Privacy Policy

1. Who we are and what this covers

PT Luxury Leisure Internasional (“Aetheria”, “we”), part of the Leisure Group, operates Aetheria OS, software that villas and boutique hotels (“hosts”) use to run bookings, rates, guests, teams and payments. This policy explains what we collect, why, and the choices you have.

For guest data, the host is responsible for deciding what is collected about its guests; we process that data on the host's behalf to run the service.

2. What we collect

• Account details — name, email, phone, role and the properties you manage.
• Operational data — bookings, guests, rates, availability, tasks and messages that you or connected booking channels put into the platform.
• Payment records — the reference, amount and status of payments. Card details are entered on our payment processor's hosted pages; we never receive full card numbers.
• Usage and security data — pages used, device and browser, IP address and sign-in events, used to run the service, detect misuse and alert you to new sign-ins.

3. How we use it

• To provide the service: sending availability and rates to your booking channels, taking direct bookings, producing statements and reports.
• To process payments and send confirmations and invoices.
• To keep accounts secure and to investigate errors.
• To answer support requests and tell you about changes to the service.
• To meet legal obligations, such as keeping invoices.

We do not sell personal data.

4. Who we share it with

• Service providers who run parts of the platform for us: cloud hosting, the database, email delivery, payment processing, channel distribution to booking sites, and error monitoring. They may use the data only to provide their service to us.
• Booking channels you connect — availability, rates and booking details are exchanged with the online travel agencies you choose to sell on.
• People in your own organisation — according to the roles and properties you give them.
• Authorities — when the law requires it.

Data is never shared between unrelated hosts.

5. How long we keep it

We keep account and operational data while your account is active. When an account is closed we delete or anonymise its personal data on request, except records we must keep by law, such as invoices.

Security logs are kept for as long as they are needed to protect accounts and investigate incidents.

6. Security

Data is encrypted in transit and at rest, access is checked by role on the server, and sensitive actions are recorded in an append-only audit log. The full description is on our Security page. No system is perfectly secure; if you suspect someone has accessed your account, contact us straight away.

7. Your rights

Under Indonesia's Personal Data Protection Law (UU PDP) and, where it applies, the GDPR, you can ask to access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent you have given.

Email privacy@aetheriaos.com. We answer within 30 days. Guests should contact the host they stayed with first; we will help the host respond.

8. Cookies

Essential cookies keep you signed in and remember your settings. Analytics and marketing cookies are used only if you accept them in the cookie banner, and you can change that choice at any time. The site works with essential cookies alone.

9. Children

Aetheria OS is a business service and is not directed at anyone under 16.

10. Changes and contact

If we make a material change to this policy we will tell account holders by email or in the app at least 30 days before it takes effect.

Questions: privacy@aetheriaos.com · PT Luxury Leisure Internasional, Bali, Indonesia.