LEGAL

Privacy Policy

Last updated: 4 July 2026

This policy explains what personal data Coco collects and why. It is written to meet the EU/EEA/UK GDPR and Thailand's Personal Data Protection Act (PDPA). It is a good-faith template and should be reviewed by a qualified lawyer before you rely on it commercially.

1. Who we are (Data Controller)

Coco ("Coco", "we", "us") is an AI travel concierge for Koh Samui operated by Cyril Joseph, based in Koh Samui, Surat Thani, Thailand. For any privacy request, contact: privacy@coco-samui-ai.com or via WhatsApp +66 63 375 3316.

2. What we collect and why

Data	Purpose	Legal basis
Chat messages you send to Coco	To generate travel answers. Messages are sent to our AI provider (Anthropic) for processing.	Legitimate interest / consent
Hotel partner enquiry: name, email, phone, property, message	To respond to your enquiry and set up a trial.	Consent / steps prior to a contract
Aggregated, non-identifying usage counts (e.g. questions per property, language)	To improve the service and report to partner hotels.	Legitimate interest
Technical data (IP address, approximate region, user agent)	Security, abuse-prevention and rate-limiting.	Legitimate interest

We do not knowingly collect data from children, we do not sell your data, and we do not require an account to chat with Coco.

3. Processors and third parties

Anthropic (AI model provider) — processes chat messages to produce answers.
Vercel — hosting and serverless functions.
Upstash / Vercel KV (Redis) — stores partner enquiries and aggregated usage counts.
Affiliate partners (Viator, Klook, GetYourGuide, Booking.com) — only if you click a booking link; they then apply their own privacy policies.

4. Affiliate links

Some booking links Coco shows are affiliate links. If you book through them, Coco may earn a commission at no extra cost to you. This never changes the price you pay. See our Terms for details.

5. International transfers

Coco operates from Thailand and uses providers that may process data outside your country (including the EU and the US). Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

6. Retention

Partner enquiries are kept for up to 24 months to manage the commercial relationship, then deleted. Aggregated usage counts contain no personal data and may be kept indefinitely. Chat messages are not stored on our servers and are never used for long-term profiling. Your conversation is kept on your own device only, for up to 24 hours, so Coco keeps the thread as you move between pages — see section 8.

7. Your rights

Under the GDPR and PDPA you may request access, correction, deletion, restriction, portability, or object to processing, and withdraw consent at any time. To exercise any right, email privacy@coco-samui-ai.com. You may also lodge a complaint with your local data protection authority (EU) or the PDPC (Thailand).

8. Cookies & local storage

Coco uses only essential local storage (for the PWA/service worker and to remember your language). We do not use third-party advertising or tracking cookies.

Your current conversation is also stored in your browser's local storage so Coco does not lose the thread when you move from one page to another. It stays on your device, is never uploaded for storage, and expires automatically after 24 hours. You can erase it at any time with the "New conversation" button in the chat header, or by clearing your browser data.

9. Changes

We may update this policy; the "last updated" date above will change. Material changes will be highlighted on this page.