Privacy Policy: stays.co

Last Updated: September 24th, 2026 Operator: Greater Wave LLC dba Stays, stays.co ("Stays," "we," "us," or "our")

This Privacy Policy describes how Stays collects, uses, processes, shares, and protects your personal information when you access or use our platform, including our website at stays.co, any subdomains, the Host Portal, the Traveler Portal, the Creator Portal, Stays AI, Connectors, mobile applications, APIs, dashboards, and related tools (collectively, the "Platform"). This Policy also explains your privacy rights and choices.

This Privacy Policy is incorporated into and forms part of our Terms and Conditions (the "Terms"). Capitalized terms not defined here (such as Host, Traveler, Organization, Stay, Lead, Invite, Offer, Membership, Stays AI, Connector, and Creator) have the meaning given in the Terms.

By accessing or using the Platform in any capacity, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your information as described. If you do not agree with this Policy, you must not use the Platform.

The short version of what matters most: Through Leads and Invites, a Host sees only that an interested traveler exists, what that traveler did on their listing, and a first name; you decide if and when you contact the Host, and you can opt out of Leads entirely. Section 4 explains how that works. Separately, Section 3 describes the other ways your name, email address, and general location may be shared, including with Hosts, business partners, and our affiliates, and Section 12 describes how to opt out of that sharing where the law gives you that right.

1. Information We Collect

We collect information to provide and improve our services, communicate with you, and operate our business. The types and categories of information we collect depend on how you interact with the Platform and whether you use it as a Traveler, a Host, a Creator, or a combination.

a. Information You Provide Directly

When you create an account, set your preferences, submit a Stay application, create or join an Organization, purchase a Promotion, Giveaway, or Membership, enter a Giveaway, favorite a Stay, send or respond to an Invite, use Stays AI, apply to the Creator Marketplace, opt in to notifications, or communicate with us, you may provide us with:

• Contact and Identity Information: First and last name (both required for an account), email address, phone number, and physical or business address. If you sign in with Google, we receive your name, email address, and profile image from Google as authorized by you.
• Account Information: Password (stored in hashed form; not collected if you sign in with Google), profile photograph, how you intend to use Stays (list a property, find places to stay, or both), and account preferences.
• Traveler Preferences and Activity: Regions you follow, settings and vibes you prefer, property types, favorites and trips, saved Offers, Giveaway entries and reminders, your responses to Invites, whether you allow Hosts to send you Invites, and your notification settings.
• Host and Organization Information: Your Organization's name, description, size tier, location or service area, year you started hosting, logo and cover photo, social profiles, contact information, and custom links; the email addresses of team members you invite and the roles you assign them; details about each property, including address, photographs, descriptions, amenities, rate range, booking and social links, Special Interests, and any Offers or Openings; ownership and operational details you choose to provide (not independently verified by us); and the content of Invites you send, including personal notes, private offer terms, and redemption instructions.
• Membership and Payment Information: Which Membership you hold, its billing frequency and status, billing address, and payment method details. Payment processing is handled by our third-party payment processor, Stripe. Stays never stores full payment card numbers.
• Stays AI Inputs: Prompts, questions, and messages you send to Stays AI; text you paste and URLs you provide (for example, an existing listing page for Stays AI to draft from); your shortlist; conversation titles; and the actions you ask Stays AI to take.
• Connector Authorizations: When you connect a third-party AI assistant to your Stays account, the permissions you grant (read-only, or read plus actions), the access tokens we issue, and a log of the requests and actions made through the Connector.
• Creator Information: If you apply to or participate in the Creator Marketplace, your name, handle, home base, years creating, bio, platforms and handles, audience figures, content focus and themes, regions you travel to, what you offer, typical arrangements, usage-rights positions, logistics (such as stay duration, party size, and travel with a pet), free-text special considerations, recent work links, and your requests to Hosts.
• Giveaway Entry Information: Information submitted in connection with entering Giveaways, including contact information, entry responses, Instagram handle where applicable, and any optional information requested in the Official Rules for a specific Giveaway; for winners, the Winner Acceptance form and related prize documents.
• Communications: The content of your communications with us, including customer support inquiries, feedback, survey responses, and reports of other Users.
• User-Generated Content: Any content you upload, post, import, or submit to the Platform, including Stay photographs, descriptions, captions, Org Page content, Creator profiles, media imported from a URL you provide, and media imported from your linked social media accounts.

A note on free-text fields. Some fields (such as Invite notes, Creator special considerations, and Stays AI prompts) accept free text. Please do not enter sensitive personal information (such as health, disability, or financial account details) in these fields. Anything you choose to enter is processed and displayed as you direct.

b. Information We Collect Automatically

When you access or use the Platform, we may automatically collect certain information about your device and usage, including:

• Usage and Interest Signals: Pages, listings, Org Pages, and Offers viewed; searches you run, including the regions you search; Stays favorited or added to trips; Offers saved; Giveaways entered; booking, host, and social links clicked; Invites opened and answered; Stays AI features used; time and date of visits; session duration; and navigation patterns. For signed-in Travelers who have Invites enabled, some of these signals are used to identify you to a Host as an anonymized Lead, as described in Section 4.
• Notification and Email Engagement: Whether notification emails we send are delivered, opened, or clicked, and which in-app notifications you open.
• Device Information: IP address, device type, operating system, browser type, browser language, unique device identifiers, mobile network information, and screen resolution.
• Log Data: Server logs including IP address, request type, referrer URL, device event information, crash reports, and timestamps, including logs of requests made through Connectors.
• Location Information: General location (typically city or state level) inferred from your IP address. We do not collect precise geolocation information without your explicit consent.
• Cookies and Tracking Technologies: Information collected through cookies, web beacons, pixels, and similar technologies, as described in Section 6 below.

c. Information from Third Parties

We may receive information about you from third-party services and sources, including:

• Sign-In Providers: If you sign in with Google, we receive the profile information Google provides as authorized by you. Google manages the security of that sign-in and, if you use it, the email address on your account.
• Third-Party AI Assistants (Connectors): If you connect Claude, ChatGPT, or another supported AI assistant to your Stays account, we receive the requests that assistant makes on your behalf and, where you have allowed actions, the actions it asks us to take. We do not receive your conversations with that assistant beyond what it sends to Stays.
• Listing Pages You Provide: When you give Stays AI the URL of an existing listing (for example, on a booking platform) so it can draft your Stay application, we retrieve the publicly available content of that page at your direction.
• Linked Property Management Systems: If you link your Host account to a PMS (such as Lodgify, Hostfully, OwnerRez, or similar), where supported, we may receive listing, calendar, and operational information as authorized by you and your PMS provider.
• Linked Social Media Accounts: If you connect your Instagram, TikTok, Facebook, or other social media account, we may receive profile information, media, and other data as authorized by you and the third-party platform.
• Outlets and Social Platforms: We may receive engagement data from the Outlets and social media platforms where Promotions and Giveaways are published, including comments and follows used to verify Giveaway entries.
• Payment Processor: We receive transaction confirmations, subscription status, fraud signals, and limited payment metadata from Stripe.
• Analytics and Advertising Partners: Aggregated or pseudonymized data about how users find and interact with the Platform.
• Public Sources: Publicly available information that helps us verify Host and Creator claims, prevent fraud, prepare Draft Listings as described in the Terms, or curate the Platform.

d. Sensitive Personal Information

Stays does not intentionally collect sensitive personal information as defined under applicable privacy laws (such as government identifiers, financial account numbers beyond what is necessary for payment, precise geolocation, race or ethnic origin, health information, or biometric data). To the extent any sensitive information is incidentally collected (for example, if you include such information in a customer support communication or a free-text field), we use it only as necessary to respond to your request or display the content as you directed, and do not use it for inference, advertising, or any purpose requiring opt-in consent.

2. How We Use Your Information

We use the information we collect to operate, improve, and protect the Platform and our business. The legal bases for our processing include:

• Performance of our contract with you: To provide you with the services you request, including account creation, Stay applications, Organizations, Promotions, Giveaways, Offers, Leads and Invites, Memberships, Stays AI, Connectors, the Creator Marketplace, and notifications.
• Our legitimate business interests: To operate, improve, and secure the Platform, develop new features, conduct analytics, prevent fraud, and market our services in a manner that does not override your rights.
• Compliance with legal obligations: To meet our legal, regulatory, and tax obligations.
• Your consent: For specific purposes where we obtain your consent, such as certain marketing communications, precise geolocation, Connectors, or optional features.

Specifically, we use your information to:

Provide and maintain the Platform, including creating and managing your account and Organizations, processing Stay applications, publishing listings and Org Pages, facilitating Promotions and Giveaways, displaying Offers and Openings, surfacing Booking Links, operating the Traveler Portal (feed, favorites, trips, saved Offers, and Invites), billing and managing Memberships, and providing customer support.

Operate Leads and Invites, including recording a signed-in Traveler's interest in a Stay, calculating an approximate interest score, showing that interest to the Host in the anonymized form described in Section 4, delivering Invites, applying Invite allowances, limits, and cooldowns, and notifying each party of Invite activity.

Operate Stays AI and Connectors, including generating responses to your prompts using your account data and the Platform's listing data, drafting Stay applications and listing content from material you provide, taking the in-account actions you ask for, and authenticating and serving requests from AI assistants you connect. See Section 5.

Rank and personalize, including calculating Strength Rankings, ordering listings in the directory, search, collections, and feeds (which takes Host Premium status into account as described in the Terms), personalizing your Traveler feed from your preferences and favorites, and recommending Stays, Offers, and Giveaways.

Improve the Platform and Stays AI, including understanding how the Platform is used, developing new features, and evaluating and improving the accuracy and usefulness of Stays AI and other AI Tools, which may include reviewing conversations and outputs.

Connect you with Hosts, partners, and affiliates, including sharing your name, email address, general location, and interests with Hosts, business partners, and our affiliates as described in Section 3, so that they can contact you about stays, offers, products, services, and promotions that may interest you, subject to your opt-out rights.

Communicate with you, including sending account, security, billing, and legal notices; service notifications about your Stays, Promotions, Giveaways, Offers, Invites, and Organization; optional activity emails you have turned on; marketing communications (subject to your preferences and applicable law); responses to feedback and inquiries; and announcements about the Platform.

Secure the Platform, prevent fraud, and enforce the Terms, including detecting and addressing fraud, abuse, spam, manipulated Giveaway entries, artificial engagement, security incidents, chargebacks, and harmful or unlawful activity; verifying Hosts, Creators, and Giveaway winners; and taking the enforcement actions described in the Terms.

Conduct analytics and research, including measuring Platform performance, understanding user behavior, providing Hosts with analytics about their own listings (in aggregate or anonymized form as to Travelers), conducting surveys, and producing aggregated insights.

Comply with legal obligations, including responding to lawful requests from authorities, complying with tax and regulatory requirements, and protecting our rights and the rights of others.

3. How We Share Your Information

We may share your personal information in the following circumstances:

Publicly and With Other Users. Information you submit as part of a Stay listing (including property details, photographs, descriptions, location, rate range, links, and Offers) and as part of an Org Page (including your Organization's name, description, branding, links, and Stays) is visible to Visitors and Users of the Platform and may be surfaced through Stays AI and Connectors. Your Organization's name appears on every listing it hosts and on every Invite it sends. Openings, where available, are visible to Travelers following the relevant region.

With Hosts, as Anonymized Leads. If you are a signed-in Traveler with Invites enabled, Hosts whose Stays you interact with can see that an interested Traveler exists, identified only by first name (or a placeholder), together with the type of activity, an interest level, and the time of last activity. Through the Leads and Invites feature itself, Hosts do not see your last name, email address, phone number, or other contact information. Section 4 describes this in full, including how to opt out.

With Hosts, Organizations, and Property Managers. Beyond anonymized Leads, we may share your name, email address, general location, and information about your interests and activity on the Platform with Hosts, their Organizations, and their property managers: (i) when you knowingly provide that information to a Host through a Platform feature, such as winning a Host's Giveaway, submitting an inquiry, contact, or booking request, responding to an Offer or Invite in a way that asks for your details, or choosing to share your contact information with a Host; and (ii) for the purpose of connecting interested Travelers with Hosts and helping Hosts market their Stays, fill availability, and follow up on Offers, Invites, Openings, and Giveaways. Hosts who receive your information are required under the Terms to use it only in connection with their Stays and in compliance with applicable law. Where applicable law treats this sharing as a sale or sharing of personal information, you may opt out as described in Section 12.

With Business Partners and Co-Marketing Partners. We may share your name, email address, general location, and information about your interests (such as the regions, property types, and Stays you follow) with business partners, including property management system providers, travel and hospitality brands, booking and payment partners, and promotional and co-marketing partners, so that they can offer you products, services, and promotions that may interest you, so that we can run joint promotions and Giveaways with them, and so that they can onboard you to services you have expressed interest in. These partners' own privacy policies govern their use of your information once they receive it. Where applicable law treats this sharing as a sale or sharing of personal information, you may opt out as described in Section 12.

With Our Affiliates. Stays is operated by Greater Wave LLC. We may share your information, including your name, email address, and general location, with Greater Wave LLC and its other brands, businesses, and social media outlets, and with any parent, subsidiary, or affiliate we may form in the future (for example, a corporate entity formed to hold the Stays business), for purposes consistent with this Policy, including operating the Platform, marketing Stays and affiliated brands and outlets to you, and analytics. Our affiliates are bound by this Policy with respect to information they receive from us.

With Travelers, When You Send an Invite. If you are a Host and send an Invite, the Traveler sees your Organization's name, the Stay, your personal note, the private offer, and, once they say they are interested, your redemption instructions and any link you included.

Within Your Organization. Team members of an Organization can see the Organization's Stays, Leads, Invites, analytics, Promotions, Giveaways, Offers, and notifications according to their role. Owners can also see billing and Membership details. Anything you contribute to an Organization is visible to its other team members as their roles allow, and Stays may rely on instructions from any Owner.

With Hosts and Creators in the Creator Marketplace. Creator profiles are currently shown to approved Hosts and to Stays, not to Travelers or the public. When a Creator sends a request about a specific Stay, the Host sees the Creator's profile and note. Where both parties are interested, Stays may make an introduction, in which case each party receives the contact information the other has provided for that purpose.

With Service Providers. We share information with third-party service providers who perform services on our behalf, including:

• Stripe (payment processing, subscription billing, and the billing portal)
• Email delivery providers (transactional, notification, and marketing email), such as Brevo or Mailgun
• Google (Firebase Authentication for sign-in, and Google Cloud for hosting, storage, and secrets management)
• AI model providers that power Stays AI and other AI Tools (including but not limited to Anthropic and OpenAI), as described in Section 5
• Hosting, content delivery, and infrastructure providers
• Property Management System integrations (where authorized by you)
• Analytics, performance monitoring, and error reporting services
• Customer support and internal operations tools
• Marketing and advertising partners

These service providers are permitted to use your information only for the purposes for which we engage them and are required to protect your information in accordance with applicable law.

With Third-Party AI Assistants You Connect. When you authorize a Connector, the AI assistant you connect (such as Anthropic's Claude or OpenAI's ChatGPT) can retrieve the Stays data your account and roles can access and, if you allow actions, act on your behalf. That assistant, and the company that operates it, receives whatever data you or the assistant request through the Connector and handles it under its own terms and privacy policy, not this one. This sharing happens only at your direction and is not a sale. You can revoke a Connector at any time from the assistant's settings, which invalidates its access.

With Outlets and Social Platforms for Promotions and Giveaways. When you purchase a Promotion or Giveaway, we share relevant content about your Stay and Organization with the designated Outlets and social media platforms for publication. For a Giveaway, your Organization and Stay are identified on the Giveaway Page and the announcement post as the prize provider.

Giveaway Administration. As described in the Giveaway Terms, we may share an entrant's information with the participating Host or prize provider, fulfillment services, or other parties as necessary to verify eligibility, administer the Giveaway, and deliver the prize. Winners may be announced by first name, last initial, and city and state, and the winner's first name, Instagram handle, likeness, and city and state may be used in promotion of the Giveaway.

When You Click Booking Links. When you click a Booking Link from a Stay listing, Offer, Invite, or Org Page, you leave the Platform and are directed to a third-party booking platform (such as Airbnb or Vrbo) or a Host's direct booking site. The third-party platform's or Host's privacy policy and practices apply to information you provide there. Stays may receive aggregated click-through or referral information.

For Business Transfers. In connection with, or during negotiations of, any merger, acquisition, financing, reorganization, conversion or change of corporate form, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of the transaction. We will notify you of any change in ownership or use of your personal information as required by law.

For Legal Reasons. We may disclose information when required by law or in good faith to:

• Comply with a legal obligation, subpoena, court order, or governmental request
• Protect and defend the rights or property of Stays or Greater Wave LLC
• Prevent or investigate possible wrongdoing in connection with the Platform, including fraud, abuse, and manipulated Giveaway entries
• Protect the personal safety of Users or the public
• Protect against legal liability

With Your Consent. We may share your information for any other purpose with your explicit consent.

Aggregated or De-identified Data. We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you with third parties (including Hosts, in the form of listing analytics) for industry analysis, research, marketing, and other lawful business purposes.

Sale and Sharing Under State Privacy Laws. Stays does not sell personal information for money. However, some of the disclosures described above, in particular sharing your name, email address, general location, and interests with Hosts and with business and co-marketing partners, may be considered a "sale" or "sharing" of personal information under the California Consumer Privacy Act and similar state laws, because those parties may use the information for their own purposes or because we receive a benefit in exchange. The categories of personal information that may be sold or shared in this way are identifiers (name, email address), general location, and commercial and internet activity information (your interests, favorites, and activity on the Platform), and the categories of recipients are Hosts and their Organizations, and business and co-marketing partners. You have the right to opt out of this sale or sharing at any time as described in Section 12, and we honor Global Privacy Control signals as an opt-out where required by law. We do not knowingly sell or share the personal information of anyone under 16. Showing a Host an anonymized Lead, delivering an Invite, making a Creator introduction, sharing information with our service providers or affiliates, or serving a Connector request at your direction is not a sale.

4. Leads and Invites: What Hosts Can and Cannot See

Leads and Invites let Hosts see anonymized interest in their Stays and send private offers to interested Travelers. Because this feature shares information about your activity with other Users, we describe it here in detail.

a. How You Become a Lead

When you are signed in as a Traveler and have Invites enabled, interacting with a Stay (for example, viewing its listing, favoriting it, clicking one of its booking, host, or social links, entering its Giveaway, or searching the region it is in) may cause the Platform to record your interest in that Stay and calculate an approximate interest score that rises with activity and decays over time. Visitors who are not signed in, and Travelers who have turned Invites off, are never shown to Hosts as Leads.

b. What a Host Sees

For each Lead, the Host sees:

• Your first name, or a placeholder if we do not have one
• The type of activity (for example, viewed, favorited, clicked a booking link, searched the area)
• An interest level (hot, warm, or cool) and approximate score
• When you were last active on that listing
• Whether you are a Stays Premium member (shown as a badge, because Premium members can receive Invites without a queue)

The same anonymized information may appear in the Host's weekly Leads summary email, in the Host's Stay Overview and analytics, and in answers the Host receives from Stays AI about their Leads. Stays may expand the activity detail shown to Hosts about a Lead over time (for example, additional detail about what a Traveler viewed, saved, or searched, or how their interest has changed). Any change that would show a Host your contact or other identifying information is governed by Sections 3 and 4.d, not by this Section.

c. What a Host Does Not See Through Leads and Invites

Through the Leads and Invites feature, Hosts are not shown your last name, email address, phone number, mailing address, profile photograph, other listings you have viewed, or other contact information. This does not change when you open an Invite, and it does not change when you respond to an Invite with "I'm interested." When you say you are interested, the Host is told that you (by first name, on that Invite only) said yes, and you are shown the Host's redemption instructions and link so that you can contact the Host if and when you choose, through the channel the Host set. The Leads and Invites feature itself does not pass your email or other contact details to the Host.

Hosts are contractually prohibited under the Terms from attempting to identify, contact, locate, or track you beyond what the Platform intentionally provides.

d. Other Ways a Host May Receive Your Information

Separately from Leads and Invites, a Host may receive your name, email address, general location, and related information in the circumstances described in Section 3 under "With Hosts, Organizations, and Property Managers": when you knowingly provide it through a Platform feature (for example, winning that Host's Giveaway, submitting an inquiry, contact, or booking request, or choosing to share your contact information), and where we share it to connect interested Travelers with Hosts. Where applicable law treats that sharing as a sale or sharing of personal information, you may opt out as described in Section 12, and opting out does not affect anonymized Leads.

e. Your Controls

• Turn Invites off. In Traveler Settings under Invites and privacy, switch off "Allow hosts to send me invites." You then never appear as a Lead to any Host and no Host can send you an Invite. Existing activity data stops being shown to Hosts. You can turn it back on at any time. Stays does not tell Hosts when a Traveler opts out.
• Keep Invites but stop the emails. Turn off Invite emails in your notification settings; Invites then wait quietly on your Invites tab.
• Decline or ignore an Invite. Declining tells the Host you said no. Ignoring lets the Invite expire. Either way, the Host learns nothing further about you.

f. Information Shared With Travelers About Hosts

An Invite shows the Traveler the sending Organization's name, the Stay, the Host's note, the private offer, and, after the Traveler says they are interested, the Host's redemption instructions and any link the Host included. Hosts are responsible for the accuracy and legality of what they send.

5. Stays AI, Connectors, and Automated Processing

a. Stays AI

Stays AI is the assistant built into the Platform. To answer you and to take the actions you request, Stays AI uses your prompts together with the data your account can access (for Travelers, your feed, favorites, trips, preferences, saved Offers, and Invites; for Hosts, your Organizations, Stays, applications, Leads, Invites, Promotions, Giveaways, Offers, and analytics; for Creators, your profile and requests) and the Platform's listing, Offer, and Giveaway data. When you ask Stays AI to draft a Stay application from a listing URL or pasted text, it uses the content you provided or pointed to.

AI model providers. Stays AI and other AI Tools are powered by third-party AI model providers (including but not limited to Anthropic and OpenAI). To generate a response, we send those providers the relevant prompt and the account and Platform data needed to answer it. These providers act as service providers to Stays. We access them through their business and developer services rather than their consumer products; under those providers' published data policies, business and developer data is not used to train their models unless the customer opts in, and Stays has not opted in. These providers may process data outside the United States and may retain it for limited periods for abuse monitoring, safety, and legal compliance under their own policies, which we do not control.

Retention and improvement. Your Stays AI conversations are saved to your account so you can return to them, and you can rename, archive, or remove individual conversations from your account at any time. We may review and use conversations, prompts, and outputs (including through automated analysis) to provide the requested response, to operate, secure, and troubleshoot the Platform, to enforce the Terms, and to evaluate and improve Stays AI and the AI Tools. Removing a conversation takes it out of your account; Stays archives removed conversations and retains them for the purposes described in this paragraph and in Section 8, subject to your deletion rights under Section 12.

Actions. When Stays AI takes an action in your account at your request (such as saving a favorite, entering a Giveaway, responding to an Invite, or, for Hosts, sending an Invite), we record that the action was requested through Stays AI. Responding to an Invite through Stays AI has the same effect as responding on the Invites tab: the Host learns your first name on that Invite only, and nothing more.

What Stays AI does not do. Stays AI does not have access to your password or payment card details, cannot make purchases, does not book stays, and does not decide application status, verification, or placement.

b. Connectors to Third-Party AI Assistants

You may connect a third-party AI assistant (such as Claude or ChatGPT) to your Stays account. Connectors use OAuth: the assistant receives a limited, revocable access token, never your Stays password. You choose at consent time whether the Connector is read-only or may also take actions on your behalf; Connectors can never make purchases.

Through a Connector, the assistant can retrieve the data your account and roles can access, as described above, and send it to the company that operates the assistant. That company's privacy policy governs what it does with that data, including whether it retains it or uses it to improve its models; Stays has no control over those practices. We log the requests and actions made through each Connector for security, support, and enforcement. You can revoke a Connector at any time in the assistant's settings, and revoking an access token stops any further access immediately. Revocation does not delete data the assistant already received.

c. Automated Processing and Profiling

The Platform uses automated processing for purposes including Lead interest scoring, Strength Ranking, ordering and personalizing listings, feeds, and recommendations, fraud, spam, and abuse detection, content screening, Giveaway entry validation, and customer support automation.

Profiling with limited effects. Lead interest scoring and feed personalization are forms of profiling. They affect what Hosts see about anonymized interest in their listings and what you see in your feed; they do not produce legal or similarly significant effects. You can remove yourself from Lead scoring entirely by turning Invites off (Section 4.e), and you can change what your feed is built from by adjusting your Traveler preferences.

Human review. Stays generally applies human review to decisions such as approving a Stay listing and verifying a Giveaway winner. Automated tools may flag, limit, or temporarily suspend accounts or content pending review. To the extent applicable law affords you the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, we do not make such decisions about you without human involvement.

AI output reliability. AI-generated output may contain errors, biases, or inaccuracies. You should not rely on AI-generated output as authoritative.

AI disclosure. Where AI is used in a manner that materially affects your experience or the information presented to you, we will provide reasonable disclosure consistent with Federal Trade Commission guidance. Where AI-generated content is presented as such on the Platform, it will be reasonably identified as AI-generated. Stays AI conversations are with an automated system, not a person.

6. Cookies, Tracking Technologies, and Specific Providers

We use cookies, web beacons, pixels, local storage, software development kits (SDKs), and similar technologies to collect information about your interactions with the Platform.

• Cookies: Small data files stored on your device. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until they expire or are deleted).
• Web Beacons and Pixels: Small graphics or programming code in web pages and emails that allow us to measure usage and engagement, including whether a notification email was opened.
• SDKs: Code libraries integrated into our applications that may collect device and usage data.
• Local Storage: Data stored locally on your device for performance and preference purposes.

We use these technologies for:

• Essential functionality, such as authenticating users, maintaining your session, and remembering preferences
• Analytics, to understand Platform usage and improve performance
• Personalization, to customize the experience and recommendations
• Advertising and Marketing Measurement, to deliver and measure relevant advertisements and campaign performance

Specific Tracking, Analytics, and Service Providers

The Platform may use the following third-party providers. The specific providers in use at any given time may vary as the Platform evolves; this list is illustrative of the categories of providers we use.

Google Analytics. Purpose: site analytics and performance measurement. Data categories collected: IP address, device information, page views, session data, and referral source. Provider's privacy policy: policies.google.com/privacy.

Google Ads and Google Tag Manager. Purpose: advertising measurement and ad delivery. Data categories collected: IP address, device information, and conversion events. Provider's privacy policy: policies.google.com/privacy.

Google Firebase Authentication and Google Cloud. Purpose: account sign-in (including Sign in with Google), hosting, storage, and infrastructure. Data categories collected: email address, name, sign-in events, IP address, and request data. Provider's privacy policy: policies.google.com/privacy.

Meta Pixel (Facebook and Instagram). Purpose: advertising measurement, audience building, and ad delivery on Meta platforms. Data categories collected: IP address, device information, page views, and conversion events. Provider's privacy policy: facebook.com/privacy/policy.

TikTok Pixel. Purpose: advertising measurement and audience building on TikTok. Data categories collected: IP address, device information, and conversion events. Provider's privacy policy: tiktok.com/legal/privacy-policy.

Pinterest Tag. Purpose: advertising measurement on Pinterest. Data categories collected: IP address, device information, and conversion events. Provider's privacy policy: policy.pinterest.com/privacy-policy.

Stripe. Purpose: payment processing, subscription billing, billing portal, fraud signal detection, and transaction telemetry. Data categories collected: transaction metadata, subscription status, fraud signals, and billing identifiers. Provider's privacy policy: stripe.com/privacy.

Email Delivery Providers (Brevo, Mailgun). Purpose: transactional, notification, and marketing email delivery and deliverability tracking. Data categories collected: email address, name, email content, and email engagement events. Provider privacy policies: brevo.com/legal/privacypolicy; mailgun.com/privacy-policy.

AI Model Providers (including but not limited to Anthropic and OpenAI). Purpose: generating Stays AI responses and powering other AI Tools. Data categories collected: prompts and the account and Platform data needed to answer them. Provider privacy policies: anthropic.com/privacy; openai.com/privacy.

Performance and Hosting Infrastructure Providers. Purpose: site performance monitoring, security, and uptime. Data categories collected: IP address, request data, and error logs. Provider privacy policies vary by provider.

If we add, remove, or materially change tracking providers, we will update this list. Where required by applicable law, we will obtain consent before activating tracking providers in your session.

Your Cookie and Tracking Choices

• Browser settings: You can manage cookies through your browser settings.
• Mobile OS settings: On iOS, you can use App Tracking Transparency to limit advertising tracking. On Android, you can reset your advertising ID or limit ad personalization.
• Industry opt-out tools: Network Advertising Initiative opt-out (optout.networkadvertising.org) and Digital Advertising Alliance opt-out (optout.aboutads.info).
• Google Analytics opt-out: tools.google.com/dlpage/gaoptout
• Meta ad preferences: facebook.com/adpreferences
• Universal Opt-Out Signals: Where required by applicable law, we honor Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of personal information for cross-context behavioral advertising.

Disabling cookies or tracking may affect the functionality of the Platform.

Mobile App Privacy Disclosures

If you access the Platform through a mobile application, additional categorical disclosures of data collection and use are provided through the relevant app store (Apple App Store privacy nutrition labels, Google Play Data Safety section) consistent with this Privacy Policy.

7. Notifications, Marketing, and Your Choices

a. Notifications and Emails

The Platform sends several kinds of communications, described in the Terms. In summary:

• Account, security, billing, and legal notices (such as email verification, password resets, Membership renewals and receipts, failed-payment notices, application decisions, and policy changes) are sent to all Users and cannot be turned off while your account is active.
• Service notifications about your Stays, Promotions, Giveaways, Offers, Invites, and Organization are sent through the Notification Center, the Stay Inbox, and email. Some can be adjusted in your settings.
• Optional activity emails are controlled in your account's Email settings and, for Travelers, in Traveler Settings under Notifications. Hosts can turn Lead and Invite summaries and alerts on or off, and can quiet one Organization without silencing the rest. Travelers can turn Offer, Giveaway, Opening, Invite, and digest emails on or off, and can use the bell on each favorite to control emails about that Stay.

Turning an email off does not stop the underlying activity; for example, Invites still arrive on your Invites tab if you turn off Invite emails.

b. Marketing Communications

We may send you marketing communications about Stays, including new features, Stays we think you will like, Promotions, Giveaways, Memberships, and special offers, subject to your preferences and applicable law. You may opt out of marketing communications at any time by following the unsubscribe instructions in any marketing email, adjusting your notification preferences in your account settings, or contacting us at admin@stays.co. Opting out of marketing does not affect the account, security, billing, and legal notices described above.

c. Text Messages

Stays does not currently send SMS or text messages. If we offer text messaging in the future, it will require your separate opt-in, message and data rates may apply, and you will be able to opt out by replying STOP.

d. Other Choices

• Leads and Invites: Turn Invites off in Traveler Settings to stop appearing as a Lead (Section 4.e).
• Sharing with Hosts, partners, and affiliates: Opt out of the sale or sharing of your personal information as described in Section 12, by emailing admin@stays.co with the subject line "Do Not Sell or Share."
• Traveler feed: Change the regions, settings, vibes, and property types your feed is built from in Traveler Settings.
• Stays AI conversations: Rename, archive, or remove conversations from the chat rail (removed conversations are archived by Stays as described in Section 8).
• Connectors: Revoke a Connector in the connected assistant's settings.
• Organization membership: Leave an Organization, or ask an Owner to remove you, from the Organization's Team page.
• Account deletion: Delete your account from Account Settings (Section 8).

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Policy, including to comply with legal, accounting, tax, or reporting requirements, resolve disputes, and enforce our agreements.

When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the information; the potential risk of harm from unauthorized use or disclosure; the purposes for processing; whether we can achieve those purposes through other means; and applicable legal requirements.

Examples:

• Account information: retained while your account is active and for a reasonable period thereafter.
• Published User-Generated Content: may be retained as described in the Terms, including under the license granted in Section 14.1 of the Terms.
• Lead activity and interest scores: interest scores decay automatically, and a Lead with no recent activity drops off a Host's list on its own; underlying activity records are retained for analytics and fraud prevention and are not shown to Hosts once they are no longer current. If you turn Invites off, your activity is no longer shown to any Host.
• Invites: the content and status of Invites are retained while your account is active so that both parties can see their history and so that allowances and cooldowns work correctly.
• Stays AI conversations: kept in your account until you remove them or your account is deleted; removed conversations are archived and retained for as long as reasonably useful for operating, securing, and improving Stays AI and for enforcement and legal purposes, then deleted, anonymized, or aggregated. You may request deletion under Section 12.
• Connector tokens and logs: tokens are retained until revoked or expired; request logs are retained for a limited period for security and support.
• Membership and transaction records: retained as required by tax and accounting laws.
• Giveaway entry and winner records: retained as set forth in the Giveaway Terms and Official Rules.
• Creator profiles and requests: retained while you participate in the Creator Marketplace and for a reasonable period thereafter.
• Marketing and analytics data: retained for as long as reasonably useful for the purposes for which it was collected.

Account deletion. You can delete your account from Account Settings. Deletion is permanent and removes your account and associated data, including your listings, preferences, favorites, and history, subject to the Terms and to the retention exceptions above. If you are the only Owner of an Organization, you must delete the Organization or transfer ownership first.

When information is no longer needed, we securely delete, anonymize, or aggregate it.

9. Data Security

We implement reasonable technical, administrative, and physical security measures designed to protect your personal information from unauthorized access, use, alteration, or disclosure. These measures include encryption in transit, hashed password storage, OAuth-based access for Connectors with revocable tokens, access controls, and regular security review. Payment card numbers are handled by Stripe and are never stored by Stays.

No method of transmission over the internet or method of electronic storage is one hundred percent secure. While we use commercially reasonable efforts to protect your information, we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials, for the AI assistants you choose to connect, and for all activities under your account. Please notify us immediately at admin@stays.co of any unauthorized access or suspected breach of your account.

In the event of a security incident affecting your personal information, we will notify you as required by applicable law.

10. International Data Transfers

The Platform is operated from the United States, and your information is processed and stored in the United States and other countries where our service providers (including AI model providers) operate.

If you access the Platform from outside the United States, you understand and consent to the transfer, storage, and processing of your information in the United States and other countries, which may have data protection laws that differ from those in your jurisdiction.

Where required by applicable law (including the General Data Protection Regulation), we implement appropriate safeguards for international data transfers, including standard contractual clauses with our service providers.

11. Children's Privacy

The Platform is not directed to children under the age of 18. We do not knowingly collect personal information from children under 18.

In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete that information as quickly as possible.

If you are a parent or guardian and believe a child under 18 has provided us with personal information, please contact us at admin@stays.co.

12. Your Privacy Rights and Choices

Depending on your location and applicable law, you may have specific rights regarding your personal information.

a. General Rights

Subject to applicable law, you may have the right to:

• Access: Request information about the personal information we hold about you and how we process it.
• Correct: Request correction of inaccurate or incomplete personal information. You can update most account, preference, Organization, and profile information yourself in the Platform.
• Delete: Request deletion of your personal information, subject to certain exceptions. You can delete your account yourself from Account Settings.
• Object: Object to certain processing, including for direct marketing.
• Restrict: Request that we restrict certain processing.
• Portability: Receive your information in a portable, machine-readable format.
• Withdraw Consent: Where we rely on your consent, withdraw that consent at any time (without affecting prior lawful processing), including by turning Invites off or revoking a Connector.
• Opt Out of Marketing: Opt out of marketing communications at any time.

b. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act provide you with specific rights:

• Right to Know what categories of personal information we have collected, the sources, the purposes for collection, the categories of third parties with whom we share information, and specific pieces of information we hold about you
• Right to Correct inaccurate personal information
• Right to Delete personal information, subject to legal exceptions
• Right to Opt Out of Sale or Sharing: As described in Section 3, some of our disclosures to Hosts and to business and co-marketing partners may be considered a sale or sharing of personal information. You may opt out at any time by emailing admin@stays.co with the subject line "Do Not Sell or Share." Where required by applicable law, we also honor Global Privacy Control signals as an opt-out request. Opting out does not affect disclosures to service providers or affiliates, anonymized Leads, or information you knowingly provide to a Host yourself
• Right to Limit Use and Disclosure of Sensitive Personal Information: As noted in Section 1.d, Stays does not collect sensitive personal information in a manner that triggers this right
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your privacy rights

You may also designate an authorized agent to make requests on your behalf, subject to our verification process.

c. Other US State Residents

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Indiana, Tennessee, New Jersey, New Hampshire, Kentucky, Maryland, Minnesota, Nebraska, Rhode Island, or another US state with a comprehensive consumer privacy law, you may have rights similar to those described above, including the right to access, correct, delete, and obtain a portable copy of your personal information; the right to opt out of targeted advertising, sale of personal information, or profiling that produces legal or similarly significant effects; and the right to appeal a denial of a privacy rights request. As described in Section 5.c, the profiling we perform (Lead interest scoring and feed personalization) does not produce legal or similarly significant effects, and you can opt out of Lead scoring by turning Invites off. To opt out of the sale of personal information or targeted advertising, email admin@stays.co with the subject line "Do Not Sell or Share."

To exercise these rights, contact us at admin@stays.co. We will respond within the timeframe required by applicable law, generally 45 days.

Appeal Process: If we deny your request in whole or in part, you may appeal our decision by emailing admin@stays.co with the subject line "Privacy Appeal." We will respond to your appeal within the timeframe required by applicable law.

d. European Union / United Kingdom Residents (GDPR / UK GDPR)

If you are a resident of the European Economic Area, United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation and equivalent UK law, including those described in Section 12.a above plus:

• Right to lodge a complaint with your local data protection authority
• Right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects

For purposes of the GDPR, Greater Wave LLC is the data controller for personal information processed through the Platform. You may contact our data protection contact at admin@stays.co.

e. How to Exercise Your Rights

To exercise any of your privacy rights, contact us at:

• Email: admin@stays.co
• Mail: Greater Wave LLC, 225 Michigan St NW, PO Box 3771, Grand Rapids, MI 49501

We will respond to your request in accordance with applicable law after verifying your identity. We may require additional information to verify your identity before fulfilling your request. We will not discriminate against you for exercising your rights.

13. Do Not Track and Global Privacy Control

Some browsers offer "Do Not Track" (DNT) signals. There is no industry consensus on how to respond to DNT signals, and we do not currently respond to DNT.

Where required by applicable law, we recognize and honor Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of personal information, including the sharing with Hosts and business partners described in Section 3, for the browser or device on which the signal is sent.

14. Third-Party Links and Services

The Platform may contain links to third-party websites, services, or content (including Booking Links, Hosts' direct booking sites and redemption links, social media accounts, PMS integrations, and the third-party AI assistants available through Connectors). This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices of third parties, and we encourage you to read their privacy policies before providing them with information or connecting them to your Stays account.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other reasons. We will notify you of material changes by posting the revised Policy on this page, updating the "Last Updated" date at the top, and where appropriate, providing additional notice (such as by email or in-Platform announcement).

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must stop using the Platform.

16. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us at:

Greater Wave LLC, doing business as Stays 225 Michigan St NW, PO Box 3771 Grand Rapids, MI 49501 Email: admin@stays.co

For privacy rights requests, please use the subject line "Privacy Request." To opt out of the sale or sharing of your personal information, please use the subject line "Do Not Sell or Share." For appeals of a denied request, please use the subject line "Privacy Appeal." To report another User's conduct, contact hello@stays.co.