How we treat your details

A showcase site

Casa Vellum is an invented hotel and this website is a showcase build by Phoenix Codes. Requests sent through it are stored so that the booking flow can be shown working, and no one will reply. If you only want to try the form, please use made-up details. The rest of this page describes how the site handles data as if the hotel were real, because that is how a hotel's site should work.

Who we are

The controller of your data is Casa Vellum Unipessoal Lda, Travessa do Trigo Novo 9, 1100-399 Lisboa, Portugal. You can write to us at stay@hotel.phoenixcodes.org.

What we collect

We collect data in one place: the booking request form. It stores:

• your name and e-mail address, which are needed to reply;
• a telephone number and notes, only if you choose to give them;
• the room, dates and number of guests you asked for, and the price shown to you;
• a one-way hash of your IP address and a request number, which we explain below.

We do not store your IP address itself. To limit abuse, the server turns it into a salted one-way hash. The hash lets us count how many requests come from the same place in an hour, which is capped at five, and it cannot be turned back into an address. Server logs hold the request number and the outcome, never a name, e-mail address, note or address.

Why, and on what basis

We use your details to answer your request and, if you stay, to prepare your stay. The basis is steps taken at your request before a contract (article 6(1)(b) of the GDPR). The hash and the request number serve our interest in keeping the form free of abuse (article 6(1)(f)). We do not use your details for marketing, and we do not sell them.

Who sees it

The people at the house who answer requests. Two companies process data on our behalf: Cloudflare, which hosts the website, and Neon, which hosts the database, in the United States (the AWS us-east-1 region). Both are bound by data processing terms, and transfers rely on the standard contractual clauses. No one else receives your details.

How long we keep it

A request is kept for 24 months so that we can find it if you write again, and then deleted. Hashed rate-limit entries expire after a day and are cleared out on a rolling basis. If you want a request deleted sooner, write to us with the reference you were given and we will delete it within 30 days.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Write to stay@hotel.phoenixcodes.org. If you think we have handled your data badly, you may complain to the Comissão Nacional de Proteção de Dados (CNPD) in Portugal, or to the authority where you live.

Cookies and tracking

The site sets no cookies and loads no analytics, advertising, social media or third-party scripts. The fonts are served from our own domain. Your browser may remember small things for the site's own use, such as a form you have half filled, and none of that leaves your device.