Privacy Policy: stays.co

Last Updated: June 2026 Operator: Greater Wave LLC dba Stays, stays.co ("Stays," "we," "us," or "our")

This Privacy Policy describes how Stays collects, uses, processes, shares, and protects your personal information when you access or use our platform, including our website at stays.co, any subdomains, mobile applications, APIs, dashboards, and related tools (collectively, the "Platform"). This Policy also explains your privacy rights and choices.

This Privacy Policy is incorporated into and forms part of our Terms and Conditions. Capitalized terms not defined here have the meaning given in the Terms and Conditions.

By accessing or using the Platform in any capacity, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your information as described. If you do not agree with this Policy, you must not use the Platform.

1. Information We Collect

We collect information to provide and improve our services, communicate with you, and operate our business. The types and categories of information we collect depend on how you interact with the Platform.

a. Information You Provide Directly

When you create an account, submit a Stay listing, purchase a Promotion, enter a Giveaway, save a favorite Stay, opt in to notifications, or communicate with us, you may provide us with:

• Contact Information: Name, email address, phone number, physical or business address.
• Account Information: Username, password (stored in encrypted form), profile photograph, account preferences.
• Host Information: Details about your property, including address, photographs, descriptions, amenities, availability, pricing, and any Exclusive Offers; ownership and operational details you choose to provide (not independently verified by us); business registration details if you operate as a legal entity.
• Payment Information: Billing address and payment method details. Payment processing is handled by our third-party payment processor, Stripe. Stays does not directly store full payment card numbers.
• Giveaway Entry Information: Information submitted in connection with entering Giveaways, including contact information, entry responses, and any optional information requested in the Official Rules for a specific Giveaway.
• Communications: The content of your communications with us, including customer support inquiries, feedback, survey responses, and reviews.
• User-Generated Content: Any content you upload, post, or submit to the Platform, including Stay photographs, descriptions, captions, reviews, and any media imported from your linked social media accounts.

b. Information We Collect Automatically

When you access or use the Platform, we may automatically collect certain information about your device and usage, including:

• Usage Information: Pages or content viewed, features used, Stays saved as favorites, Booking Links clicked, time and date of visits, session duration, and navigation patterns.
• Device Information: IP address, device type, operating system, browser type, browser language, unique device identifiers, mobile network information, and screen resolution.
• Log Data: Server logs including IP address, request type, referrer URL, device event information, crash reports, and timestamps.
• Location Information: General location (typically city or state level) inferred from your IP address. We do not collect precise geolocation information without your explicit consent.
• Cookies and Tracking Technologies: Information collected through cookies, web beacons, pixels, and similar technologies, as described in Section 5 below.

c. Information from Third Parties

We may receive information about you from third-party services and sources, including:

• Linked Property Management Systems: If you link your Stays Host account to a PMS (such as Lodgify, Hostfully, OwnerRez, or similar), we may receive listing, calendar, and operational information as authorized by you and your PMS provider.
• Linked Social Media Accounts: If you connect your Instagram, TikTok, Facebook, or other social media account, we may receive profile information, media, and other data as authorized by you and the third-party platform.
• Outlets: We may receive engagement data from third-party Instagram Outlets where your Promotions are published.
• Payment Processor: We receive transaction confirmations, fraud signals, and limited payment metadata from Stripe.
• Analytics and Advertising Partners: Aggregated or pseudonymized data about how users find and interact with the Platform.
• Public Sources: Publicly available information that helps us verify Host claims, prevent fraud, or curate the Platform.

d. Sensitive Personal Information

Stays does not intentionally collect sensitive personal information as defined under applicable privacy laws (such as government identifiers, financial account numbers beyond what is necessary for payment, precise geolocation, race or ethnic origin, health information, or biometric data). To the extent any sensitive information is incidentally collected (for example, if you include such information in a customer support communication), we use it only as necessary to respond to your request and do not use it for inference, advertising, or any purpose requiring opt-in consent.

2. How We Use Your Information

We use the information we collect to operate, improve, and protect the Platform and our business. The legal bases for our processing include:

• Performance of our contract with you: To provide you with the services you request, including account creation, Stay submissions, Promotions, Giveaway entries, and notifications.
• Our legitimate business interests: To operate, improve, and secure the Platform, develop new features, conduct analytics, prevent fraud, and market our services in a manner that does not override your rights.
• Compliance with legal obligations: To meet our legal, regulatory, and tax obligations.
• Your consent: For specific purposes where we obtain your consent, such as certain marketing communications, precise geolocation, or optional features.

Specifically, we use your information to:

Provide and maintain the Platform, including creating and managing your account, processing Stay applications, facilitating Promotions, enabling Giveaway entries, surfacing Booking Links, providing customer support, and operating notifications such as save-favorite alerts, cancellation alerts, and offer alerts.

Improve and personalize your experience, including understanding how the Platform is used, developing new features, recommending Stays, and personalizing curated discovery.

Communicate with you, including sending transactional and security messages, marketing communications (subject to your preferences and applicable law), notifications you have opted into, responses to feedback and inquiries, and announcements about the Platform.

Secure the Platform and prevent fraud, including detecting and addressing fraud, abuse, security incidents, chargebacks, and harmful or unlawful activity; verifying identity; and enforcing the Terms and Conditions.

Conduct analytics and research, including measuring Platform performance, understanding user behavior, conducting surveys, and producing aggregated insights.

Comply with legal obligations, including responding to lawful requests from authorities, complying with tax and regulatory requirements, and protecting our rights and the rights of others.

3. How We Share Your Information

We may share your personal information in the following circumstances:

With Other Users. Information you submit as part of a Stay listing (including property details, photographs, descriptions, location, and any Exclusive Offers) is visible to Visitors and Users of the Platform. Stays does not directly facilitate communication or bookings between Users on the Platform; off-Platform communications are subject to the terms of the relevant third-party services.

With Service Providers. We share information with third-party service providers who perform services on our behalf, including:

• Stripe (payment processing)
• Mailgun (transactional email delivery)
• Hosting and infrastructure providers
• Property Management System integrations (where authorized by you)
• Analytics and performance monitoring services
• Customer support tools
• Marketing and advertising partners

These service providers are contractually required to use your information only for the purposes for which we engage them and to protect your information in accordance with applicable law.

With Third-Party Outlets for Promotions. When you purchase a Promotion, we share relevant content about your Stay with the designated third-party Instagram Outlets or other channels for publication.

When You Click Booking Links. When you click a Booking Link from a Stay listing, you leave the Platform and are directed to a third-party booking platform (such as Airbnb, Vrbo, or a Host's direct booking site). The third-party platform's privacy policy and practices apply to information you provide on that platform. Stays may receive aggregated click-through or referral information.

For Business Transfers. In connection with, or during negotiations of, any merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of the transaction. We will notify you of any change in ownership or use of your personal information as required by law.

For Legal Reasons. We may disclose information when required by law or in good faith to:

• Comply with a legal obligation, subpoena, court order, or governmental request
• Protect and defend the rights or property of Stays or Greater Wave LLC
• Prevent or investigate possible wrongdoing in connection with the Platform
• Protect the personal safety of Users or the public
• Protect against legal liability

With Your Consent. We may share your information for any other purpose with your explicit consent.

Aggregated or De-identified Data. We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you with third parties for industry analysis, research, marketing, and other lawful business purposes.

We Do Not Sell Your Personal Information. Stays does not sell personal information in the traditional sense and does not "share" personal information for cross-context behavioral advertising as defined under California law. If our practices change, we will update this Policy and provide the legally required notices and opt-out mechanisms.

4. Cookies, Tracking Technologies, and Specific Providers

We use cookies, web beacons, pixels, local storage, software development kits (SDKs), and similar technologies to collect information about your interactions with the Platform.

• Cookies: Small data files stored on your device. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until they expire or are deleted).
• Web Beacons and Pixels: Small graphics or programming code in web pages and emails that allow us to measure usage and engagement.
• SDKs: Code libraries integrated into our applications that may collect device and usage data.
• Local Storage: Data stored locally on your device for performance and preference purposes.

We use these technologies for:

• Essential functionality, such as authenticating users and remembering preferences
• Analytics, to understand Platform usage and improve performance
• Personalization, to customize the experience and recommendations
• Advertising and Marketing Measurement, to deliver and measure relevant advertisements and campaign performance

Specific Tracking and Analytics Providers

The Platform may use the following third-party tracking and analytics providers. The specific providers in use at any given time may vary as the Platform evolves; this list is illustrative of the categories of providers we use.

Google Analytics. Purpose: site analytics and performance measurement. Data categories collected: IP address, device information, page views, session data, and referral source. Provider's privacy policy: policies.google.com/privacy.

Google Ads and Google Tag Manager. Purpose: advertising measurement and ad delivery. Data categories collected: IP address, device information, and conversion events. Provider's privacy policy: policies.google.com/privacy.

Meta Pixel (Facebook and Instagram). Purpose: advertising measurement, audience building, and ad delivery on Meta platforms. Data categories collected: IP address, device information, page views, and conversion events. Provider's privacy policy: facebook.com/privacy/policy.

TikTok Pixel. Purpose: advertising measurement and audience building on TikTok. Data categories collected: IP address, device information, and conversion events. Provider's privacy policy: tiktok.com/legal/privacy-policy.

Pinterest Tag. Purpose: advertising measurement on Pinterest. Data categories collected: IP address, device information, and conversion events. Provider's privacy policy: policy.pinterest.com/privacy-policy.

Stripe. Purpose: payment processing, fraud signal detection, and transaction telemetry. Data categories collected: transaction metadata, fraud signals, and billing identifiers. Provider's privacy policy: stripe.com/privacy.

Mailgun. Purpose: transactional email delivery and deliverability tracking. Data categories collected: email address and email engagement events. Provider's privacy policy: mailgun.com/privacy-policy.

Performance and Hosting Infrastructure Providers. Purpose: site performance monitoring, security, and uptime. Data categories collected: IP address, request data, and error logs. Provider privacy policies vary by provider.

If we add, remove, or materially change tracking providers, we will update this list. Where required by applicable law, we will obtain consent before activating tracking providers in your session.

Your Cookie and Tracking Choices

• Browser settings: You can manage cookies through your browser settings.
• Mobile OS settings: On iOS, you can use App Tracking Transparency to limit advertising tracking. On Android, you can reset your advertising ID or limit ad personalization.
• Industry opt-out tools: Network Advertising Initiative opt-out (optout.networkadvertising.org) and Digital Advertising Alliance opt-out (optout.aboutads.info).
• Google Analytics opt-out: tools.google.com/dlpage/gaoptout
• Meta ad preferences: facebook.com/adpreferences
• Universal Opt-Out Signals: Where required by applicable law, we honor Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of personal information for cross-context behavioral advertising.

Disabling cookies or tracking may affect the functionality of the Platform.

Mobile App Privacy Disclosures

If you access the Platform through a mobile application, additional categorical disclosures of data collection and use are provided through the relevant app store (Apple App Store privacy nutrition labels, Google Play Data Safety section) consistent with this Privacy Policy.

5. Marketing Communications and Your Choices

We may send you marketing communications about Stays, including new features, Stays we think you'll like, Promotions, Giveaways, and special offers, subject to your preferences and applicable law.

You may opt out of marketing communications at any time by:

• Following the unsubscribe instructions in any marketing email
• Adjusting your notification preferences in your account settings
• Contacting us at admin@stays.co

Opting out of marketing does not affect transactional communications related to your account, security, transactions, or material Platform changes. These communications continue while your account is active and are addressed in our Terms and Conditions.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Policy, including to comply with legal, accounting, tax, or reporting requirements, resolve disputes, and enforce our agreements.

When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the information; the potential risk of harm from unauthorized use or disclosure; the purposes for processing; whether we can achieve those purposes through other means; and applicable legal requirements.

Examples:

• Account information: retained while your account is active and for a reasonable period thereafter
• Published User-Generated Content: may be retained as described in the Terms and Conditions, including the license granted in Section 11.1 of the Terms
• Transaction records: retained as required by tax and accounting laws
• Giveaway entry records: retained as set forth in the Giveaway Terms and Official Rules
• Marketing and analytics data: retained for as long as reasonably useful for the purposes for which it was collected

When information is no longer needed, we securely delete, anonymize, or aggregate it.

7. Data Security

We implement reasonable technical, administrative, and physical security measures designed to protect your personal information from unauthorized access, use, alteration, or disclosure. These measures include encryption in transit, access controls, and regular security review.

No method of transmission over the internet or method of electronic storage is one hundred percent secure. While we use commercially reasonable efforts to protect your information, we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for all activities under your account. Please notify us immediately at admin@stays.co of any unauthorized access or suspected breach of your account.

In the event of a security incident affecting your personal information, we will notify you as required by applicable law.

8. International Data Transfers

The Platform is operated from the United States, and your information is processed and stored in the United States and other countries where our service providers operate.

If you access the Platform from outside the United States, you understand and consent to the transfer, storage, and processing of your information in the United States and other countries, which may have data protection laws that differ from those in your jurisdiction.

Where required by applicable law (including the General Data Protection Regulation), we implement appropriate safeguards for international data transfers, including standard contractual clauses with our service providers.

9. Children's Privacy

The Platform is not directed to children under the age of 18. We do not knowingly collect personal information from children under 18.

In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete that information as quickly as possible.

If you are a parent or guardian and believe a child under 18 has provided us with personal information, please contact us at admin@stays.co.

10. Your Privacy Rights and Choices

Depending on your location and applicable law, you may have specific rights regarding your personal information.

a. General Rights

Subject to applicable law, you may have the right to:

• Access: Request information about the personal information we hold about you and how we process it.
• Correct: Request correction of inaccurate or incomplete personal information.
• Delete: Request deletion of your personal information, subject to certain exceptions.
• Object: Object to certain processing, including for direct marketing.
• Restrict: Request that we restrict certain processing.
• Portability: Receive your information in a portable, machine-readable format.
• Withdraw Consent: Where we rely on your consent, withdraw that consent at any time (without affecting prior lawful processing).
• Opt Out of Marketing: Opt out of marketing communications at any time.

b. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act provide you with specific rights:

• Right to Know what categories of personal information we have collected, the sources, the purposes for collection, the categories of third parties with whom we share information, and specific pieces of information we hold about you
• Right to Correct inaccurate personal information
• Right to Delete personal information, subject to legal exceptions
• Right to Opt Out of Sale or Sharing: As noted in Section 3, Stays does not sell personal information or share it for cross-context behavioral advertising. If our practices change, we will update this Policy and provide a "Do Not Sell or Share My Personal Information" link
• Right to Limit Use and Disclosure of Sensitive Personal Information: As noted in Section 1.d, Stays does not collect sensitive personal information in a manner that triggers this right
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your privacy rights

You may also designate an authorized agent to make requests on your behalf, subject to our verification process.

c. Other US State Residents

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Indiana, Tennessee, or another US state with a comprehensive consumer privacy law, you may have rights similar to those described above, including the right to access, correct, delete, and obtain a portable copy of your personal information; the right to opt out of targeted advertising, sale of personal information, or profiling that produces legal or similarly significant effects; and the right to appeal a denial of a privacy rights request.

To exercise these rights, contact us at admin@stays.co. We will respond within the timeframe required by applicable law, generally 45 days.

Appeal Process: If we deny your request in whole or in part, you may appeal our decision by emailing admin@stays.co with the subject line "Privacy Appeal." We will respond to your appeal within the timeframe required by applicable law.

d. European Union / United Kingdom Residents (GDPR / UK GDPR)

If you are a resident of the European Economic Area, United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation and equivalent UK law, including those described in Section 10.a above plus:

• Right to lodge a complaint with your local data protection authority
• Right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects

For purposes of the GDPR, Greater Wave LLC is the data controller for personal information processed through the Platform. You may contact our data protection contact at admin@stays.co.

e. How to Exercise Your Rights

To exercise any of your privacy rights, contact us at:

• Email: admin@stays.co
• Mail: Greater Wave LLC, 225 Michigan St NW, PO Box 3771, Grand Rapids, MI 49501

We will respond to your request in accordance with applicable law after verifying your identity. We may require additional information to verify your identity before fulfilling your request. We will not discriminate against you for exercising your rights.

11. Artificial Intelligence and Automated Decision-Making

The Platform uses artificial intelligence ("AI"), machine learning, and automated processing for purposes including, without limitation, fraud detection, content moderation, search ranking, recommending Stays, personalizing the experience, summarizing or classifying content, customer support automation, and operating creator marketplace and discovery features.

Human Review for Material Decisions. Decisions that materially affect Users (such as approving a Stay listing, issuing the Verified Badge, removing an account, or resolving a dispute) involve human review and are not based solely on automated processing.

No Solely-Automated Significant Decisions. To the extent applicable law affords you the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, we do not make such decisions about you without human involvement.

AI Output Reliability. AI-generated output may contain errors, biases, or inaccuracies. You should not rely on AI-generated output as authoritative.

FTC Compliance and AI Disclosure. Where AI is used in a manner that materially affects your experience or the information presented to you, we will provide reasonable disclosure consistent with Federal Trade Commission guidance. Where AI-generated content is presented as such on the Platform, it will be reasonably identified as AI-generated.

12. Do Not Track and Global Privacy Control

Some browsers offer "Do Not Track" (DNT) signals. There is no industry consensus on how to respond to DNT signals, and we do not currently respond to DNT.

Where required by applicable law, we recognize and honor Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of personal information.

13. Third-Party Links and Services

The Platform may contain links to third-party websites, services, or content (including Booking Links, social media accounts, and PMS integrations). This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices of third parties, and we encourage you to read their privacy policies before providing them with information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other reasons. We will notify you of material changes by posting the revised Policy on this page, updating the "Last Updated" date at the top, and where appropriate, providing additional notice (such as by email or in-Platform announcement).

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must stop using the Platform.

15. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us at:

Greater Wave LLC (Stays) 225 Michigan St NW, PO Box 3771 Grand Rapids, MI 49501 Email: admin@stays.co

For privacy rights requests, please use the subject line "Privacy Request." For appeals of a denied request, please use the subject line "Privacy Appeal."