Privacy Policy

Yourantai GmbH Via Naccio 50, 6614 Brissago, Switzerland Email: hello@yourantai.ch

• Booking enquiries: name, email, phone (optional), requested dates, party size, message. • Experience requests (tea ceremony, zen, spa): as above. • Guest portal access: email address for magic-link authentication. • Technical data: anonymised server logs (IP, user-agent, timestamp) for abuse prevention — deleted after 30 days. • Cookies: strictly necessary cookies only (session, language preference). No tracking, no profiling, no advertising cookies.

Processing is carried out for the initiation and fulfilment of contracts (Art. 31 para. 2 lit. a revFADP; Art. 6 para. 1 lit. b GDPR), to comply with statutory obligations (notably tax and accounting retention obligations of 10 years) and on the basis of our legitimate interest in operating a secure website.

We use the following service providers under GDPR-compliant data processing agreements: • Hosting & database: Supabase (EU region, Frankfurt). • Web hosting: Lovable / Cloudflare Workers (EU region). • Email delivery: [TODO: e.g. Resend, once active. Currently no automated emails are sent — see note below.] Your data is never shared with third parties for advertising purposes.

Booking and contract data: 10 years (statutory tax retention). Enquiries without a booking: max. 12 months. Server logs: 30 days.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection at any time. An informal email to hello@yourantai.ch is sufficient. Right of complaint: you may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, Bern) and — where the GDPR applies — with the supervisory authority of your country of residence.

The website uses encrypted connections (HTTPS / TLS) exclusively. Database access is protected by row-level security rules. Administrative functions are accessible only via separate admin accounts with role-based permissions.

Booking confirmations and portal invitations are technically prepared but not yet sent automatically — the personal confirmation is sent manually by email. Once the sending domain is active, this statement will be updated accordingly.