Privacy Policy

1. Who we are

Visit Thailand Today ("we", "our", or "the site") is a travel directory for Thailand. This policy explains how we collect, use, and protect your information when you use our website.

Data controller. The site is operated by Mac Kiley, an individual trading as Visit Thailand Today. For the purposes of the UK/EU GDPR and the Thailand PDPA, Mac Kiley is the data controller responsible for your personal data. You can contact us at admin@visitthailandtoday.com for any privacy question or to exercise your rights.

2. Data we collect

• Place submissions. When you suggest a place (name, category, region, address, website, Google Maps link, description), we store this so we can review and potentially add it to the directory. If you provide your name and email, we use them only to follow up about your submission (e.g. if we have questions). Providing name and email is optional.
• Itinerary data. If you use the Itinerary Builder and save your trip, we store your itinerary (title, days, places) so you can view or share it. If you sign in (e.g. via Supabase), we associate the itinerary with your account; otherwise it is stored with a share link only.
• Technical data. Our hosting and analytics (e.g. Google Analytics 4) may collect IP address, browser type, device information, and similar technical data. We use this to understand how the site is used and to improve it. We do not sell this data.

3. How we use your data

We use submission data to review and publish places in the directory and to contact you about your submission if needed. We use itinerary data to provide the planning and sharing features. We use technical data to operate and improve the site and to prevent abuse.

Lawful basis (EU/UK): For submissions, we process place details and optional contact details on the basis of your consent (by submitting the form). For necessary technical processing (e.g. security, logs), we rely on legitimate interests.

4. Data sharing

We do not sell your personal data. We share data with the service providers below, who process it on our behalf or as independent controllers under their own policies:

• Vercel Inc. (United States) — website hosting and delivery; processes request/server-log data including IP address.
• Supabase — database and authentication; stores place submissions and saved itineraries, and sets a strictly necessary session cookie if you sign in.
• Google LLC (United States) — Google Analytics 4, used only with your consent, to measure traffic and usage.
• Microsoft Corporation (United States) — Microsoft Clarity, used only with your consent, for aggregated usage analytics, heatmaps and session replay. Text you type into form fields is masked and is not captured.
• Stay22 Technologies Inc. (Canada) — affiliate link management, used only with your consent, to attribute bookings made through outbound links.

International transfers. Some of these providers are located outside the UK, EEA and Thailand — principally in the United States and Canada. Where personal data is transferred internationally, we rely on the transfer mechanisms offered by those providers, such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision. Canada benefits from an EU adequacy decision.

Affiliate links. Some links on the site direct you to third-party booking and travel services — including Booking.com, Agoda, Airbnb, Hostelworld, Kiwitaxi, and SafetyWing (travel insurance) — and we may earn a commission if you complete a booking or purchase. For most accommodation partners we use a service called Stay22 to track clicks; Kiwitaxi and SafetyWing clicks are tracked directly via our own referral parameters, and Kiwitaxi commissions are only credited when you enter our promo code at checkout. Choosing to click an affiliate link does not change the price you pay. The booking site you land on (and Stay22, where applicable) will receive standard click and referral information (e.g. the page you came from, your browser, IP address) under their own privacy policies. We do not receive your booking details or payment information.

5. Retention

We keep personal data only as long as we need it for the purposes described above:

• Place submissions (the place details you send us) — up to 24 months after we review the submission. Places we publish become part of the directory, but the submission record itself is deleted on this schedule.
• Submitter name and email (optional) — up to 24 months, then deleted. You can ask us to remove them sooner at any time.
• IP address captured with a submission (used only to prevent spam and abuse) — 30 days.
• Saved itineraries — up to 24 months after you last access them, unless you delete them sooner. Itineraries you build without saving stay in your own browser's local storage and never reach us.
• Google Analytics data — event and user data is retained for 14 months.
• Microsoft Clarity data — session recordings and heatmap data are retained by Microsoft for up to 30 days.

We may keep anonymised or aggregated statistics (which cannot identify you) for longer.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your data, or to object to or restrict processing. To exercise these rights, contact us (see below). You can also withdraw consent for optional contact details by asking us to remove your name/email from a submission.

7. Cookies

We use a consent management platform (iubenda) to ask for your permission before any non-essential cookie or tracker is used. Trackers are grouped into three categories:

• Strictly necessary — always active, no consent required. These include your session/authentication cookie and the cookie that records your consent choice, plus itinerary data stored in your own browser.
• Measurement — Google Analytics 4 and Microsoft Clarity. These load only if you consent.
• Marketing — Stay22, used to attribute affiliate bookings. This loads only if you consent. Stay22 stores identifiers in your browser's local storage which do not expire automatically.

If you are in the EEA, the UK or Switzerland, nothing in the Measurement or Marketing categories runs until you opt in. If you are in the United States, you may opt out at any time, and we honour the Global Privacy Control (GPC) signal automatically.

You can change or withdraw your choices at any time via the Cookie preferences link in the footer — withdrawing consent is as easy as giving it. For the full list of cookies and trackers, including names and durations, see our Cookie Policy.

8. California privacy rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the CPRA.

Categories of personal information we collect: identifiers (such as IP address and cookie or device identifiers); internet or network activity (pages viewed, links clicked, interactions with the site); approximate geolocation inferred from IP address; and, if you choose to provide them, your name and email address with a place submission. We do not collect sensitive personal information as defined by the CPRA, and we do not use or disclose personal information for purposes requiring a "Limit the Use of My Sensitive Personal Information" link.

Sale and sharing. We do not sell your personal information for money, and we have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. However, the use of third-party analytics and affiliate trackers may be treated as "sharing" or a "sale" under California law in some interpretations. You can prevent this at any time by rejecting the Measurement and Marketing categories.

Your rights: to know what personal information we collect, use and disclose; to delete it; to correct inaccurate information; to opt out of any sale or sharing; and not to be discriminated against for exercising these rights.

How to exercise them: use the Cookie preferences link in the footer to opt out of sale/sharing, or email us at admin@visitthailandtoday.com. We also honour the Global Privacy Control (GPC) browser signal as a valid opt-out request. You may use an authorised agent to submit a request on your behalf; we may ask for proof of authorisation.

9. Thailand (PDPA)

If you are in Thailand, we process your personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019).

Lawful bases. We rely on your consent for non-essential cookies and trackers and for the optional contact details you provide with a submission; on legitimate interest for operating, securing and improving the site; and on contractual necessity where you ask us to provide a feature such as saving or sharing an itinerary.

Your rights. You have the right to access your personal data and obtain a copy; to rectify inaccurate or incomplete data; to erasure or de-identification; to restrict or object to processing; to data portability; and to withdraw consent at any time (which does not affect processing carried out before withdrawal).

Cross-border transfers. As described in section 4, your data may be processed outside Thailand, principally in the United States and Canada, using providers that offer appropriate safeguards.

To exercise any of these rights, contact us at admin@visitthailandtoday.com. You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand.

10. Children's privacy

This site is intended for a general adult audience and is not directed to children. We do not knowingly collect personal data from children under 16 (or under 13 in the United States). If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Security

We take reasonable steps to protect your data (e.g. HTTPS, access controls). No system is completely secure; we encourage you to avoid sending sensitive data through the submission form beyond what is needed.

12. Changes and contact

We may update this policy from time to time; the "Last updated" date at the top will change. Continued use of the site after changes means you accept the updated policy.

For questions, to exercise any of the rights described above, or to make a privacy complaint, contact Mac Kiley at admin@visitthailandtoday.com. We aim to respond within 30 days.

If you are in the UK or EEA and are unhappy with our response, you have the right to complain to your local supervisory authority — in the UK, the Information Commissioner's Office (ICO).