Privacy Policy
1. Who we are and what TRZ PMS is
TRZ PMS is the internal reservation and guest-management application of The Resthouse Zamboanga (“the resort”, “we”), Tala Road, Brgy. Lumbangan, Zamboanga City, Philippines. Resort staff use it to manage bookings, guest records, payments, and booking-related emails. It is operated by the resort for its own business. You can reach us at theresthousezamboanga@gmail.com.
2. Information the booking system processes
When a guest submits a booking request, or when staff create a booking, TRZ PMS processes:
- Guest details: full name, mobile number, email address, and (optionally) city or municipality.
- Booking details: dates, package, number of guests, occasion, and special requests.
- Payment records for the booking: amounts, payment method, and reference numbers. TRZ PMS does not store card numbers.
- A record of which version of the resort's House Rules and Damage, Loss & Applicable Charges Policy the guest agreed to, and when.
- A log of booking-related emails sent (recipient, subject, status, and time).
- Optionally, a “Guest Memory” card image that staff upload after a stay.
Guests do not create accounts. Resort staff sign in to TRZ PMS with access codes held by the resort.
3. Google user data and the Gmail permission
To send booking-related emails, the resort owner authorizes TRZ PMS one time to use the resort's Gmail account, theresthousezamboanga@gmail.com. TRZ PMS requests exactly one Google API scope:
https://www.googleapis.com/auth/gmail.send— permission to send email on behalf of that account.
TRZ PMS does not request, and does not have, permission to read the inbox, view messages or labels, modify or delete email, or access contacts or any other Google data. It does not read, modify, or delete the contents of the mailbox.
The only Google-related data TRZ PMS holds is the OAuth credential issued for that one authorization (a refresh token, plus short-lived access tokens obtained from it). No mailbox content is received, copied, or stored.
4. How we use information
- Booking information is used to run reservations, record payments and deposits, contact the guest about their own booking, and keep the resort's business records.
- The Gmail permission is used only to send transactional, booking-related emails to the guest who made the booking (for example a booking confirmation, an optional check-in reminder, and an optional thank-you message). It is not used for marketing or advertising.
5. Google API Services User Data Policy — Limited Use
TRZ PMS's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- Google user data is used only to provide and improve the email-sending feature described above.
- Google user data is not sold and is not used for advertising, including personalized or retargeted advertising.
- Google user data is not used to develop, improve, or train generalized artificial-intelligence or machine-learning models.
- Google user data is not transferred to third parties except as necessary to provide the email-sending feature, to comply with law, or for security.
- Because TRZ PMS never reads mailbox contents, no person at the resort reads Google user data through TRZ PMS.
6. Who information is shared with
We do not sell personal information. Information is processed by the service providers that make TRZ PMS work: Cloudflare (hosting, database, and file storage) and Google (Gmail, to deliver the emails). Booking information is otherwise visible only to authorized resort staff.
7. How information is protected
- TRZ PMS is served over HTTPS.
- The Gmail OAuth credentials are stored only as encrypted server-side secrets. They are never written into the application's source code, never shown in the user interface, and never written to logs.
- Staff areas require an access code, and sensitive settings require a separate manager code.
- Public pages show only the information a guest needs and never another guest's details.
No system is perfectly secure, but we work to keep information safe and to limit access to the people who need it.
8. How long we keep information
Booking, guest, payment, and email-log records are kept for as long as they are needed to run the resort's reservations and to meet accounting, tax, and legal record-keeping needs, and are then deleted or anonymized. The Gmail OAuth credential is kept until the resort revokes it or replaces it.
9. Your choices
- Resort owner: you can revoke TRZ PMS's Gmail access at any time at myaccount.google.com/permissions. Revoking it immediately stops TRZ PMS from sending email; the rest of the system keeps working.
- Guests: you can ask to see, correct, or delete the information we hold about you by emailing theresthousezamboanga@gmail.com. We will act on the request, except where we must keep a record for accounting or legal reasons. We aim to handle personal information in line with the Philippines' Data Privacy Act of 2012.
10. Changes to this policy
If we change how information is handled, we will update this page and its “Last updated” date.
11. Contact
The Resthouse Zamboanga, Tala Road, Brgy. Lumbangan, Zamboanga City, Philippines
Email: theresthousezamboanga@gmail.com