Privacy policy

Misty Mountain Haven is a small campsite in Barangay Kibalabag, above Malaybalay City in Bukidnon, and we are the personal information controller for everything on this page. In plain words: we decide what is collected and why, and we answer for it.

We're a small team, and the people who read your booking are the same people who'll welcome you at the gate. We'd like you to feel as comfortable handing us your details as you will by the fire.

To see, correct or delete what we hold about you, or just to ask how we handle it, reach us through any of the channels on our contact page. A real person will answer you directly.

When you book, we collect the name, email address and phone number you give as the lead guest, roughly what time you expect to arrive, any notes or requests you type in, the number of adults, children and infants in your party, your dates, your accommodation and any extras, the amounts, the full name of each guest traveling with you, and whether each guest is male or female. Each guest gets their own gate pass, which is why we ask for their names. If you'd rather not give them, the form uses "Guest 2", "Guest 3" and so on instead.

When you pay by QR Ph, you scan a code with your own GCash, Maya or banking app. When card payment is available, you enter card details on PayMongo's secure hosted checkout. We never receive your card number or CVV. Your account details stay inside that app and never reach us. What we receive back from our payment provider is whether the payment went through, the amount, the method and the provider's reference.

Some earlier bookings were paid by GCash transfer, and for those we hold the receipt image the guest uploaded and the GCash reference number our staff recorded when they checked it. We no longer ask for receipts.

When you arrive, we record the time each guest is checked in and which member of our staff did it.

Our gate and reception staff also keep operational messages and assistance requests to coordinate your arrival. These may include your name, booking reference, accommodation, arrival details and the concern being handled, together with the staff sender, message time, delivery and read receipts, and request status history. Access is limited to authorized staff accounts. Staff are instructed to leave contact details, payment details and sensitive information out of these messages.

If you tick the optional box on the review step to hear from us, we record that you said yes, and when. If you later say no, we record that too.

When you write to us through the contact form, we receive the name, email address and message you send, as an email. Nothing else on that form is kept.

Automatically, we record your IP address against booking attempts and against attempts to sign in to the staff area, so that one address can't flood the booking system. That's the only thing it's used for.

We don't collect sensitive personal information as the Act defines it: no government ID numbers, no health information, no religious, political or other affiliations. Please don't put any of it in the notes field.

To take and honor your booking: your name, contact details, party, dates, accommodation, extras and amounts. The lawful basis is section 12(b) of the Act, processing that's necessary to fulfill a contract with you and to take the steps you asked for before it. We can't hold a booking without these, which is why the form requires them.

To send the emails a booking needs: your confirmation, your gate passes, a friendly note before you arrive, and anything about a change or cancellation. Same basis, section 12(b). These aren't marketing, and every guest gets them.

To let you in: guest names and each guest's gate pass. Same basis.

To report our visitor numbers to Malaybalay City: how many of our guests were male and how many female. The city asks accommodations for this count, so the lawful basis is section 12(c), compliance with a legal obligation. We report totals only, never a name.

To answer your message: the contact form. The lawful basis is your consent under section 12(a), since you chose to write to us.

To keep the records the law asks of any business: booking and payment records kept for tax and accounting purposes. The lawful basis is section 12(c), compliance with a legal obligation.

To keep the site safe: the IP addresses behind booking and sign-in attempts, and a record of every change our staff make to a booking. The lawful basis is section 12(f), our legitimate interest in protecting the booking system and the staff area. It doesn't override your rights, because the data is minimal and is used for nothing else.

To understand how the site is used: we count page visits and measure how quickly pages load, using our hosting provider's cookie-free statistics. Visitors are counted with an anonymous code that resets every day, so nobody can be followed from one day to the next or across other websites. The lawful basis is section 12(f), our legitimate interest in a site that works well on a mountain connection. The two booking events we count carry only the accommodation, the number of nights and the payment method, never your name or contact details.

We don't sell your data, we don't share it for advertising, and we don't profile you or make automated decisions about you.

Beyond the booking emails above, we only write to you if you tick the optional box on the review step. Leaving it empty changes nothing about your booking.

If you do say yes, there are only two kinds of email you'll get from us: a gentle reminder if you start a booking and don't finish it, and a hello about a year after your stay, in case the mountain is calling again. The lawful basis is your consent, section 12(a).

Every one of those emails has an unsubscribe link, and one click is all it takes. You can also ask us through the contact page. Withdrawing your consent never affects a booking you've already made.

To remember returning guests, the owner may keep a short note on your guest record, such as a favorite cottage. You can ask to see it, change it or have it removed, like anything else we hold.

Our own staff, to look after your stay. Every staff account belongs to one named person, and every change made to a booking is logged with who made it and when.

A few trusted service providers, each a personal information processor acting only on our instructions. Our hosting provider, Vercel, runs the website. Our database provider, Supabase, stores the booking records. Our email provider, Resend, delivers our emails and only ever receives the address and the message being sent. Our payment provider, PayMongo, a Philippine company, handles QR Ph and, when available, card payments under its own privacy policy. Card details are entered on PayMongo's hosted checkout; we never receive or store your card number or CVV.

Google, for the map on our home and contact pages. It loads as you scroll to it, and Google's own privacy policy applies to it.

Anyone we're legally required to share it with: a court order, a lawful request from a government agency, or the Bureau of Internal Revenue in the ordinary course of keeping records.

Our hosting, database and email providers process data on servers outside the Philippines; the booking records themselves are stored in Tokyo, Japan. We remain accountable for it under the Act wherever it's stored, and they are bound by contract to process it only as we instruct.

Booking records (your details, your stay, your payments) are kept for three years after your check-out date. After that they're either deleted or stripped of anything that identifies you, so only anonymous stay figures remain. The Act doesn't set a number; it asks that data be "retained only for as long as necessary", and three years is the period we have set for ourselves.

Receipt images from earlier GCash payments are deleted along with the rest of their booking, three years after its check-out date.

Contact form messages are kept for one year, or longer if the conversation turned into a booking, in which case they follow the booking.

Your yes or no to our occasional emails is kept for as long as we hold your guest record, so we can always show what you agreed to.

The IP addresses recorded against booking attempts are kept for 24 hours, and those recorded against staff sign-in attempts for one hour.

Records we're required to keep for tax or accounting purposes are kept for as long as that law requires, even where that's longer than the periods above. That's the one thing a deletion request can't reach.

As a guest, you'll get just one cookie from us. It remembers the booking you're part way through, so a refresh or the back button doesn't lose your dates. It's signed so it can't be tampered with, and it expires on its own after 24 hours. Staff who sign in to the admin area also get cookies that keep them signed in and remember their screen settings.

There are no advertising cookies, no analytics cookies and no third-party trackers on this site. There's nothing here to opt out of.

For signed-in staff, the browser tab keeps message drafts and uncertain sends in session storage so a brief disconnection or a minimized chat does not lose them. They are cleared when staff sign out or a different account opens that tab. Sending or retrying always checks the signed-in account. The notification mute preference is saved separately on the device.

Your own browser also keeps a little for you, on your device only. If you're on the guest details step and lose your connection, what you've typed is saved so you don't have to start over. It's cleared when you reach the review step, it expires after 24 hours, and the "Start fresh" button removes it right away. The browser also notes whether you've already seen our opening animation, so it doesn't play every time. None of this is sent to us.

Under the Act, you have the right to be informed of what we hold and why, which is what this page is for. You can also ask to access a copy of it, have anything inaccurate corrected, object to processing or withdraw a consent you gave, and have data blocked or erased where it's incomplete, outdated, unlawfully obtained or no longer needed. You can receive an electronic copy in a portable format, and you have the right to be indemnified for any damage caused by inaccurate, unlawfully obtained or unauthorized use of your data.

To use any of them, write to us through the contact page and tell us which right you're using and which booking it's about. Your booking reference is the quickest way for us to find you. We'll answer within 30 days, and if we can't do what you asked, we'll explain why.

To have your data deleted: just ask, and we'll delete your booking record, your guest names, your notes, your guest record and any receipt image. Two things survive that request, and it's fairer to tell you now than for you to find out later: the booking and payment figures we must keep for tax and accounting purposes, and the fact that particular dates were occupied. Both are stripped of anything that identifies you.

If you're not happy with how we handled a request, you can complain to the National Privacy Commission at privacy.gov.ph. You don't need to come to us first.

We take care to keep your data safe: staff accounts are individual and password protected, every connection to the site is encrypted, and payment details never touch our systems.

If your data is ever exposed in a way that's likely to put you at real risk, we'll tell you and the National Privacy Commission within the 72 hours the Commission requires, along with what happened and what you can do to protect yourself.

The version at the foot of this page changes whenever the words do. If a change affects what we collect or why, we'll say so here plainly rather than quietly reissuing it.