Privacy notice

Help messages

When you use the Help form, Sanya Expats receives the topic, reply email, message, optional name, page language, consent record and submission time. This information is used only to review your request, protect the form from abuse and reply to the address you provide. It is not used for marketing.

Sending a message is optional. If you do not provide a valid reply email, message and the required consent, the form cannot send your request.

Correction reports

When you use the correction form, Sanya Expats receives the page or listing, correction type, report, optional source or evidence, optional contact, page language, good-faith confirmation, consent record and submission time. This information is used only to investigate the factual issue, follow up where possible and update the guide when appropriate. A report is not automatically published and is not used for marketing.

Sending a correction is optional. The form can accept a report without contact details, but it cannot send without the required factual fields, good-faith confirmation and overseas-transfer consent.

Event submissions

When you submit an event, Sanya Expats receives the event facts, organizer name and private contact, language, consent records, submission time and any optional image and credit. This information is used to check the event, contact the organizer if needed, and prepare a listing for possible publication. A submission is not published automatically and is not used for unrelated marketing.

Organizer contact details remain private unless the organizer separately agrees to public display. Optional images remain private during review and are published only after an editor checks the stated rights and approves their use.

Community polls and event updates

When you vote in a community poll on the Community page, Sanya Expats stores your choice, the poll, the time and two one-way HMAC tokens made for that poll: one from a random identifier your browser keeps in localStorage, so each browser votes once, and one from your IP address, so many votes from one network can be capped. The raw identifier and IP address are not stored. Poll results are not published.

Cloudflare Turnstile checks for automated voting using browser and connection signals. When several votes come from one connection, we ask for an email code. With your consent, Cloudflare sends the code to your email; this does not subscribe you to updates. Our database keeps per-poll HMACs of the email and code, rather than the email address or code itself. Codes expire after 10 minutes. Verification and consent records are deleted within three days; the email HMAC stays with a verified vote to prevent that email voting again. These checks are processed outside mainland China.

After voting you can choose to leave an email address to hear when the event is announced. That needs your separate consent. Sanya Expats stores the email, poll, page language, consent record and time, uses them only to announce the event the poll is about, and deletes them automatically within 12 months. To remove your email sooner, write to the Help address below. Votes and emails are processed through Cloudflare and stored with Supabase in Singapore, outside mainland China.

Delivery, storage and overseas processing

Help messages and correction reports are transmitted through Cloudflare to the operator’s Gmail inbox. Event submissions are processed through Cloudflare and stored in the Sanya Expats Supabase database. These services use systems outside mainland China, and each live form asks for separate consent before sending. Direct email to help@sanya-expats.com follows the email route described here.

The overseas service providers are Cloudflare for website and form processing, Google for Gmail storage, and Supabase for the private event-submission database and image storage. They receive only the information needed to provide those services. Review the Cloudflare Privacy Policy, Google Privacy Policy and Supabase Privacy Policy.

Only the operator and authorized editors should access private submissions. Help messages, correction reports and unaccepted private event submissions are normally deleted within 180 days after the relevant request or review, unless longer retention is required for legal or security reasons. Approved public facts and properly licensed images may be retained while the listing is used.

Do not include passport or ID numbers, visa documents, health information, payment details, precise location or other sensitive personal information.

Website analytics

Cloudflare Web Analytics measures aggregate page views, visits and page-performance metrics. Its lightweight browser beacon does not use cookies or localStorage and does not track individual users across Cloudflare customers’ websites. On this proxied site, beacon data is sent to this domain’s /cdn-cgi/rum endpoint and processed by Cloudflare. Sanya Expats excludes known bots when it uses these figures, although bot filtering and aggregate traffic figures remain approximate.

Separately, you can choose optional browser and action analytics. If you accept, first-party Secure, HttpOnly cookies hold a random identifier, scoped to /api/analytics for monthly counting and /api for action measurement. The server turns it into a different one-way HMAC token each month. Private Supabase tables store that month and token, plus daily counts of directions clicks, booking or registration link clicks, and Help enquiries accepted by our email service, grouped by public page path. Page language is derived from that path. Clicks do not confirm a booking or visit, and email acceptance does not confirm inbox delivery.

Analytics does not store form contents, names, contact details, raw browser identifiers, IP addresses, user agents, destination links, URL query strings or fragments. It does not record every page viewed or use fingerprinting. Counts cover consenting browsers, not unique people or all visitors. The current month and previous twelve monthly buckets are retained; daily cleanup deletes older browser records and their action counts. Identifier cookies last up to about 13 months; a monthly marker cookie lasts up to 35 days. Your choice stays in localStorage until changed. Tokens and action records are processed through Cloudflare and stored with Supabase in Singapore, outside mainland China.

Use Analytics choices in the footer to change your decision. Rejecting clears the identifiers and requests deletion of the matching retained monthly tokens and action counts. Earlier acceptance of monthly counting alone does not enable action analytics: a new choice is required. The admin dashboard also offers a browser exclusion for testing; it uses an exclusion cookie and localStorage and affects future optional counts only. Cloudflare’s separate cookie-free aggregate analytics continues either way.

Cloudflare and ordinary website infrastructure may also process limited technical request information needed to deliver pages, maintain security and rate-limit the Help, correction and event forms and the optional counter. Future newsletters or other public submission services will require an updated notice before launch.

Your choices and requests

Use Analytics choices in the footer to accept, reject or withdraw from the optional browser and action analytics.

For access, correction, deletion, consent withdrawal, takedown or another privacy request, email the operator at help@sanya-expats.com.

For a factual problem with public content, you can send a private report through the correction form.

Changes to this notice

This notice will be updated before Sanya Expats activates another form or materially changes how messages are processed. Material changes should be dated and communicated where appropriate.