Privacy Policy

This policy explains what personal data Island Index ("Island Index", "we", "us") collects when you use our website and mobile experience, why we collect it, and what you can ask us to do with it. It covers https://islandindex.mv, including the accounts, business pages, posts, bookings and advertising tools offered on it.

Summary. We collect the information you give us (account and profile details, content you post, verification documents, and booking or advertising records) plus limited technical data needed to operate and secure the service. We use automated services to check content before publication, which means your post text and images are sent to those providers for that purpose. We do not sell your data and we do not use advertising networks or third-party analytics. You can ask us for a copy of your data, to correct or delete it, or to withdraw consent, and we respond within 30 days.

1. Who we are

Island Index is the data controller for the personal data described in this policy. We operate https://islandindex.mv from Republic of the Maldives, and we handle personal data in accordance with the data protection laws of Republic of the Maldives.

Where our hosting, email or content-screening providers process data on our behalf, they act as processors under written data processing terms and are not independent controllers for your information.

2. What we collect

We collect three broad categories of information.

2.1 Information you give us

• Account information. Your name, email address, username, password (stored only as a one-way hash), and a birthdate. We use the birthdate solely to confirm you meet the minimum age requirement of 18 years, as set out in section 10.
• Profile information. Your profile photo, bio, location (atoll and island), and contact methods you choose to publish, such as phone, WhatsApp, Viber, Telegram and contact email.
• Business information. If you create a business page, the business name, handle, business type, logo, address, description, opening hours, and the registration details you supply when applying for a verification badge.
• Verification documents. If you request a verified badge we require an identity document and a business profile from the Economic Ministry portal. These are handled through our verification team.
• Content you post. Post text, images, product and room details, prices, contact details you publish, comments, reviews, replies, and reposts.
• Advertising and payment records. Campaign details you submit, the amount and duration you pay for, and the payment confirmation you provide. We do not store full card or online-banking credentials; advertising and booking payments are settled directly with the payee and confirmed to us.
• Booking requests. Where you use travel booking, the stay details, guest name, contact email, party size, check-in date and any notes you provide.
• Support correspondence. The subject, topic and message of any support ticket you submit, plus any reply we send.

2.2 Information we receive from Google when you sign in with Google

If you choose to sign in or register using Google, you are taken to Google's own sign-in screen and Google authenticates you, not us. We never see or store your Google password, and we cannot read it at any point.

With your permission at that screen, Google returns only the following, and we store it on your account:

• Your Google account identifier — a unique, non-meaningful code that lets us recognise you on future sign-ins. It is not your email address and reveals nothing about you on its own.
• Your email address, together with Google's confirmation that you have verified that address yourself. We will not connect a Google sign-in to an existing account unless the address on that account was already verified here.
• Your name and profile picture, if you have set them, used to pre-fill your profile. You can change or remove either one afterwards.

We request only the openid, email and profile permissions, which are the minimum needed to confirm who you are and read the three items above. We do not request access to your contacts, calendar, files, location or browsing activity, and we do not use Google to show you advertising. Your Google access token is not stored after your identity has been read, and is not retained for any later purpose.

If you would rather not use Google, an account can be created and signed into with an email address and password instead, and you can add Google later if you change your mind. Choosing Google does not weaken your security: if your account has two-factor authentication enabled, you are still asked for your code.

2.3 Information we collect automatically

• Server logs. IP address, browser and device type, requested URL, referrer and timestamps, retained for security and troubleshooting.
• Search and interaction records. Searches you run, the results shown, which results you click, and interactions with posts, pages and advertisements, used to operate the directory and to measure campaign performance.
• Session information. A session identifier so you stay signed in, and, if you choose "Stay logged in", a long-lived authentication token described in section 8.2.
• Rate-limiting records. Short-lived counters used to prevent abuse of login, password-reset and two-factor endpoints.

2.4 What we do not collect

We do not sell your personal data, and we do not run advertising networks, cross-site tracking pixels or third-party analytics. We do not ask for national identity numbers from general users; identity documents are collected only and only for business verification, as described in section 2.1.

We do, however, use third-party automated services to check content before it is published. What is sent to them, and why, is set out in sections 5 and 6.

We also do not receive your Google password, your existing passwords, or your browsing activity elsewhere on the internet, whether or not you sign in with Google.

Separately from sign-in, this site loads its text font from Google's font servers, which means Google sees your IP address and the fact that a page was requested. No cookie is set by this and it is not used to profile you, but it is a connection to a third party, so we are telling you about it. See section 4.1 of the Cookie Policy.

3. How we use your data

• To create and operate your account, business pages and content.
• To authenticate you, keep you signed in, and verify your email address or phone number.
• To enforce the minimum age requirement.
• To moderate content, respond to abuse reports, and enforce our Terms.
• To operate search, the feed, recommendations and advertising, including counting impressions and clicks.
• To verify a business and to revoke verification where it is no longer valid.
• To process booking requests and hand the necessary details to the property concerned.
• To send service messages such as security alerts and verification outcomes.
• To answer support tickets.
• To detect, investigate and prevent fraud, abuse and security incidents.
• To meet legal, tax and regulatory obligations.

We use your information to send updates only where you have agreed to receive them. Service messages about your account, your content, or a security event are not marketing and are sent regardless of marketing consent.

4. Legal bases for processing

Where Republic of the Maldives data protection law applies, we rely on the following bases:

• Performance of a contract — operating your account, publishing your content, and processing bookings and advertising you have purchased.
• Legitimate interests — securing the service, preventing abuse, moderating content, improving search and recommendations, and understanding aggregate usage. We balance these against your rights and privacy.
• Legal obligation — retaining records we must keep for tax, regulatory or dispute purposes.
• Consent — marketing email, and any optional analytics we may enable in future. You may withdraw consent at any time.

5. Automated tools and AI

Some processing on the platform happens without a person reviewing each item. It matters to you because content you post is sent to external automated services in order to be checked.

• Text checking before publishing. When you create or edit a post, its title and text are sent to an AI language model to check for harmful or unlawful content. A separate pattern-based check also looks for contact details in the title. If content is flagged, the model is asked for a suggested rewrite, which we show you.
• Image checking before publishing. Images you upload are sent to an automated image screening service, which checks for nudity, weapons, gore, violence, alcohol, tobacco, medical content and self-harm. If that service cannot return a result, the image is instead sent to an AI vision model for the same check.
• Writing and metadata assistance. If you ask for help with a description, post suggestions, title ideas, category or tag suggestions, or a clearer report, the text you entered is sent to an AI language model. You decide whether to use any suggestion, and nothing is published without your action.

These services act on our instructions and are used only to perform the check or produce the suggestion. We do not use your content to train general-purpose models. The image screening service receives the image file itself; the text services receive the post text you have typed.

Automated checks can be wrong. If content is rejected and you disagree, you can edit it and try again, or contact us using section 13 and ask for human review. Where an automated result has a significant effect on an account, a person reviews it before we act.

6. Who we share it with

We share personal data only in these circumstances:

• Service providers who host the site, send transactional email, process payments, or deliver messages, each limited to the function we engage them for.
• Google, for sign-in only. If you choose "Continue with Google", the identity details listed in section 2.2 are transferred to us by Google, acting as the provider that authenticates you and as a processor for that single purpose. Google is not given a copy of anything you post here, and is not used to advertise to you. Signing in this way is always your choice, and the email-and-password route works identically without it.
• Automated content-screening providers. Post text is sent to an AI language model for content checking, and uploaded images are sent to an image screening service (or, if that service is unavailable, to an AI vision model). These providers act as processors for that purpose only, as described in section 5.
• The business or property you interact with. If you send a booking request, the property receives your name, contact email and the stay details needed to confirm it. A business page owner sees the contact details and interactions on their own page.
• Other users, deliberately. Content you post publicly — posts, comments, reviews, business pages, your profile name and photo — is visible to other users and may be indexed by search engines. Do not include in a public post anything you would not want published.
• Law enforcement or regulators where we are legally required to disclose, and where we will notify you unless prohibited by law.
• A buyer or successor in a merger, reorganisation or sale of assets, with notice to you and the same protections continuing.

We do not sell your personal data to third parties, and we do not share it for their own marketing. We do not share your personal data with advertising networks or third-party analytics providers.

7. Retention

We keep data only as long as it serves the purpose it was collected for:

• Account and profile data — while your account is active, then deleted or anonymised within 30 days of closure.
• Published content — while it is on the platform, and for up to 90 days afterwards if you delete it, before permanent removal. Content subject to a moderation or legal hold is retained until the hold is lifted.
• Verification documents — for as long as the badge is held, then deleted. We do not keep identity documents after a verification decision is made unless needed to resolve a dispute.
• Booking and payment records — for the period required by tax and accounting law in Republic of the Maldives, typically 5 to 7 years, after which they are deleted.
• Support tickets — 24 months from closure.
• Server logs — up to 30 days, extended to 90 days where an investigation is open.
• Rate-limiting counters — pruned automatically within about 24 hours.
• Sign-in tokens — expire one year from issue, and are deleted immediately on logout, on revocation, or when two-factor authentication is changed or disabled.
• Google account identifiers — held for as long as your account is active, because they are what lets us recognise you when you sign in with Google. They are removed along with the account. If you would like the link between your account and a Google identity removed before then, ask us and we will clear it; you can still sign in with your email address and password afterwards.

8. How we protect it

8.1 General measures

Passwords are stored as one-way hashes and are never recoverable. Data in transit uses HTTPS. Access to administrative tools is role-restricted and separately authenticated from the main site, and sensitive actions are recorded.

8.2 Staying signed in

If you select "Stay logged in", we issue a long-lived authentication token so you do not have to sign in on every visit. The token is random, is stored on our servers only as a keyed one-way hash, and is presented to us as a rotating pair so that a copied token cannot be replayed. It is scoped to your account, expires one year after issue, and is deleted when you log out, revoke the device, or change your two-factor settings. You can review and revoke individual devices from your security settings at any time. Signing out on one device does not sign you out elsewhere; revoke the device if you no longer have it.

8.3 Two-factor authentication

Two-factor authentication adds a second step at sign-in. When you use it, we may treat the device as trusted so you are not challenged repeatedly; a trusted device is still covered by the token controls in section 8.2 and can be revoked at any time. Enabling, changing or disabling two-factor authentication revokes all existing sign-in tokens, including trusted devices.

8.4 What we cannot protect against

No system is perfectly secure. If a breach affects your personal data and creates a risk to your rights, we will notify you and the relevant regulator without undue delay as required by law.

9. Your rights

Subject to the law that applies to you, you may:

• Ask what personal data we hold about you and request a copy.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to delete your data where we no longer have a reason to keep it.
• Ask us to restrict or object to certain processing.
• Receive your data in a portable, machine-readable form.
• Withdraw consent, where we rely on it.
• Ask us to remove the link between your account and a Google identity, and continue using your account with a password only.
• Complain to your data protection authority.

How to exercise these rights: use the support ticket form on our Help Center, or email [email protected]. Please describe what you want, and include enough detail for us to find the right account. We will confirm receipt, verify your identity so we do not disclose your data to someone else, and respond within 30 days. If we decline a request we will explain why and tell you how to complain.

You can withdraw a marketing email at any time using the unsubscribe link, or by contacting us. Note that service and security messages will continue.

10. Children

Island Index is not directed at children, and you must be at least 18 years old to create an account. We verify this against the birthdate you provide at sign-up and enforce the limit on the server as well as in the browser. We do not knowingly collect personal data from anyone under this age. If you believe a child has created an account or provided us personal data, contact us using section 13 and we will remove it.

11. Cookies

Island Index sets no advertising or analytics cookies, and runs no third-party tracking. We use only the cookies needed for the site to function. Our Cookie Policy lists each one, its purpose, and its lifetime.

The cookies in use are ISLANDSESSID, which keeps your session active and expires when you close the browser, and island_remember, which is set only when you choose "Stay logged in" and keeps you signed in for up to one year. Both are HttpOnly and SameSite=Lax. We do not use a CSRF cookie: our CSRF token lives in the server-side session and is delivered inside forms, so the browser never attaches it automatically. Because the first two are required for security, blocking them will prevent you from signing in.

12. Changes to this policy

We may update this policy as the platform, the law, or our practices change. The date at the top always reflects the current version, and material changes will be announced on the site or by email before they take effect. Continuing to use Island Index after a change means you accept the updated policy.

13. Contact us

For any privacy question, rights request, or complaint, reach us at:

• Island Index
• Registered address: to be published. Contact us using the details below and we will provide it in writing.
• Email: [email protected]
• Support: https://islandindex.mv/help