Your data

Privacy Policy

Last updated 21 September 2026

The short version: this website has no contact form, sets no cookies and loads nothing from anyone else. Unless you write to me, no personal data about you reaches Araya.

Who is responsible

When you visit this site

The site is delivered by Cloudflare. Like every web server, Cloudflare records technical data needed to send you the page and to keep the site available:

• your IP address
• date and time of the request
• which file was requested
• browser and operating system as your browser reports them
• the page you came from, if your browser sends one

This data is used to deliver the site, to keep it working and to defend against attacks and abuse. The legal basis under the GDPR is the legitimate interest in operating a secure website, Article 6(1)(f). Cloudflare acts as a processor on behalf of Araya Consulting LLC.

What this site does not do

• No cookies are set by this site.
• Nothing is written to local storage in your browser.
• There is no analytics, no statistics tool and no heat mapping.
• There are no advertising pixels and no social media trackers.
• The typefaces are served from this site's own server, so no request goes to Google Fonts or any other font provider.
• There is no contact form, no newsletter and no embedded video.

That is the whole picture. If it changes, for example because a booking form or a pixel is added later, this page will change with it before the feature goes live.

When you write to me

The site shows two email addresses. If you write to one of them, your address, your name if you give it and the content of your message are processed in order to answer you. The legal basis is Article 6(1)(b) of the GDPR where your message concerns a possible engagement, and Article 6(1)(f) otherwise.

Messages are kept as long as the conversation is live and afterwards for as long as the resulting business relationship requires. Where tax and commercial law demand longer retention of business correspondence, that applies.

Nothing is sold or shared

Personal data is not sold, not rented, and not shared for anyone else's advertising. Nothing is shared for cross context behavioural advertising as that term is used under California law.

Where data is processed

Araya Consulting LLC is based in the United States, and email is read there. Cloudflare delivers the site from servers around the world, so a request from Europe is usually answered from within Europe, while the company behind the site sits in the US. If you write from the European Economic Area or the United Kingdom, your message therefore reaches the United States.

Your rights

If you are in the European Economic Area or the United Kingdom, the GDPR gives you the right to ask what data is held about you, to have it corrected or deleted, to have its processing restricted, to receive it in a portable form, and to object to processing based on legitimate interest. You can also complain to a supervisory authority in the country where you live.

If you are a California resident, you have the right to know what personal information is collected, to have it deleted or corrected, and to opt out of sale or sharing. As set out above, nothing is sold or shared, so there is nothing to opt out of.

To use any of these rights, write to legal@araya-retreats.com. There is no fee, and you will get an answer within one month.

Security

The site is served over HTTPS only. Since it collects nothing, there is no account, no password and no stored customer record connected to this website.

Children

This site is not directed at children and is not intended to collect data from anyone under 16.

Changes

If the site changes in a way that affects this policy, the policy is updated first and the date at the top changes with it.