StaySage Privacy Notice
Effective October 27, 2026.
Who we are and how to reach us
StaySage is a California-based sole-proprietor business providing reporting for independent motel and small-hotel operators. This notice describes personal information handled through our website, customer relationships, support, and service. Contact legal@getstaysage.com for privacy questions and requests, or support@getstaysage.com for service and billing questions.
For our own website, billing, account administration, and marketing, we determine how personal information is used. For personal information a business customer lawfully provides for reporting, we handle it to provide the contracted service and follow that customer's lawful instructions, subject to applicable law and any separate data-processing agreement. We request summary business totals, not hotel guest records.
Information we collect
| Category | Examples and source | Main purposes |
|---|---|---|
| Business contact and account information | Name if you provide it, work email, property name/location, account identifiers, and authorized-user details supplied by you | Setup, access, customer support, and service administration |
| Subscription and transaction information | Subscribed properties, plan, amount, billing dates, payment status, invoice/subscription references, and limited payment-method details supplied by Stripe | Billing, accounting, cancellation, refunds, fraud prevention, and payment disputes |
| Submitted reports and correspondence | Report dates, room counts, revenue/rate totals, attachments, setup details, and messages you send | Produce and troubleshoot reporting, answer questions, and document service delivery |
| Technical and usage information | IP address, browser/device information, approximate location inferred from IP, timestamps, visited pages, referrals, security logs, and interactions | Deliver and secure the site; optional analytics and advertising uses described below |
| Marketing and preference information | Campaign/creative IDs, UTM tags, permitted click/cookie identifiers, consent choices, and communications preferences | Attribute advertising, measure performance, honor choices, and send permitted communications |
We receive information from you, your authorized colleagues, your browser/device, payment and technical providers, and advertising or analytics partners when the relevant features are enabled. IP addresses and pseudonymous identifiers can be personal information; calling an event “anonymous” does not necessarily make it unidentifiable.
Stripe collects payment information on its hosted payment pages. We do not ask you to email card details and do not receive the full card number from Stripe. See Stripe's Privacy Policy.
Please send summary reports. Remove guest names, guest contact information, reservation/booking numbers, card details, government identifiers, and unnecessary sensitive data. If you accidentally submit them, contact us so we can arrange correction or deletion, subject to necessary legal preservation. Report contents and support-message text are not advertising or product-analytics event payloads.
How we use information
We use relevant information to provide and maintain reporting; verify your authority and secure access; communicate about setup, service, and billing; process payments and refunds; investigate abuse or errors; improve the service; measure permitted marketing and product activity; comply with law; and establish, exercise, or defend legal claims. We do not promise improved occupancy, room rates, or revenue based on our use of information.
Where a legal basis is required, we rely on performing a contract or taking requested precontract steps, our legitimate interests in operating and protecting the business where balanced against individual rights, compliance with legal obligations, and consent for optional processing where required or where our choices control specifies it. We do not treat acceptance of subscription terms as blanket consent to advertising cookies.
Cookies, analytics, and advertising
Essential technical processing supports page delivery, security, billing, access, and remembering privacy preferences. Optional analytics helps us understand visits, demo interactions, and product use. Optional advertising technology helps us measure campaigns and, if enabled, reach people who previously interacted with our site.
Current tracking status: Google Analytics, Google Ads website tags, Meta Pixel/Conversions API, Segment, and Mixpanel are not enabled on the current static marketing site. The following describes the services planned for possible use and the data they would receive when enabled with the appropriate choices. We will update this notice and the on-site provider/settings information before activation; merely listing a provider does not mean it receives your data now.
| Optional provider | Intended use and information when enabled | Further information |
|---|---|---|
| Google Analytics | Measure site usage with page/event data, browser/device information, and permitted cookie or other pseudonymous identifiers. Advertising features, if separately enabled, can connect measurement with advertising. | Google's partner-site data explanation; Analytics opt-out tool |
| Google Ads | Attribute ad interactions and conversions; if remarketing is enabled, Google and other advertising vendors can show our ads on other sites using cookies/device identifiers based on past visits. | Google advertising controls; Google Privacy Policy |
| Meta, including Facebook and Instagram | Measure ad performance and, if enabled, support advertising audiences through Pixel and server-side Conversions API events. Permitted data can include page/event details, browser/device information, IP address, ad/cookie identifiers, and purchase amount/currency. Meta may associate events with a Meta account or use them under its own terms. | Meta Privacy Policy; Meta ad preferences |
| Twilio Segment | Collect and route permitted event information and pseudonymous identifiers to the destinations selected for that purpose. A routing platform can receive information even when a downstream destination is disabled; our source-side controls must restrict collection too. | Twilio Privacy Notice |
| Mixpanel | Analyze permitted page/product events, feature interactions, and pseudonymous identifiers to understand usage and improve the service. | Mixpanel Privacy Program |
We do not send hotel guest information, audit attachments, property financial report contents, card data, passwords, or free-text support messages to these advertising/analytics tools. We do not upload customer email lists for advertising or enable enhanced/advanced matching or session replay under this notice's launch configuration. A change to those practices requires a fresh review, disclosure, and any required consent before collection.
Your tracking and communication choices
When optional tracking is introduced, the site will offer Accept optional, Reject optional, and category settings for analytics and advertising. Optional trackers will remain off until the relevant choice is affirmative under our proposed launch configuration. When those features are enabled, Privacy choices in the website footer will let you review or withdraw that choice. Today that page explains the absence of optional tracking. Rejecting optional tracking will not prevent you from viewing the site or subscribing.
We will honor a recognized Global Privacy Control or other applicable opt-out preference signal as an opt-out of sale/sharing for cross-context behavioral advertising and targeted advertising on the browser/device that sends it. Necessary processing to deliver the service, handle transactions, and remember that choice can continue. The older “Do Not Track” browser signal is distinct from GPC and does not currently trigger a separate mechanism. Requests can also be sent to legal@getstaysage.com.
Our proposed launch uses consent-based controls in addition to these opt-out signals. A server-side event, Segment destination, or advertising API will not be used to bypass a recorded opt-out or required consent. Browser controls and vendor opt-outs may be browser/device-specific. Deleting cookies or changing devices can affect saved preferences. Google’s Analytics opt-out tool does not opt out of every advertising platform or essential service processing.
If we send promotional email, you can unsubscribe using its link or contact us. Important service, billing, privacy, and security messages may continue while relevant to your relationship with us.
Disclosures to other parties
We disclose information as needed to hosting, email, database, support, payment, security, and other service providers helping operate StaySage, subject to appropriate obligations and access restrictions. Cloudflare hosts and delivers this marketing website; Purelymail handles our human support and contact email. Google Fonts supplies the website fonts and receives the browser request information needed to serve them, such as IP address and request headers. Stripe processes payments when hosted checkout is connected. Postmark is selected for future report ingestion but is not connected today. Django application hosting, reporting infrastructure, and database providers are not yet deployed; we will update this notice before they begin handling customer data. The optional measurement services listed above are not active website trackers today.
When optional advertising sharing is enabled, disclosures of identifiers and browsing/conversion information to advertising partners may be considered a “sale,” “sharing,” or processing for “targeted advertising” under some privacy laws even if no money is paid for the information. We will offer the applicable controls before that sharing occurs. At present, we do not use the optional advertising technologies listed above to sell or share website visitor information for targeted advertising. We do not sell submitted hotel reports or guest records to advertisers.
We may also disclose relevant information with your direction, to comply with lawful requests, prevent or investigate harm or fraud, handle payment disputes, or protect legal rights. If the business transfers to a successor, information may transfer with appropriate protections and notice, subject to applicable law. There is no permission here to remove existing privacy choices by transferring the business.
Retention, security, and transfers
We retain information for the purposes described here, considering the active customer relationship, the sensitivity and volume of information, service and support needs, documented retention settings, applicable accounting/legal obligations, and the need to handle actual disputes. We then delete or de-identify information or retain a restricted copy where a specific legal or security purpose requires it. Backup removal follows the applicable backup lifecycle. Contact us for a request relating to your information.
We use reasonable technical and organizational measures appropriate to the information and service. No system is completely secure, and this notice does not promise a particular certification, data-residency region, encryption design, or database isolation implementation that has not been verified.
Information may be processed in the United States and other countries where confirmed providers operate. Those countries' laws can differ from yours. Where required, we use an applicable transfer mechanism, such as contractual safeguards, and provide information about it on request. A provider's general certification does not by itself establish StaySage's compliance.
Privacy rights
Depending on where you live and which laws apply, you may have rights to access or know about personal information, obtain a copy, correct it, delete it, restrict or object to certain processing, withdraw consent, or opt out of sale/sharing or targeted advertising. Where applicable, you may appeal a declined request and complain to a competent regulator. We will not unlawfully discriminate against you for exercising a right.
Send requests to legal@getstaysage.com. We may verify identity or authority where appropriate for an access/deletion request, without collecting unnecessary information. We will not require identity verification for an opt-out where the law prohibits it. An authorized agent may submit a request with any legally necessary evidence of authority. We respond within the period required by applicable law and explain any lawful limitation or extension. If your request concerns information controlled by your employer or another hotel business, we may direct it to that business or coordinate with it.
For California visitors, the categories, sources, purposes, and recipient types above describe our proposed notice at collection. Whether specific CCPA obligations apply depends on the law's scope and StaySage's circumstances; we do not claim that every statutory regime applies merely because it is mentioned. Sensitive guest information is not requested. We do not knowingly sell or share personal information of people under 16.
Children and changes
StaySage is intended for adult business operators, not children. We do not knowingly collect children's personal information for the service. Please contact us if you believe a child has submitted information so we can investigate and take appropriate action.
We will date material changes to this notice and provide additional notice or obtain consent when required. A notice update does not retroactively authorize new uses that require a different legal basis or consent.