, analytics cookies (e.g. Google Analytics) for aggregated usage. You may manage or block non-essential cookies in your browser; disabling essential cookies may affect booking or portal sign-in.

9. Minors

Booking is intended for adults. Data about traveling minors is collected through the adult who books, solely for occupancy and stay operations. We do not knowingly collect minors’ data for marketing.

10. Security measures

We apply reasonable administrative, technical, and physical measures (restricted access, HTTPS in transit, temporary portal authentication, environment segregation) to protect personal data against damage, loss, alteration, or unauthorized access.

11. Changes to this policy

Material changes to this Privacy Policy will be published on this page with a new update date. Continued use of the site, app, or portal after publication means you are aware of the current version.