Privacy Policy

How we handle your information

Last updated: 1 October 2026

Oraya respects your privacy. This page explains what we collect when you book or inquire with us, how we use that information, and how you can reach us with questions. It also explains how Oraya's own app connects to Oraya's Instagram, Facebook and TikTok accounts.

Booking requests and confirmations

Submitting a stay or event form on our site creates a booking request (pending review). It is not a confirmed reservation until our team has approved dates and operations and, where payment applies, you have completed the steps we send you. Data you enter at the request stage is used only to evaluate and respond to that request.

Once a stay is confirmed, we retain the details needed to deliver your reservation, coordinate services, and meet legal and accounting obligations. Event inquiries may proceed as custom written proposals before any confirmation; proposal terms are shared with you explicitly in that process.

Information we collect

When you submit a booking or event inquiry, we collect:

• Your name and email address
• Your phone number and country, when provided
• Booking details: villa, dates, guest counts, add-ons, and any notes you share
• Online payment status and gateway reference metadata from NetCommerce / Credit Libanais / CyberSource when you use secure card payment. Oraya does not collect or store your full card number or CVV.
• Payment references you share with us after we have confirmed your booking and requested payment (Whish reference, bank transfer reference, etc.) - see our Payment Policy for how manual payment works

How we use it

• To review and confirm your booking or event request
• To communicate with you about availability, payment, and your stay
• To prepare your villa and any selected services
• To prepare and follow up on custom event proposals when you have requested an event - pricing and scope are agreed in writing, not inferred from the form alone

Guest responsibilities

You are responsible for the accuracy of the information you submit and for keeping your contact details up to date so we can reach you. Operational and house rules communicated before or during your stay form part of how you use the property. Full contractual responsibilities are summarized in our Terms & Conditions.

Access & operational automation

For confirmed stays, we may issue temporary access credentials (for example digital or physical codes) so you can enter the property at the agreed time. Booking details you provide may be used to coordinate arrival, staffing, and property access in line with your reservation.

• We only request information that is proportionate to operating your stay or event
• Operational messages may reach you by email and through messaging channels you have approved or used to contact us
• We do not collect unnecessary sensitive data; if something optional is ever requested, we will explain why

Oraya's social media accounts

Oraya uses its own app to publish to Oraya's own Instagram account, Facebook Page and TikTok account. This concerns Oraya's accounts only: the app does not collect messages, comments, likes, followers or statistics.

What we publish. Photos, videos and captions about our villas that an Oraya owner has approved in the app, at the time they chose. Nothing is posted without an owner's approval, and only the approved version goes out. Each platform can be switched off at any time. For TikTok, a video is either sent to Oraya's TikTok inbox as a draft that we finish in the TikTok app, or, where TikTok allows it, posted directly with the audience settings chosen on that post.

What we read and keep when an owner connects an account:

• Facebook and Instagram: the Facebook Pages the person connecting manages (names and ids, so the Oraya Page can be chosen), the Instagram account linked to that Page (id and username), and whether the connection is valid and which permissions it has
• TikTok: the account's id and display name; when posting directly, the account's posting options (name, picture, who can see a video, the longest video allowed), shown to the owner before approving and not stored
• To confirm that a post went out, and never post it twice, the app checks the status of each upload and Oraya's own recent posts, and keeps only the id of and link to Oraya's post
• We also keep when the account was connected and by whom, when the connection expires, and a record of each post: what went out, where, when, and its link

Access tokens (the keys that let the app post) are stored encrypted on Oraya's server, with the encryption key kept separately from the database, and are never shown in the app. For Facebook, we keep only the Page's token, not the personal sign-in of the person who connected it.

Disconnecting. An Oraya owner can disconnect an account at any time in the app (Settings › Social accounts › Disconnect): the stored tokens are deleted at once, and for TikTok the app also asks TikTok to end its access. Access can also be removed at the source, which revokes it: in Facebook, Settings › Business Integrations (this also covers the Instagram account linked to the Page); in TikTok, the app permissions in its settings. To have the remaining account details deleted as well, write to us at the address below.

AI tools for Oraya's own photos. Inside Oraya's private marketing app, an Oraya owner can ask an AI service (Google's Gemini, through Oraya's own paid account) to tidy one of Oraya's villa photos, to draw a plain background graphic, or to answer a question about Oraya's marketing. Only the photo or text the owner chooses is sent, only when they ask, and only within monthly spending limits the owners set. The tools may tidy a photo (for example remove a towel or brighten it) but never change what the villa looks like, and every result is labelled and checked before an owner decides to keep it. Guests' booking details are never sent to these tools.

What we don't do

We do not sell, rent, or share your personal information with third parties for marketing. Your details are used by Oraya to deliver your reservation and follow-up communication.

Cancellation and refunds

Privacy-related deletion or correction requests, and questions about refunds after a confirmed booking, are handled in line with our Cancellation & Refund Policy.

Contact

Questions about your data? Reach us at admin@stayoraya.com or by phone at +961 71 140 041.

Registered address:
Street 413, I-126
Hboub, Byblos
Mount Lebanon 4001
Lebanon