Legal
Privacy policy
This policy explains what personal data Samui Local Hub collects, why, how long we keep it, who processes it for us and the rights you have. We collect as little as possible.
Last updated: 13 November 2026
Who we are
Samui Local Hub (samuilocalhub.com) is an independent information platform about Koh Samui with an optional request service for local providers. It is operated by Samui Local Hub, Koh Samui, Thailand. Privacy contact: support@samuilocalhub.com.
Browsing without an account
You can read every public page without an account and without giving us personal data. Our server records technical data needed to deliver and protect the site (request time, page, browser type, and your IP address in short-lived server logs). Security events (for example repeated failed sign-ins) are stored with a one-way keyed hash of the IP address, not the address itself.
Your account
If you register we store: username, email address, a securely hashed version of your password (we can never see or retrieve your password), the date you accepted this policy and the Terms (with their version), whether and when your email address was confirmed, your sign-in times, and the trip plans you save. Optional details — first and last name, country, phone number and preferred language — are stored only if you enter them. Nothing from your account is shown publicly.
Email verification and account emails
We send you the emails needed to run your account: email confirmation, password reset, and security notices such as a changed password or email address. These are not marketing. Links in these emails are single-use and expire.
Newsletter (optional, separate consent)
The newsletter is off by default. We only send it if you switched it on yourself and confirmed your email address. We record when, where and with which wording you gave consent. Every newsletter contains a one-click unsubscribe link, and you can switch it off on your account page at any time.
Requests to local providers
When you send a request (with a form or by confirming a request the AI assistant prepared for you) we collect what that request needs: your name, contact details and preferred channel, dates, party size, accommodation area and anything you write. Our local team sees these details to handle the request, and we share them with the specific local provider needed to fulfil it.
Businesses we list or contact
So visitors can find local businesses, we also list businesses that have not signed up with us. For them we use publicly available business information: OpenStreetMap data (© OpenStreetMap contributors, ODbL) and the contact details a business publishes on its own website — business name, address, location, category, phone number, website, public email address and social media pages. We use it to show a basic listing that is clearly marked as unclaimed, and to contact the business once about the free listing and our partner plans (by email from partners@samuilocalhub.com, or by phone or message from our team). Legal basis: our legitimate interest in an accurate local directory and in telling the business about it. Every introduction email has a one-click link to stop further contact. A business can write to support@samuilocalhub.com at any time to correct or remove its listing or to object to being contacted; we then mark it so we never contact it again.
AI assistant and trip planner
You can chat with our AI assistant without an account, within a daily fair-use limit. The AI trip planner (day-by-day plans) needs a free account with a confirmed email address. Your messages are processed by our AI provider (OpenAI; Anthropic instead, if we switch the assistant to its Claude models) as a processor acting on our instructions; this can involve processing outside Thailand. Chat transcripts are kept for 90 days and then deleted — including any name, phone number or email address you give the assistant, for example when it prepares a booking or availability request for you. A request you then send is handled like any other request (see above). Without an account we count AI messages per day under keyed one-way hashes of your IP address and your browser's user agent, so we can apply fair-use limits; the raw IP address is not stored, the hash cannot be turned back into it and it changes every day. With an account we count usage per account. Please don't enter sensitive information (passport numbers, payment details, health data) in the chat.
Community contributions
If you send a beach report, tip, correction or place suggestion, we store it with your account, the place, the date and the language you used. Photos are re-encoded on our server, which removes location and camera data (EXIF). Everything is reviewed first. Approved beach reports and tips are shown on the place page together with your username; corrections and place suggestions are never published. You can see the status on your account page and ask us to remove a contribution at any time; deleting your account deletes all of them, including photos.
Cookies and statistics
Strictly necessary cookies (sign-in, your cookie choice, the language and theme you selected) are always active. Optional categories — functional storage, statistics, marketing — are used only after you agree in the cookie settings, and you can change your choice at any time via “Cookie settings” in the footer. Our statistics are first-party and cookieless. For the public visitor counter we count every visit anonymously, without cookies and without consent: from the IP address and browser we compute a code that changes every day and cannot be traced back; we store only that code and the date, never the IP address, and delete it after 35 days. Detailed statistics (pages viewed) are used only with your consent. We use no advertising trackers. Details: Cookie policy.
Bot protection
To keep automated sign-ups out we use a hidden form field and timing checks. If Cloudflare Turnstile is enabled on the registration form, Cloudflare processes technical data of your browser to tell humans from bots.
Who processes data for us
Hosting: the site and its database run on a rented server at our hosting provider (OVHcloud). Processors: Resend (delivery of account and service emails; they process your email address and the email content for delivery), OpenAI (AI replies, only for AI features; Anthropic instead, if we switch the assistant to its Claude models), Telegram (our local team receives new requests, request messages and chats handed over to a person — including the contact details in them — in Telegram, which we use as our internal work tool), Cloudflare (DNS, forwarding of emails sent to our @samuilocalhub.com addresses and, if enabled, bot protection) and Apple iCloud Mail (the mailbox those forwarded emails are delivered to). Request details go to our local team and to the provider you asked about. We never sell personal data and never share it with advertisers.
How long we keep it
Account data: until you delete your account (you can do this yourself on the account page). Unconfirmed accounts can be removed after 30 days. AI chat transcripts, including contact details given in the chat and requests the assistant prepared but you never sent: 90 days. The keyed hashes used for AI fair-use limits: erased after 2 days. Request records: as long as needed to arrange and deliver the service and meet legal obligations, then deleted or anonymised. Community contributions: until you delete them or your account; declined or removed ones after 90 days, beach reports after 12 months. Security events: 12 months. Statistics events: 13 months. Consent records: as long as the account exists, as proof of your choices.
Your rights (PDPA and GDPR)
You can ask for access to your data, a copy, correction, deletion, restriction or objection, and you can withdraw consent at any time without affecting earlier processing. Write to support@samuilocalhub.com. You can also complain to Thailand's Personal Data Protection Committee (PDPC) or, if you live in the EU/EEA, to your local data protection authority.
Security
All connections use HTTPS. Passwords are stored only as salted hashes, sessions can be revoked, sign-in attempts are rate-limited and accounts lock temporarily after repeated failures. Staff access to personal data is limited by role and every sensitive admin action is logged.
Changes to this policy
If we change this policy we update the date above. If a change needs your consent again, we ask you the next time you sign in.
Live cams (YouTube videos)
Some pages show live cams from YouTube. Before you tap a cam we show only our own photo, and your browser does not contact YouTube. When you tap play, the video loads from youtube-nocookie.com, YouTube's privacy-enhanced mode, which is provided by Google. From then on YouTube receives your IP address, device details and the page you watch from, and may store data on your device to run the player (for example to remember volume or to limit abuse). We do not get any of this data. Google's privacy policy applies: https://policies.google.com/privacy. If you do not want this, do not tap play. You can open the same stream on youtube.com instead.