1. Who is responsible
Dreamy operates Dreamy and is the data controller for accounts, requests and platform operations. The accommodation provider or property manager named in your quote may be an independent controller for the stay itself.
2. Data we collect
- Account and identity: name, email, account identifier and interface language.
- Request and booking: phone, dates, guest count, special requests, status and communications.
- Payment: amount, currency, status, Stripe identifiers and receipt. Dreamy does not store full card numbers or CVCs.
- Property partners: contact details, property assignments, calendar, notification preferences and operational payout records.
- Technical use: path, event type, random session identifier, errors and security diagnostics. First-party analytics does not collect email or free-form text.
3. Purposes and legal bases
We process data to:
- Create an account, confirm availability, prepare a quote, book, collect payment and provide support — to perform a contract or take requested pre-contract steps.
- Prevent fraud, secure the service, measure performance and improve the experience — for legitimate operational interests that do not override your rights.
- Keep transaction, tax and receipt records and respond to lawful requests — to meet legal obligations.
- Send marketing only where separate consent has been given; consent may be withdrawn at any time.
4. Sharing and service providers
Relevant data is shared on a need-to-know basis with the property owner/manager, Dreamy operations and infrastructure providers: Supabase (database and authentication), Vercel (hosting), Stripe (payments), Resend (email), and an analytics provider only if enabled. We do not sell personal data.
5. Transfers, retention and security
Providers may process data outside Thailand. We select providers with data-protection and security commitments and restrict access by role. Account data is kept while the account is active and for a reasonable period afterwards; booking, payment and tax records are kept for the period required by law and to establish or defend claims. Data is then deleted or anonymised.
6. Cookies and analytics
We use local storage and cookies required for sign-in, security and session continuity. Guests also receive a preference cookie for up to 180 days containing recent searches, stay dates and the identifiers of saved properties. It can be removed through browser settings. First-party analytics uses a random identifier and does not create an advertising profile. If external analytics is enabled, this notice will be updated and consent controls will be shown where required.
7. Your rights
Subject to applicable law, you may request access, a copy, correction, deletion, restriction, objection, portability or withdrawal of consent. You may also complain to the competent data-protection authority. We may verify identity before acting on a request.
To make a request: bookings@dreamy-stay.com