Privacy policy

hotelkhaolak.com is an independent guide to Khao Lak and the Andaman coast. We are a publisher. You cannot buy anything here, you cannot create an account, and we never see your payment details — bookings complete on the merchant’s own site.

That keeps the picture simple: we hold very little about you. The parts worth reading carefully are the scripts other companies run on our pages, because those are not ours — and none of them start until you answer the cookie banner.

Before you choose, nothing that measures you runs. Measured in a browser on 19 October 2026, from a browser with nothing stored: every request goes to this site, none to another company, and no cookie is set. Cloudflare, which sits in front of this site, still serves the pages and so receives your IP address with every request; it also sends your browser a hint about which page you are likely to open next, which reports nothing about you. Two things do happen whatever you choose, and the banner does not control either: the partner IDs on our booking links, and the logs described under “Our own records”.

Until 19 September 2026 this paragraph said something else. Cloudflare’s Web Analytics script was injected into every page before anyone was asked, measuring page views for every visitor. It set no cookies, but it was measurement without consent, so it was switched off; the figures it had already collected stay in our Cloudflare account.

If you accept, these load:

• Google Analytics 4, on every page. It sets cookies named _ga and _ga_0VL2P0NC02, which let it recognise a returning browser and last up to two years, and we use it to see which articles are read. Google receives the full address of each page you view — on our hotel search results that includes what you searched for, your dates and the number of guests — the page you came from, your device and browser, and an approximate location worked out from your IP address. Google’s advertising features stay off: ad storage, ad user data and ad personalisation are all set to “denied”. When you click a booking link, our server tells Google Analytics which partner, which link and which page, using the ID in your _ga cookie, and passes on your browser’s identification string and your IP address so Google can work out the device and the approximate location, as it does for the pages you view. It does this only if that cookie is there, which means only after you accept.
• GetYourGuide: a partner-analytics script on every page. It tells GetYourGuide which of our pages you view — the full address, including any hotel search terms and dates, the page you came from, and your browser and language — and sends a last report as you leave each page. It does so under a visitor ID that GetYourGuide’s own server assigns, and can link to GetYourGuide’s cookies if your browser allows them. On this site it sets a session_id cookie, deleted when you close your browser, and stores the visitor ID (gyg_visitor_id, in session storage) and our partner ID (partner_id, in local storage).
• Viator: the tour cards on our home page, the Similan, Surin, Khao Sok and Takua Pa guides, the tours and things-to-do pages, and our Khao Lak hotel pages show Viator’s photos from Tripadvisor’s servers. Before you accept, the cards show no photo and make no request to them. Until 17 October 2026 our home page also showed Viator’s own listings in a frame from viator.com, where DataDome, a bot-detection service, set a datadome cookie on viator.com; that frame is gone.
• Travelpayouts: the flight search on our flights page. Measured on 8 and 19 October 2026, it sets tpwl_currency and tpwl_locale cookies that remember your currency and language for a year, and runs Snowplow, an analytics tracker, which sets a _sp_id cookie that lasts two years and a _sp_ses cookie that lasts less than a day. It keeps __wlcc and snowplowOutQueue_sp in local storage and __wlft and __wlrt in session storage. With the “Show hotels” box ticked, a search also opens Booking.com hotel results in the tab you searched from, and shows the flights in a new tab.
• Travelpayouts Drive, on every page: a script from Travelpayouts (tp-em.com) that can turn links to travel companies into partner links and show travel offers. When it starts, it reports the visit to Travelpayouts: the address of the page, the page you came from, your screen size, how far down the page you are, your language, whether an ad blocker is on, whether your browser is in private mode, and the ID in your Google Analytics _ga cookie, which lets Travelpayouts connect what it records with that ID. Travelpayouts keeps that report under its own privacy policy. Drive may set an am_user_session cookie, a visit ID that expires 30 minutes after your last page view, and keep one entry, YeaMoAvnmSamSLml, in local storage: it did both when we measured it on 8 October 2026, and neither when we measured it again on 19 October. It changed none of our booking links. Withdrawing consent removes both and stops it loading; the reports it already sent stay with Travelpayouts.
• Google AdSense, on every page since 10 October 2026, which is how this site shows ads. The ads are not personalised: the same “denied” setting that keeps Google Analytics’ advertising features off also tells AdSense not to use ad cookies or build an interest profile from your visit. Google still receives the address of the page, your browser and an approximate location from your IP address, to choose an ad and count it, under its own privacy policy. If Google sets its ad cookies anyway (__gads, __gpi, __eoi), withdrawing consent removes them, and rejecting stops AdSense loading at all.

If you reject, none of that loads, on this visit or later ones. Your choice is stored in your own browser, in local storage, as cmp_decision, with the time you chose in cmp_decision_at and the version of the banner you answered in cmp_version — when we change what the banner asks about, we ask again. Accepting also stores tp_consent_granted, which is what the scripts above wait for. We keep no other record of your choice. On every page where you have not accepted, the site also removes any of the cookies and IDs above that a script left on this site — including Google Analytics cookies set before 14 September 2026, when an earlier version of this site loaded Google Analytics before asking.

The booking links in our own pages pass through a redirect on our domain, which adds the partner ID that tells the merchant we sent you. Links to Klook, KKday, Tiqets, Welcome Pickups, Kiwitaxi, GetTransfer, intui, BikesBooking, Localrent, GetRentacar, Yesim and Airalo then pass through the Travelpayouts network — KKday links also through the Involve Asia network, and Airalo links through the Impact network — on their way to the merchant. Links to Viator and GetYourGuide go to them directly. Each of those sees the visit, as any site you pass through does, records it so that we are credited, and may set cookies on its own domain as you pass.

When our redirect runs, our code writes one line to our application log: the time, which partner, which product, and a label for the page the link was on. It holds no name, email address or IP address, and no cookie is set. We do not count or analyse these lines yet. The log is rotated daily and only the last 14 days are kept, so each line is deleted within about two weeks.

Separately, like most web servers, ours keeps logs of the requests it serves, booking-link clicks included: your IP address, the address requested (with any search terms), your browser and the page you came from. We use them to keep the site running and secure, and they are deleted within two weeks. Cloudflare, which sits in front of the site, keeps its own logs under its own privacy policy.

Results in the flight search go straight to the airline or agent, through Travelpayouts, and do not pass through our redirect. Every other booking link on this site does. See our affiliate disclosure for how the commission side works.

• Cloudflare sits in front of this site. It receives every request, including your IP address, in order to serve the page; may fetch pages you are likely to open next, from this site only; and may have your browser report failed connections to it. Its Web Analytics, which measured every visitor before any choice, was switched off on 19 September 2026.
• Our host, Linode (Akamai), provides the virtual machine in Singapore that our web server runs on. The server’s logs described above are ours.
• Google receives Analytics 4 events, and serves the ad library — only if you accept.
• GetYourGuide runs its partner analytics on every page, and Tripadvisor’s servers serve the photos on our Viator tour cards — both only if you accept.
• Travelpayouts runs the flight search and Drive, only if you accept, and receives the visit reports described above, including your Google Analytics ID; and whenever you follow a booking link to one of the twelve merchants named under “Our own records” it passes you on to the merchant, with Involve Asia in between for KKday and Impact for Airalo.
• The booking sites we link to — Klook, Viator, GetYourGuide, KKday, Tiqets, Welcome Pickups, Kiwitaxi, GetTransfer, intui, BikesBooking, Localrent, GetRentacar, Yesim and Airalo, and Travelpayouts itself if you follow the referral link on our About page — receive you as a referred visitor, along with the ID that identifies us. Hotels and tour operators hear about your booking from them, not from us.

Once you land on a merchant’s site you are on their property, under their privacy policy, not ours. We have no visibility into what you do there beyond eventually being told a booking happened.

Our server is in Singapore, and the companies above handle data in several countries, including the United States (Cloudflare, Google and Viator).

If you are in the EU or UK, the GDPR gives you the right to ask what we hold about you, to have it corrected or deleted, to restrict or object to how it is used, and to receive it in a portable form. If you are in Thailand, the PDPA gives you comparable rights. You can exercise them by writing to privacy@hotelkhaolak.com. You can withdraw cookie consent yourself, at any time, with the button under Changing your mind further up this page. Withdrawing stops future collection; it does not undo what was collected before.

In practice we hold very little that could be about you: no account, no contact details unless you sent them to us, click records that carry no identifier and our server’s request logs, both kept for up to two weeks, and — if you accepted — the Google Analytics data for your browser. For that, write to us rather than to Google: it is our analytics property, and we can delete a browser’s data if you send us the value of your _ga cookie. Copy it before withdrawing consent, which deletes the cookie.

You can also complain to your data protection authority — in the UK the ICO, in the EU your national regulator, in Thailand the PDPC.

Changes

When what we do changes, this page changes with it and the review date at the top moves. We do not quietly broaden it. This is a plain-language policy written to be read, not a document designed to be skipped — if any of it is unclear, that is a fault worth telling us about.