What we know about you

The controller of the personal data described here is MG MGMT LLC, at 407 Palm Drive, Islamorada, Florida 33036, United States, trading as Casago Costa Rica.

For anything on this page — a question, a copy of your data, a deletion request — write to hello@casagocr.com. A person reads it.

Only what a reservation cannot be made without:

• Your first and last name.
• Your email address, and your phone number if you give one.
• The stay itself — which house, which dates, how many guests, and the price quoted.

That is the entire list of what reaches us. We do not ask your date of birth, your nationality or your passport number to take a booking.

Your billing address is asked for in the card field, which belongs to our payment processor rather than to this site — see below. Your bank uses it to check the card. It is given to them, not to us, and it is not stored on this website.

Your card number never reaches this website. The card field on the checkout page — the number, the expiry, the security code and the billing address — is served by Guesty from Guesty’s own systems and is not part of this site’s page. What comes back to us is a reference to your card, not the card.

This is not a claim about how careful we are. It is a property of how the page is built: our servers cannot log a card number because they are never sent one. Guesty holds the card, through GuestyPay, their own payment service.

Inside that field Guesty runs its own fraud checks and may set its own cookies to do so. That is Guesty’s processing under Guesty’s privacy policy, and it is the one place any cookie appears on this site at all.

Two companies, neither of them buying anything from us:

• Guesty — the reservation system our whole operation runs on, and, through GuestyPay, our card processing. Your booking and your contact details live there so that the team on the ground knows who is arriving. They also hold your card; we hold a reference to it.
• Vercel — the hosting this site runs on, and its analytics.

Where a stay requires it, the house’s owner or a building’s security may be told the name and arrival date of the guest — that is how gated communities work in Costa Rica. Nothing else is passed on.

We do not sell personal data, we do not share it for advertising, and there is no advertising network on this site.

Page views and a short list of interactions: a property opened, a search run, an enquiry sent, a booking started. They exist to answer one question — whether booking direct is working — and they are deliberately built so that they cannot identify anybody.

There is no user id, no session id, and no email, name or phone number in any of it. Nothing is fingerprinted. An event records a house or an action, never a person.

Because of that, this site sets no analytics cookies and you will not find a cookie banner on it. A banner would be theatre: there is nothing to consent to.

Houses you save are held in the address bar — the shortlist lives in the URL of the page you are looking at, which is why you can send it to whoever you are travelling with by pasting a link.

Nothing is stored on our side and nothing is stored in your browser. Close the tab without saving the link and the shortlist is gone.

The owner enquiry form collects your name, an email address, a phone number if you give one, and whatever you write in the message. It is used to reply to you about managing your property and for nothing else.

We keep your booking and payment records for seven years after your stay ends, and then delete them. Seven years is the period United States federal and Florida tax rules require us to be able to produce records for. Anything we do not need for that — the messages you send us about a stay, for example — is deleted sooner. You can ask us to delete your data before then and we will, apart from records we are legally required to keep.

Analytics data carries no identity, so there is nothing in it to delete on request and nothing in it that expires as personal data.

Wherever you live, and regardless of which law happens to reach us, we will do all of the following on request:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete it, unless we are required to keep a booking record for tax or accounting.
• Stop sending you anything you did not ask for.

Write to hello@casagocr.com. We will answer within thirty days and normally a great deal sooner. You do not have to give a reason and we will not make it difficult.

If you are in the UK or EU and you think we have handled this badly, you are entitled to complain to your national data protection authority. We would rather you told us first.

Our suppliers are United States companies and their systems are largely in the United States, so booking with us means your details are processed there and in Costa Rica. Guesty operates standard contractual protections for transfers out of the UK and EU.

This site is for adults making travel bookings. We do not knowingly collect anything about children. Children in your party are covered by the occupancy count on your booking — we hold a number, not names.

The site is served over HTTPS everywhere. There are no guest accounts and no passwords on this site, which removes an entire category of risk rather than managing it. Payment data is held by Guesty, not by us.

If you believe you have found a security problem with this site, tell us at hello@casagocr.com and we will take it seriously.

If what we do changes, this page changes with it, and the date at the top moves. See also the terms of stay and the cancellation policy.