Privacy Policy

All You Are ("we", "us", "our") operates www.allyouare.com (the "Site"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit the Site or use our services. We handle your data in line with applicable data protection laws, including the General Data Protection Regulation (GDPR) and other relevant international privacy regulations. By accessing or using the Site, you acknowledge that you have read and understood this policy and agree to be bound by it.

What we collect

Information you give us

We collect personal information you provide voluntarily — when you fill out a contact or inquiry form, subscribe to our newsletter or marketing communications, request information about our stays, communicate with us by email, phone, or other channels, or register for an account. This may include your full name, email address, phone number, postal address, company name, and anything else you choose to share.

Information we collect automatically

When you visit the Site, we automatically collect certain technical data: your IP address, browser type and version, device type and operating system, the pages you visit and the time spent on each, the date and time of your visit, the referring website or source, and your general geographic location at city or region level. This is gathered through server logs and helps us understand how the Site is used and improve its performance.

Cookies and tracking

We use cookies and similar technologies to enhance your experience and analyse how the Site is used. We use essential cookies for core functionality, performance cookies to understand interaction, functional cookies to remember your preferences, and marketing cookies to deliver relevant advertising where applicable. You can manage these through your browser settings, though disabling some may limit certain features. Our Cookie Policy covers this in full.

How we use it

What we use it for

We use your information to provide our services and respond to your inquiries, to communicate with you through updates, newsletters, and marketing materials (with your consent where required), to improve the Site by analysing usage patterns and optimising performance, to personalise your experience, to keep the Site secure and prevent fraud, to meet our legal obligations, and to run our day-to-day business operations.

Legal basis

Our grounds for processing

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your data on one of four legal grounds: your consent, where you have given explicit permission; contractual necessity, where processing is needed to fulfil a contract or take steps before entering one; our legitimate interests, such as improving our services, securing the Site, and conducting analytics, provided these do not override your rights; and legal obligation, where the law requires it. Where we rely on consent, you can withdraw it at any time.

Who we share it with

The short version

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

When we do share

We share information with trusted service providers who help us run the Site and our business — hosting, email tools, analytics — and who are contractually bound to keep it confidential and use it only as we direct. We may also transfer it as part of a merger, acquisition, or sale of assets; disclose it where required by law, a court order, or to protect our rights and the safety of others; and share it with third parties where you have given explicit permission.

Where your data goes

International transfers

We operate from Bali, Indonesia, so your information may be transferred to, stored, and processed in countries that may not offer the same level of data protection as your own. When we transfer data internationally, we apply appropriate safeguards — standard contractual clauses approved by the European Commission, recipients certified under recognised data protection frameworks, and your explicit consent where required.

How long we keep it

Data retention

We keep your information only for as long as necessary to fulfil the purposes set out in this policy, unless the law requires or permits us to keep it longer. In deciding how long, we weigh the nature and sensitivity of the data, the reasons we hold it, our legal, tax, and accounting obligations, and our legitimate business interests. Once it is no longer needed, we securely delete or anonymise it.

How we protect it

Security

We use appropriate technical and organisational measures to protect your information from unauthorised access, alteration, disclosure, or destruction — including SSL/TLS encryption for data in transit, secure servers and databases with access controls, regular security assessments, and staff training. That said, no method of transmission or storage is ever completely secure, and we cannot guarantee absolute security.

Your rights

For everyone

You have the right to access the personal information we hold about you, to ask us to correct anything inaccurate or incomplete, and to opt out of marketing at any time using the unsubscribe link in our emails or by contacting us directly.

If you're in the EEA, UK, or Switzerland

Under GDPR you also have the right to erasure (to be forgotten) in certain circumstances, to restrict how we process your data, to object to processing including direct marketing, to receive your data in a structured, machine-readable format, to withdraw consent where we rely on it, and to lodge a complaint with your local data protection authority.

Exercising your rights

To exercise any of these, contact us using the details below. We will respond within the timeframe required by applicable law, typically within 30 days.

Other things worth knowing

Children's privacy

The Site is not directed to children under 16 (or the applicable age of digital consent where you live), and we do not knowingly collect their information. If we learn that we have, we will delete it promptly. If you believe a child has given us information, please contact us.

Links to other sites

The Site may link to external websites, social platforms, and services we don't operate. This policy applies only to our Site — we are not responsible for the privacy practices of others, so review their policies before sharing your information.

Changes to this policy

We may update this policy to reflect changes in our practices, technology, or the law. When we make significant changes, we will post the revised policy here with a new "Last Updated" date, and where appropriate notify you by email or with a prominent notice on the Site. The date at the top reflects the most recent revision.