Privacy Policy

Tropical Villa Rentals (“we”, “us”, “our”) operates an online marketplace that connects overseas property owners with verified local contractors across Jamaica. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the choices and rights you have.

It applies to our website and platform, and to everyone who uses them — property owners, contractors, and prospective users browsing the site. It does not cover third-party websites or services we link to, which have their own privacy policies.

Privacy and data protection are a primary design principle for us, not an afterthought. We aim to collect only what we genuinely need, hold it securely, and be honest with you about how it is used.

Tropical Villa Rentals is the data controller for the personal data processed through the platform — meaning we decide how and why your data is used. We engage carefully chosen service providers (“sub-processors”) who process certain data on our behalf and under our instructions; these are listed in the sharing section below.

If you have any questions about this policy or how your data is handled, you can reach us through the contact details in the final section. We are happy to explain anything in plain language.

We collect information that you provide directly, information generated as you use the platform, and a limited amount of technical information from your device. Depending on your role, this may include:

Account & identity

• Your name, email address, password credentials and login activity — handled by our authentication provider, Clerk. We do not store your raw password; authentication is managed securely on your behalf.
• Optional sign-in via Google, where you choose it, which shares basic profile details (such as your name and email) with us through the provider.
• Your account role (property owner, contractor, or administrator) and account status.

Contractor profile & verification

• Business and profile details — the services you offer, the parishes you cover, your description, rates and availability.
• Verification and onboarding information you submit so our team can review and approve you before you take bookings.
• Profile and work images you upload to showcase your services.

Property owner details

• Property information and addresses needed so a contractor can attend and complete a job.
• Booking details — the service requested, dates, locations, notes and any instructions you provide.

Activity, content & payments

• Bookings, estimates, messages relating to a job, and the status and history of work carried out.
• Reviews and ratings you write, and any responses to them.
• Images and files you upload, which are stored on our file storage provider, Cloudflare R2.
• Payment metadata — such as the amount, currency, date, status and a reference for each transaction. We do NOT store your full card number. Card details are entered with and held by our third-party payment processor, never on our servers.

Technical & usage data

• Server and security logs — including your IP address, browser type, device and operating system, and timestamps of requests — used to operate, secure and troubleshoot the service.
• Essential cookies and similar technologies that keep you signed in and your session secure (see the cookies section below).

We use your personal data to run a safe, reliable marketplace and to deliver the services you ask for. Specifically, we use it to:

• Create and manage your account and keep you signed in securely.
• Operate the marketplace — let owners discover contractors, request work, and let contractors list services, manage availability and accept bookings.
• Fulfil bookings, including sharing the details necessary for a contractor to attend and complete a job at a property.
• Process payments and arrange contractor payouts through our payment processor, and apply our platform commission.
• Support safety, trust and verification — reviewing contractor applications, displaying honest reviews, and detecting fraud or misuse.
• Provide customer support and respond to your questions and requests.
• Send transactional and service emails — such as booking confirmations, account notices and security alerts — through our email provider, Resend.
• Maintain, secure, debug and improve the platform.
• Comply with our legal obligations and enforce our terms.

Where data-protection law requires a legal basis, we rely on the following, depending on the activity:

• Performance of a contract — to provide the platform, fulfil bookings and process the payments you have asked for.
• Legitimate interests — to keep the platform secure, prevent fraud and misuse, support and improve the service, and operate our business, balanced against your rights.
• Consent — where we ask for it, such as optional communications; you can withdraw consent at any time.
• Legal obligation — to meet record-keeping, tax, accounting and other legal requirements that apply to us.

We do not sell your personal data. We share it only where it is necessary to run the platform, with the following categories of recipients:

Between owners and contractors

To fulfil a booking, we share the details needed for the job — for example, a property address and booking instructions with the assigned contractor, and a contractor’s profile and contact-relevant details with the owner. We share only what is reasonably necessary to complete the work.

Service providers (sub-processors)

• Clerk — authentication and account management.
• Cloudflare R2 — secure storage for images and uploaded files.
• Resend — delivery of transactional and service emails.
• Our third-party payment processor — to take card payments and arrange payouts; card details are handled by them, not by us.
• DigitalOcean — cloud hosting and infrastructure for our application and database.

These providers process data on our behalf, under contract, and only as needed to deliver their service.

Legal & safety

We may disclose information where we believe in good faith it is required to comply with the law, respond to lawful requests, enforce our terms, or protect the rights, property and safety of our users, the public or us.

We rely on essential cookies and similar session technologies to make the platform work — chiefly to authenticate you, keep you securely signed in, and protect your session against misuse.

Because these cookies are strictly necessary for the service to function, the platform will not work properly without them. We keep our use of cookies lean and avoid unnecessary tracking.

We keep personal data only for as long as we need it for the purposes set out in this policy, and then delete or anonymise it.

• Account, profile and booking records are kept while your account is active and for a reasonable period afterwards.
• Payment and transaction metadata may be kept longer where we must retain it to meet legal, tax and accounting obligations.
• Security and server logs are retained for a limited period to help us operate and protect the service.

When data is no longer needed, we securely delete it or remove information that could identify you.

Security is central to how we build and run the platform. While no online service can be guaranteed perfectly secure, we apply industry-standard safeguards designed to protect your data, including:

• Encryption in transit — traffic to and from the platform is served over HTTPS.
• Least-privilege access — access to personal data is restricted to those who need it to do their job.
• Secure handling of credentials and payment details by specialist providers, so sensitive secrets and full card numbers are not stored on our servers.
• Validation of input and careful handling of uploads to guard against common attacks.
• Logging and monitoring to help us detect and respond to security issues.

If we ever become aware of a security incident affecting your personal data, we will act promptly and notify you and any relevant authorities where required to do so.

Subject to applicable law, you have rights over your personal data. These may include the right to:

• Access the personal data we hold about you and request a copy.
• Correct information that is inaccurate or incomplete — you can update much of this directly in your account.
• Delete your data, where there is no overriding reason for us to keep it.
• Object to or restrict certain processing, and withdraw consent where we rely on it.

To exercise any of these rights, contact us using the details in the final section. We may need to verify your identity first, and we will respond within the timeframe required by law. You also have the right to complain to a relevant data-protection authority.

Our marketplace is, by its nature, cross-border: many property owners are overseas while the work and contractors are in Jamaica. As a result, your personal data may be processed in countries other than the one you live in.

Our service providers may also process data in different regions. Where data is transferred across borders, we take reasonable steps so that it remains protected to a standard consistent with this policy and applicable law.

The platform is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to remove it.

The platform may contain links to third-party websites or services that we do not control. This policy does not apply to those sites. We encourage you to review the privacy policy of any third party before sharing your information with them.

We may update this Privacy Policy from time to time to reflect changes to the platform, our practices, or legal requirements. When we do, we will revise the “last updated” date at the top of this page.

If we make material changes, we will take reasonable steps to let you know. Your continued use of the platform after an update means you accept the revised policy.

If you have questions about this policy, want to exercise your rights, or have a privacy concern, please get in touch through our contact page. We will be glad to help and to explain how your data is handled.