Privacy Policy — CCATOO

Version: 1.0

Last Updated: January 1, 2026

This Privacy Policy explains how Vicatoo, Inc. (doing business as “CCATOO”) (“Company”, “we”, “us”, or “our”) collects, uses, shares, and protects your information when you use www.ccatoo.com (the “Site”) and our services.

By using the Site, creating an account, filling out a contact form, or communicating with us via WhatsApp/Email, you agree to the practices described in this policy. Please also review our Terms of Use and Booking & Cancellation Policy.

Official Channels: The official channels for communication are the email support@ccatoo.com and the WhatsApp number mentioned in the "Contact Us" section. Any communication from other channels is not considered official.

1. Information We Collect

We collect information you provide directly to us and information collected automatically.

1.1 Information You Provide

We may collect:

• Account Data: Name (if applicable), email, phone/WhatsApp number, username, and password (encrypted).
• Contact Form: Name, email, phone number, message subject, and content.
• Booking Request Data: Destination, stay dates, number of guests, preferences (e.g., view type, quiet room, kitchen availability...), and any details you send us via WhatsApp/Email.
• Support Communications: Content of chats and correspondence with our team.

Notice: Please do not share sensitive data (such as payment card details or health information). If we receive such data by mistake, we will endeavor to delete it where possible and reasonable.

1.2 Information Collected Automatically (Cookies & Analytics)

When using the Site, we may collect:

• IP address, browser type and device, operating system, pages visited, visit duration, and referral source.
• Data via Cookies and similar technologies.

We use Google Analytics to understand site usage and improve performance. Google may use cookies and similar identifiers to collect usage data in an aggregated form.

2. How We Use Your Information

We use information to:

• Manage Account & Service Delivery: Create accounts, login, and manage settings.
• Coordinate Bookings: Communicate with you, understand your request, coordinate with the hotel, and send the Confirmation Message.
• Customer Service: Respond to inquiries and resolve issues.
• Product & Site Improvement: Analyze performance, improve user experience, and develop features.
• Security & Fraud Prevention: Protect accounts and the Site, and verify suspicious activities.
• Marketing & Advertising (with your consent or where permitted by law): Send newsletters/offers, and manage contact lists and ad campaigns.

3. Marketing (Newsletters & Offers)

We may send you marketing messages (newsletters/offers/updates) via email and/or WhatsApp (depending on your preferences or consent). You can opt out at any time by:

• Clicking the “Unsubscribe” link if available in the message, or
• Emailing us at support@ccatoo.com requesting removal from lists.

Even after unsubscribing, we may send necessary “operational” messages (e.g., related to your account or a booking you requested).

4. Where We Store Your Data (WhatsApp + Google Sheets)

Some WhatsApp conversations may remain within the WhatsApp platform itself.

We may also record contact data and client requests (such as Name/Phone/Email and request summary) in internal tools like Google Sheets or CRM systems to organize work, follow-ups, and marketing.

We implement internal access controls so that data is accessed only by authorized team members. We limit access permissions based on need, and may review/update permissions periodically.

5. Sharing Information

We do not sell your personal information. We may share it only in the following cases:

5.1 With Hotels

We share necessary information to confirm the booking (Name, stay dates, number of guests, preferences) with the hotel or its representative.

5.2 With Service Providers (Processors)

We may share limited data with providers who help us operate the Site and Service, such as:

• Hosting, infrastructure, and email providers,
• Google Analytics,
• Newsletter mailing tools (if used),
• Google Sheets/Google Workspace for internal data organization.

These providers process data on our behalf, under our instructions, and only as needed to provide the service.

5.3 Legal Reasons

We may disclose data if required to comply with the law, protect Company/User rights, prevent fraud, or for system security.

5.4 Business Transactions

In the event of a merger, acquisition, or asset sale, data may be transferred as part of the process in accordance with the law, with appropriate notice where required.

6. Cookies & Tracking Management

You can control cookies through your browser settings. Disabling cookies may affect some Site functions (e.g., login).

We may display a notice or banner to manage cookie preferences according to the country or regulatory requirements, allowing you to accept/reject certain types of cookies.

7. Data Retention

We retain data for the period necessary to fulfill the stated purposes, including:

• Account management,
• Booking coordination and follow-up,
• Marketing (until you opt-out),
• Legal obligations and dispute resolution.

We may retain marketing data until you opt out, and booking/correspondence data for a reasonable period for follow-up, dispute resolution, and compliance. When no longer needed, we delete, minimize, or anonymize it where possible.

8. Information Security

We use reasonable security measures (e.g., access controls, protection technologies, password encryption). However, no transmission or storage method is 100% secure.

9. Your Rights & Choices

Depending on applicable laws, you may have the right to:

• Request access to, correction of, or deletion of your data,
• Withdraw consent for marketing,
• Request restriction of certain processing.

We may request additional information to verify identity before executing requests to protect your account and prevent unauthorized access.

To submit a data-related request, contact us via the email below.

10. Third-Party Links

The Site may contain links to other websites. We are not responsible for the privacy practices of those sites.

11. International Data Transfers

Data may be processed in other countries (e.g., USA) depending on hosting locations or service providers (e.g., Google). By using the Site, you understand that data processing may occur across borders in accordance with this policy.

12. Changes to This Privacy Policy

We may update this policy from time to time. We will update the “Last Updated” date at the top. Continues use of the Site after updates constitutes acceptance of the updated policy.

13. Contact Us