Privacy Policy
My Best Bali (mybestbali.com) Last updated: 21 October 2026
1. Who we are
My Best Bali is a hand-picked directory of places in Bali: stays, attractions, tours, diving, spas and beaches. The website is available in English, French, German and Indonesian.
The website is run by Ni Luh Srinasih, a private individual (not a company) living in Selat, Kabupaten Buleleng, Bali, Indonesia. She is the data controller for the personal data described in this policy.
Contact for everything about your data: srinasih@mybestbali.com
This policy applies to visitors, to people who create an owner account, and to anyone who sends us a request. It follows Indonesian law, in particular the Personal Data Protection Law (UU PDP, Law No. 27 of 2022). If you visit from the European Union or Switzerland, you keep the rights that your local law gives you (access, correction, deletion and others, see section 8). You can exercise them by writing to the contact address above.
2. What data we collect and why
We only collect data that you give us or that your browser sends when you use the website. We explain each case below.
2.1 Browsing the directory
You can browse listings, regions, the journal and the trip planner preview without an account.
- We keep a small cookie with your currency choice and one with your language choice.
- Your saved places ("Saved") are stored only in your browser (local storage). They never leave your device.
- We count page views and clicks on a listing (view, click on the property website, click on a booking link). These are plain counters per listing and per day. We do not store your IP address, your device details or any cookie for this, and we cannot tell who you are.
2.2 Sending a request to a property
When you send a request through a listing page, we collect your name, email address, message, travel date and number of guests, plus the language you used. We pass this information to the owner of the property so they can answer you. Your email address is set as the reply address, so the property can answer you directly.
We also keep a proof of your consent: the time, your IP address, your browser details and the exact wording of the box you ticked.
If a listing has no email address on file, the request stays with us and we pass it on ourselves.
Legal basis: your consent (the box you tick) and, to answer your request, the steps you ask us to take before a stay.
2.3 Contact form
When you write to us through the contact page, we collect your name and email address, and, if you choose to give them, your phone number, preferred way to be contacted, country, travel dates, group size, interests and message. We use them to answer you. We also keep a proof of consent (time, IP address, browser details and the wording you saw).
Legal basis: your consent.
2.4 Trip planner
The planner preview is free and stores nothing. To unlock the full day-by-day itinerary, you give us your email address and tick a box. We save your quiz answers and the itinerary we built for you, your IP address and browser details, and we email you the itinerary. We use your email address only for this purpose.
Legal basis: your consent.
2.5 Owner accounts
If you create an account to manage a listing, we collect your email address and a password. The password is stored only in a protected, scrambled form (a bcrypt hash). We also record when you agreed to our terms and privacy policy, with your IP address and browser details. A secure cookie keeps you signed in for up to 7 days. We email you a verification link (valid for 48 hours) and, if you ask, a password reset link (valid for 1 hour).
The changes you make to a listing are reviewed by us before they appear on the website, and we keep a log of these changes (who, what, when).
Legal basis: performance of the service you ask for (managing your listing) and our legitimate interest in keeping accounts secure.
2.6 Claiming a listing
To claim a listing, we send a verification link to the official email address of that business. If there is no official address, you can send us your email address, a short explanation and optionally a link as proof. We keep your IP address and browser details to help us spot abuse. A person on our side reviews each manual claim.
Legal basis: our legitimate interest in making sure only the real owner can manage a listing and in preventing fraud.
2.7 Pro plan requests
If you ask for our Pro plan, we collect your email address, the listing concerned, your language, your IP address and browser details. We contact you by email to activate the plan and invoice you directly.
Legal basis: steps taken at your request before a contract, then performance of the contract.
2.8 Monthly reports for Pro owners
Pro owners receive a monthly email with the listing counters described in section 2.1. These counters never contain visitor data.
2.9 Listing content
Listings show business information: name, description, phone number, email address, website, photos. This information relates to businesses, but can be personal data if the business is run by an individual. We collect it from public sources, from the business itself or from its owner. If you want something changed or removed, write to us.
2.10 Google reviews
Some listings show reviews from Google. They include the reviewer's name, photo and text as published by Google. We keep a copy in our database for up to 48 hours to avoid repeated requests to Google.
2.11 Security and error logs
To keep the website stable and safe, we limit login attempts by IP address and email address (kept only in memory for 15 minutes), and we record technical errors with an error-monitoring tool (see section 4). We do not use tracing or session replay.
3. Cookies and similar technologies
| Name | Purpose | Duration | Type |
|---|---|---|---|
mbb_session | Keeps an owner or admin signed in | up to 7 days | Strictly necessary |
mbb_currency | Remembers your currency | 1 year | Functional |
NEXT_LOCALE | Remembers your language | 1 year | Functional |
mbb_saved (local storage) | Your saved places, on your device only | until you clear it | Functional |
| Cookie choice (local storage) | Remembers whether you accepted or declined the affiliate tool | until you clear it | Strictly necessary |
| Session storage | Avoids a reload loop after a website update | until you close the tab | Strictly necessary |
We do not use advertising or analytics cookies of our own.
Affiliate tool (Travelpayouts). The website uses an affiliate tool from Travelpayouts to attribute bookings made through our partner links. It may set cookies in your browser for this purpose. We load it only if you click "Accept" in the cookie banner. If you click "Decline", it is not loaded.
Changing your mind. Your choice is stored in your browser. You can change it at any time with the "Cookie settings" link in the footer of every page, or by clearing the data of this website in your browser.
4. Who receives your data
We do not sell your data. We share it only as follows.
- Property owners, when you send a request (section 2.2): name, email, message, dates, guests.
- Service providers (processors) who help us run the website, all in Switzerland:
- Hosting: Infomaniak Network SA.
- Email delivery (SMTP): Metanet AG.
- Error monitoring: GlitchTip, run by us on Infomaniak cloud servers. It receives technical error reports, which may contain the page address.
- Backups: Infomaniak S3 storage (see section 7).
- Third-party services you reach when you use the website:
- Map tiles from CARTO and OpenStreetMap on listing maps (your IP address is visible to them).
- Google, for the reviews we display (section 2.10).
- Travelpayouts, only if you accept the cookie banner (section 3).
- Booking and activity partners through affiliate links: Stay22, Booking.com, Agoda, Klook and Travelpayouts. We do not send them your personal data. When you click, you leave our website and their own privacy policies apply. We may earn a commission if you book.
- Authorities, if the law requires it.
5. Transfers outside your country
We are based in Indonesia. Our hosting, email, monitoring and backup providers are all in Switzerland, a country the European Union recognises as offering an adequate level of data protection. Data you send us is therefore stored and processed in Switzerland. Where a third-party service you choose to use (for example maps, Google reviews, affiliate partners) is located elsewhere, its own privacy policy applies.
6. Legal bases
Depending on your situation, we rely on:
- your consent (requests, contact form, planner, owner account terms, affiliate tool);
- the performance of a contract or steps before a contract (managing your listing, Pro plan);
- our legitimate interests (security, preventing fraud, keeping the service running, counting visits);
- a legal obligation, when the law requires us to keep or give information.
You can withdraw consent at any time. This does not affect what was done before.
7. How long we keep your data
We keep data only as long as needed for the purpose, then we delete or anonymise it.
| Data | Duration |
|---|---|
| Requests and contact messages | 24 months after the last exchange |
| Trip planner leads | 12 months |
| Pro plan requests | 24 months, or the contract period plus the legal retention period |
| Owner account | While the account is open, then 12 months after closure |
| Claim records | 24 months |
| Consent proof (time, IP, browser) | As long as the related data, then 12 months |
| Verification and reset links | 48 hours and 1 hour |
| Google review cache | 48 hours |
| Listing counters | As long as the listing exists (totals only, no personal data) |
Backups. Our database is backed up every day to Infomaniak S3 storage in Switzerland. Daily copies are kept for 7 days, weekly copies for 5 weeks and monthly copies for 12 months. Data that we delete can therefore remain in backups for up to 12 months, and then disappears.
8. Your rights
Depending on the law that applies to you, you have the right to:
- ask whether we hold data about you, and get a copy;
- correct data that is wrong or incomplete;
- ask us to delete your data, or to stop using it;
- withdraw your consent;
- object to certain uses of your data;
- receive your data in a common format (portability), where the law gives you this right;
- complain to the authority in your country.
To use a right, write to srinasih@mybestbali.com. We may ask you to prove your identity. We answer within 30 days.
If you live in the EU, you can complain to your national data protection authority. If you live in Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC). In Indonesia, you can contact the personal data protection authority established under the PDP Law.
9. Children
The website is not meant for people under 18. We do not knowingly collect data from children. If you think a child gave us data, write to us and we will delete it.
10. Security
We protect data with passwords stored only as hashes, signed and protected session cookies, encrypted connections (HTTPS), limits on login attempts, and access limited to what is needed. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the competent authority as the law requires.
11. Languages
This policy exists in English, French, German and Indonesian. If the versions differ, the Indonesian version prevails (Indonesian Law No. 24 of 2009).
12. Changes to this policy
We may update this policy. The date at the top shows the latest version. If the change is important, we will tell you on the website or by email.
13. Contact
Ni Luh Srinasih, Selat, Kabupaten Buleleng, Bali, Indonesia Email: srinasih@mybestbali.com