Effective: July 21, 2026 · Last Updated: August 10, 2026

This Privacy Policy explains how Stay At, LLC DBA Stay Utah (“Stay Utah,” “we,” “us,” “our”) collects, uses, shares, and protects personal information across the Platform — including stayutah.com, pecanvalley.com, all resort collection and direct-booking sites, mobile apps, and affiliated services (collectively, the “Platform”).

Our role: We are a technology facilitator that connects guests with independent management companies and hosts (“Hosts”). We are not the merchant of record, owner, or operator of any property. Because of this model, fulfilling your booking necessarily requires us to share your information with the Host responsible for your reservation and with the service partners that support the transaction, as described below.

1. Notice at Collection (Summary)

At or before the point of collection: we collect the categories of personal information listed in Section 2 for the purposes in Section 4; we retain it as described in Section 9; and we share it with the recipient categories in Section 6. We do not sell personal information for money. Whether we “share” personal information for cross-context behavioral advertising is described in Section 7. You have the rights described in Section 8.

2. Information We Collect

Contact and identity information — name, email address, mailing/billing address, phone number, and, where a Host or law requires it, government-issued ID, images of that ID, a selfie used for comparison, or date of birth for identity verification.

Account information — username, password, security questions, account preferences, and profile details.

Booking information — properties searched and viewed, dates, party size, special requests, booking and stay history, communications about a reservation, and add-ons or services selected.

Payment-adjacent information — billing details and transaction records. Full card/bank numbers are collected and processed by our payment processor (Stripe), not stored by us. We receive limited transaction metadata (e.g., confirmation, amount, last four digits, status).

Communications — messages, chat, email, call recordings/transcripts (where lawful and disclosed), and customer-support interactions between you and us, and between you and a Host facilitated through the Platform.

Device and usage information (collected automatically) — IP address, device and browser type, operating system, device identifiers, app version, pages viewed, links clicked, referring/exit pages, clickstream, access dates/times, and crash data.

Location information — approximate location derived from IP address, and, with your permission, more precise location from a mobile device.

Cookies and tracking technologies — see our Cookie Policy and Section 11.

Information from other sources — Hosts, PMS partners, identity/fraud-prevention and background-screening vendors (where applicable and consistent with law), social-login providers you choose to connect, marketing partners, and publicly available sources.

Sensitive information — identity-verification documents and images may qualify as sensitive personal information. We use them only to verify identity, prevent fraud, fulfill and protect the related reservation, and meet legal obligations. If you choose to provide other sensitive information (for example, accessibility needs to relay to a Host), we use it only to fulfill the related request.

3. How We Collect It

We collect information you provide directly (forms, account creation, bookings, support requests), automatically through your use of the Platform and tracking technologies, and from the third-party sources listed in Section 2.

4. How We Use Information

We use personal information to: provide and operate the Platform and facilitate your bookings; route your booking and relevant details to the responsible Host; process payments through our payment processor and support host-side fee handling; communicate with you about bookings, support, security, and service updates; provide customer support and help coordinate dispute resolution (property-related disputes are between you and the Host); detect, prevent, and investigate fraud, abuse, and security incidents, and verify identity where required; personalize content and, where permitted, market to you (including SMS — see Section 12); operate promotions and loyalty programs for opted-in properties; analyze usage and improve the Platform; and comply with legal obligations and enforce our Terms and policies.

5. Legal Bases (where applicable)

Where required by law, we process personal information on the bases of: performance of a contract (facilitating your booking), our legitimate interests (operating, securing, and improving the Platform), your consent (e.g., SMS marketing, precise location, certain cookies), and compliance with legal obligations.

6. How We Share Information

We share personal information with the following categories of recipients, as necessary to fulfill bookings and operate the Platform:

Affiliated sites and commonly-owned entities. The Platform operates as one connected system across Stay Utah and its affiliated and commonly-owned websites and brands (for example, stayutah.com and pecanvalley.com, and other resort collection or direct-booking sites we operate). We share information among these affiliated sites and entities and operate them together, so information you provide on one may be used and accessed across the Platform for the purposes described in this Policy.

Management Companies and Hosts. We share your relevant booking and contact information with the specific Host responsible for your reservation so they can fulfill and service the stay, communicate with you, provide their services, market their own properties and services to you, and meet their legal obligations. When identity verification is required, limited authorized staff for that Host may securely review the verification result and submitted ID or selfie images when reasonably needed to prevent fraud, confirm the booking guest, fulfill the stay, address a dispute, or meet a legal obligation. Hosts may use the information they receive for these purposes. Once shared, the Host’s handling of your information is their responsibility, and you may also be subject to the Host’s own privacy practices and rental agreement.

Property Management System (PMS) and channel partners. We share booking and guest information with the property-management and channel-management systems that Hosts use to manage reservations.

Payment processor. We share transaction information with Stripe (and Stripe Connect) to process payments and route funds to Hosts. Stripe’s handling of payment data is governed by Stripe’s own privacy policy.

Identity, fraud-prevention, and screening vendors. Where applicable and consistent with law, we share information with vendors that verify identity, assess fraud and risk, or perform background/eligibility checks.

Communications and messaging vendors. Email, SMS, and notification providers used to deliver booking and service communications.

Advertising, marketing, and analytics partners. We share personal information — including online identifiers, device information, and activity on the Platform — with advertising and analytics partners (such as social media platforms and search/ad networks, for example Meta and Google) to measure and improve our marketing and to deliver relevant advertising, including through custom and lookalike audiences, retargeting, and cross-context behavioral advertising, and to send our own marketing communications. (See Section 7.)

Infrastructure and operational vendors. Cloud hosting, data storage, security, and IT support providers acting on our behalf under contract.

Professional advisors and authorities. Lawyers, accountants, and auditors; and courts, law enforcement, tax authorities, and governmental or public authorities, where required or permitted by law, or where reasonably necessary to comply with legal obligations, respond to lawful requests, enforce our agreements, investigate suspected illegal activity or violations, or protect the rights, property, or safety of any person.

Corporate transactions. In connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar event, information may be transferred to a successor or acquirer, subject to this Policy or a successor policy.

With your consent or at your direction, for any other purpose disclosed at the time.

We do not sell your personal information for monetary consideration.

7. “Sales” and “Sharing” for Advertising (U.S. State Law)

We use advertising and analytics technologies (such as cookies, pixels, and tags from partners like Meta and Google) that disclose online identifiers and activity to those partners so we can market the Platform and deliver relevant advertising — for example through retargeting and custom or lookalike audiences. Under several U.S. state privacy laws (including the California CCPA/CPRA and the Utah Consumer Privacy Act), this activity may be considered a “sale” or “sharing” of personal information, even though we do not exchange your data for money. We disclose this so you can exercise your choices.

Your opt-out choices. You can opt out of this “sale”/”sharing” of your personal information for targeted advertising by: - emailing us at privacy@stayutah.com with your request; and/or - using an approved browser opt-out preference signal, including the Global Privacy Control (GPC), which we honor as an opt-out for the browser or device that sends it.

We will treat opt-out preference signals as promptly as reasonably practicable and will act on emailed requests within the timeframe described in Section 8. We use commercially reasonable efforts to apply your choice across our systems and partners; because opt-outs depend on browsers, devices, and third-party systems, no method is perfect, and if you believe your choice was not applied you may contact us again and we will work to correct it. Opting out of advertising does not stop essential or first-party service communications about your bookings.

We do not knowingly sell or share for cross-context behavioral advertising the personal information of anyone under 16.

8. Your Privacy Rights

Depending on where you live (including under the Utah Consumer Privacy Act (UCPA), the California Consumer Privacy Act/CPRA, and similar Virginia, Colorado, Connecticut, Texas, and other state laws), you may have the right to: confirm whether we process your personal information and access it; obtain a copy of, or port, your personal information; correct inaccuracies; request deletion; opt out of targeted advertising, the sale of personal information, and certain profiling; and not be discriminated against for exercising these rights.

To exercise these rights, email us at privacy@stayutah.com. We will verify your request consistent with applicable law. We will acknowledge your request promptly and respond within 45 days; where reasonably necessary, we may extend once by an additional 45 days and will notify you if we do. You may use an authorized agent where permitted. If we deny a request, you may appeal by contacting legal@stayutah.com; you may also contact the Utah Attorney General’s Office or your applicable state regulator.

California residents may also request, once per year, the categories of third parties to whom we disclosed personal information for direct-marketing purposes.

9. Data Retention

We retain personal information for as long as needed to provide the Platform, fulfill the purposes in this Policy, comply with legal, tax, accounting, and dispute-resolution obligations, and enforce our agreements. We then delete or de-identify it. Retention periods vary by data type and legal requirement. Identity-document and selfie images remain with our identity-verification provider; Stay Utah does not create or retain separate copies, and authorized Host access uses short-lived provider links.

10. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your account credentials confidential and notify us at legal@stayutah.com of any suspected compromise.

11. Cookies and Tracking Technologies

We and our partners use cookies, pixels, tags, and similar technologies to operate the Platform, remember preferences, measure performance, and support advertising (including retargeting and audience-based advertising with partners such as Meta and Google). See our Cookie Policy for detail and choices. We honor the Global Privacy Control (GPC) signal as an opt-out of “sale”/”sharing” for the browser or device that sends it, and you can also opt out as described in Section 7.

12. SMS / Text Communications (TCPA)

By providing your mobile number or opting in, you give prior express written consent to receive recurring transactional and, where you opt in, marketing text messages from Stay Utah and the relevant Host. Message frequency varies. Reply STOP to opt out; reply HELP for help. Message and data rates may apply. Consent is not a condition of any purchase. We maintain records of consents and opt-outs and operate in compliance with the TCPA and applicable FCC rules.

13. Children’s Privacy

The Platform is intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact legal@stayutah.com and we will delete it as required by law.

14. International Users

The Platform is operated from the United States and intended for U.S. use. If you access it from outside the U.S., you understand your information will be processed in the U.S., which may have different data-protection laws than your jurisdiction.

15. Changes to This Policy

We may update this Policy at any time. Material changes will be posted with a new “Last Updated” date and, where required, additional notice. Your continued use after changes constitutes acceptance.

16. Contact Us

Stay At, LLC DBA Stay Utah · Attn: Privacy · PO Box 512, Toquerville, UT 84774 · privacy@stayutah.com