Privacy Policy

Last updated: 14 October 2026

← Back to Caruso

This page explains which personal data is processed when you use carusohuahin.com, its booking form and Caruso AI, the chat assistant of this site, and what choices you have.

1. Who is responsible for your data

The data controller is Caruso Co., Ltd., the Thai company that runs Caruso Italian Restaurant & Pizza, 114 Naresdamri Road, Hua Hin, Prachuap Khiri Khan 77110, Thailand.

For any question about privacy, or to exercise your rights, write to privacy@carusohuahin.com

For bookings and anything else about the restaurant, write to hello@carusohuahin.com

2. Booking form and messages you send us

When you send a booking request we receive the details you enter: name, e-mail address, phone or WhatsApp number, number of guests, date and time, seating preference and, if you add them, the occasion and a message. The language of the page you used is sent with them.

The request is sent by our web server, through the Apple iCloud Mail service, as an e-mail to the restaurant's mailbox (hello@carusohuahin.com). We use it to confirm your table, to contact you about your booking and to prepare your visit. The website does not save booking requests in a database. Once the restaurant has received your request, we send you an automatic e-mail confirming that it has arrived: it is not a booking confirmation.

The form does not ask for health information. For allergies or intolerances, please contact the restaurant directly before ordering. If you nevertheless write this kind of information in your message, we use it only to look after you at the table.

To filter out automated spam, the form also sends the time at which the page was opened. It is not used for anything else and is not kept. To avoid sending the automatic e-mail more than once, or to addresses used for abuse, the server keeps a non-reversible code derived from your e-mail address for 24 hours.

If you write to us by e-mail or WhatsApp, or call us, we use your message and your contact details to answer you. WhatsApp is a service of Meta and applies its own privacy policy.

3. Caruso AI, the chat assistant

Caruso AI is an automated assistant on the Location page. It answers questions using the information published by the restaurant. Its answers may contain mistakes, and it cannot take or confirm bookings.

Please do not enter personal or sensitive data in the chat, such as full names, phone numbers, e-mail addresses, health or payment details. The chat does not need them.

What is processed when you use the chat

• The text of your messages. It is sent to OpenAI, the company that provides the artificial intelligence, in two steps: first to its Moderation service, which checks that the message is acceptable, then to its Responses service, which writes the answer. The first step receives only the message you have just sent; the second also receives the most recent messages of the same conversation, so that the answer makes sense in context.
• With every request to the Responses service we ask OpenAI not to save the exchange among its stored responses (the “store: false” setting). Our site does not send OpenAI your IP address, cookies or any other identifier: only the text.
• This setting does not mean that OpenAI keeps nothing. According to OpenAI's documentation, as we read it on the date of the last update of this page, the content of requests to the Responses service can be kept in OpenAI's abuse-monitoring logs for up to 30 days, the Moderation service does not keep the text it checks, and data sent through these services is not used by default to train OpenAI's models. These periods are decided by OpenAI and may change; they are separate from what our own server keeps, described below.
• A message rejected by the moderation check is not passed on to the assistant and is not kept by our site.
• A technical cookie named caruso_chat. It is created only when you send your first message, its only job is to link your browser to the conversation in progress, and it expires two hours after your last message. It is not used for tracking or advertising.
• A temporary fingerprint of your IP address. To limit abuse (too many messages from the same connection) the server turns your IP address into a code that cannot be turned back into the address and that changes every day. It expires after about one hour. The address itself is not saved by the chat.

How long a conversation is kept

To follow the conversation, our server keeps its most recent messages (twelve at most) in a temporary file. Two hours after your last message the conversation expires and can no longer be continued; expired files are then deleted from the server by an automatic cleanup.

You can delete it sooner: the “New Chat” button erases the conversation from our server immediately and removes the cookie.

We also keep anonymous daily totals: number of conversations and messages, languages, topics, outcomes and amount of text processed. We use them to understand how the chat is used and to keep costs under control. They contain no message text and nothing that identifies a person or a conversation, and they are kept for up to twelve months.

Conversations are not recorded for later reading: this function exists but is switched off. If we ever switch it on, we will update this page first, and the chat will show a clear notice.

4. Cookies and services from other companies

This site does not use analytics or advertising tools. Besides the chat cookie described above, it relies on these services from other companies:

• Google Fonts. The typefaces of this site are downloaded from Google's servers, which therefore receive your IP address.
• Google Maps. The Location page shows a map supplied by Google, which receives your IP address and may use its own cookies.
• Links to other services (Grab, Facebook, Instagram, WhatsApp, what3words). They open the sites of those companies, which apply their own privacy policies. Nothing is sent to them until you click.
• Server logs. As on any website, the servers of our hosting provider may record technical access data (IP address, date and time, page requested, browser) for security and troubleshooting.

5. Who receives your data, and where

Your data is handled by the restaurant and by the providers that make this site work:

• OpenAI (United States): the text of chat messages, as described in section 3.
• Google: fonts and the map, as described in section 4.
• Our web hosting provider (VisperHost): it runs the server of this site, which prepares the e-mails of the booking form.
• Apple (iCloud Mail): it provides the restaurant's mailboxes, hello@carusohuahin.com and privacy@carusohuahin.com, and delivers the e-mails of the booking form.
• Our provider of a server for automated tasks (GalaxyHosts): a server we manage connects to the restaurant's mailbox once a day and deletes the booking requests whose visit date was at least 23 days ago, as described in section 6. It reads the messages only to recognise booking requests and the date of the visit, and does not keep copies of them: its records contain only dates, counts and short codes, with no names, e-mail addresses or message text.

Some of these providers process data outside Thailand, for example in the United States.

6. How long we keep data

• Booking requests: we keep them for up to 30 days after the planned date of your visit, unless a legal obligation or a documented need requires us to keep them longer. This is a rule we have set for ourselves. Every day an automatic procedure deletes from the restaurant's mailbox the requests whose visit date was at least 23 days ago, together with their copies and the automatic e-mail confirming that they arrived. Replies written by our staff, and messages the procedure cannot recognise with certainty, are deleted by hand within the same 30 days. You can ask us to delete yours sooner.
• Other messages you send us: for as long as we need them to answer you. You can ask us to delete them at any time.
• Chat conversation and chat cookie: they expire two hours after your last message; “New Chat” erases the conversation immediately.
• IP address fingerprint used by the chat: it expires after about one hour.
• Anonymous chat statistics: up to twelve months.

7. Your rights

Thailand's Personal Data Protection Act (PDPA) gives you rights over your personal data. They include the right to ask for access to your data or for a copy of it, to have it corrected or deleted, to object to its use or have its use restricted, to withdraw a consent you have given, and to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC).

If you are in another country, the law that applies there, such as the General Data Protection Regulation (GDPR) in the European Union, may give you similar rights. We handle every request in the same way, wherever you write from.

To exercise your rights, tell us what your request is about (for example the name and date of a booking), so that we can find your data, and write to privacy@carusohuahin.com

A note on the chat: conversations are temporary and are not linked to your identity, so we normally cannot find a specific conversation once it has ended. While it is open, you can delete it yourself with “New Chat”.

8. Changes to this page

We update this page whenever the site, or the way we handle data, changes. The date at the top shows when it was last updated.

← Back to Caruso