Privacy Policy

This Privacy Policy explains how Wonderful Innovations, Inc., which operates YoStays! ("YoStays!", "we", "us", or "our"), collects, uses, discloses, and protects personal information when you use the YoStays! website, mobile applications, marketplace, communications, and related services (collectively, the "Services").

Wonderful Innovations, Inc. is the controller of personal information covered by this policy unless we tell you otherwise. This policy applies to guests, hosts, prospective hosts, website visitors, and people who contact us. It does not govern a host's independent handling of information outside the Services or third-party websites and services that have their own privacy policies.

The information we collect depends on how you use YoStays! The categories below also describe the personal information we have collected during the preceding 12 months:

Account login information, precise geolocation, government-issued identification, financial information, date of birth, and the contents of private communications may be considered sensitive personal information under some laws. We use sensitive information only as reasonably necessary to provide requested Services, process payments and payouts, maintain account security, prevent fraud, verify users, comply with law, and protect people's safety. We do not use it to infer characteristics about you for advertising.

• Account and profile information, including your name, email address, telephone number, date of birth, profile photo, preferred language, account role, login and authentication identifiers, and account settings.
• Identity and verification information, including government-issued identification or verification results when needed for trust, safety, fraud prevention, legal compliance, or host and payout onboarding. Authentication providers may process passwords, one-time codes, and account recovery information on our behalf.
• Booking and travel information, including searches, saved stays, travel dates, destination, guest count, traveler details, accessibility or accommodation requests, special requests, booking history, check-in details, cancellations, refunds, and trip-related preferences.
• Host and listing information, including business and contact details, property addresses and coordinates, listing descriptions, photographs and other media, rates, availability, amenities, house rules, safety disclosures, permits, tax and compliance information, and payout onboarding status.
• Transaction and financial information, including amounts charged or paid, currency, payment and payout status, refunds, chargebacks, payment method type and limited card details such as brand and last four digits, and payment-provider tokens. Our payment providers, rather than YoStays!, process full payment-card numbers and bank-account details.
• Communications and content, including guest-host messages and attachments, reviews, replies, reports, support requests, dispute records, survey responses, and other content you submit through the Services.
• Device, usage, and log information, including IP address, browser and device type, operating system, app version, device and advertising identifiers where permitted, referring pages, pages or screens viewed, actions taken, session dates and times, crash information, and security logs.
• Location information, including approximate location inferred from an IP address and, if you enable a location-based feature and grant device permission, more precise device location. You can control precise-location access through your device settings.
• Cookie and preference information, including session information, language and display preferences, and analytics or campaign interactions collected through cookies, pixels, software development kits, and similar technologies.

We collect information directly from you; automatically from your browser, device, and use of the Services; from other users, such as a host, booking organizer, or guest who includes you in a reservation; from service providers such as identity, payment, fraud-prevention, communications, analytics, and hosting providers; from partners you choose to connect; and from public or legally available sources.

If you provide personal information about another person, you are responsible for having authority to provide it and for directing that person to this Privacy Policy where appropriate.

We use personal information to provide, personalize, maintain, and improve the Services. This includes creating and securing accounts; displaying listings; returning relevant search results; processing booking requests, payments, refunds, and host payouts; enabling guest-host communications; providing trip, check-in, and account notifications; and responding to support requests.

We also use information to verify users and listings; detect, investigate, and prevent fraud, abuse, discrimination, unsafe activity, payment risk, security incidents, and violations of our Terms; moderate content and messages; resolve disputes; enforce agreements; conduct audits; debug and develop features; perform analytics; comply with tax, accounting, sanctions, law-enforcement, and other legal obligations; and establish or defend legal claims.

We may send product news, offers, or surveys where permitted by law. You can unsubscribe from promotional email using the link in the message. Opting out of marketing does not stop transactional or service communications about your account, bookings, payouts, safety, or legal updates.

Where applicable law requires a legal basis, we process personal information as needed to perform our contract with you; to comply with legal obligations; with your consent; and for our legitimate interests or those of others, including operating and improving the marketplace, securing the Services, preventing fraud, communicating with users, and protecting users and the public. We balance those interests against the effect on your rights.

You may withdraw consent at any time where we rely on consent. Withdrawal does not affect processing that occurred before withdrawal, and some Services may be unavailable if the information is necessary to provide them.

We disclose personal information only as reasonably needed for the purposes described in this policy:

• Between users. We share information between guests and hosts to evaluate or fulfill a booking, coordinate a stay, communicate, handle an issue, and publish reviews. Certain profile, listing, and review information is visible to other users or the public. Exact property and check-in details may be limited until a booking is confirmed.
• With service providers. Vendors process information for cloud hosting and storage, authentication, identity verification, fraud prevention, search, payments and payouts, communications, customer support, analytics, security, and professional services. Stripe processes payment and payout information under its own privacy terms when it provides those services.
• With authorities and protected parties. We may disclose information when we reasonably believe it is required by law or legal process; necessary to enforce our agreements; or appropriate to protect the rights, property, or safety of YoStays!, our users, or others, including in emergencies and fraud or security investigations.
• In a business transaction. Information may be reviewed or transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, subject to appropriate confidentiality protections where required.
• At your direction. We may disclose information to third parties when you ask us to, connect a third-party service, or otherwise give consent.

We do not sell personal information for money. As of the effective date of this policy, we also do not share personal information for cross-context behavioral advertising or process it for targeted advertising or solely automated decisions that produce legal or similarly significant effects, as those terms are defined by applicable U.S. state privacy laws.

During the preceding 12 months, we disclosed the categories described in Section 2 to the categories of recipients described in Section 6 for the business and operational purposes stated in this policy. During that period, we did not sell those categories or share them for cross-context behavioral advertising.

If our practices change, we will update this policy and provide any required opt-out methods before using personal information in that way. We do not knowingly sell or share the personal information of anyone under 18 for targeted advertising.

We and our service providers use essential technologies to authenticate users, keep sessions secure, remember settings, prevent fraud, and operate the Services. We may also use preference and analytics technologies to understand performance and improve YoStays! Your browser or device may let you block or delete these technologies, but essential features may then stop working correctly.

Because we do not currently sell personal information or use it for targeted advertising, an opt-out preference signal such as Global Privacy Control does not change those practices. If we begin processing covered by such a signal, we will recognize qualifying signals as required by applicable law.

We retain personal information only for as long as reasonably necessary for the purposes described in this policy. Retention periods depend on the type and sensitivity of the information; the length of our relationship with you; booking, payment, payout, and support history; safety and fraud-prevention needs; applicable limitation periods; and tax, accounting, regulatory, and other legal requirements.

When information is no longer needed, we delete or de-identify it. We may retain information after account deletion when required by law, necessary to complete transactions, resolve disputes, prevent fraud or abuse, enforce our agreements, or protect the safety and integrity of the Services. Backup copies may remain for a limited period before being overwritten.

Depending on where you live and subject to legal exceptions, you may have the right to confirm whether we process your personal information; access it; correct inaccuracies; delete it; obtain a portable copy; receive a list of categories of third parties to which it was disclosed; withdraw consent; restrict or object to certain processing; limit certain uses of sensitive personal information; and opt out of sale, targeted advertising, or qualifying automated profiling. You also have the right not to receive discriminatory treatment for exercising a privacy right.

You may update certain profile information in your account. To exercise another right or request account deletion, email privacy@yostays.com and describe your request. We will verify your identity using information associated with your account before fulfilling a request. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct identity verification. If we deny a request, you may appeal by replying to our decision with the subject line "Privacy Appeal."

Residents of the European Economic Area, United Kingdom, or Switzerland may also complain to their local data protection authority. These rights are not absolute, and we may retain or continue to use information where permitted or required by law. We will explain any material denial and available appeal or complaint options.

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, security monitoring, and protections appropriate to the nature of the information. No system or transmission method is completely secure. You are responsible for using a strong, unique password, keeping credentials and verification codes confidential, and promptly telling us if you suspect unauthorized account activity.

YoStays! is operated from the United States, and we and our service providers may process information in the United States and other countries whose data-protection laws may differ from those where you live. Where required, we use an approved transfer mechanism or another legally recognized safeguard for international transfers.

The Services are not directed to people under 18, and they may not create an account, make a booking, or publish a listing. We do not knowingly collect personal information directly from children under 13. An adult organizing a trip may provide limited information about a child traveler when reasonably necessary for a booking or stay. If we learn that an account belongs to a person under 18, or that a child has provided personal information without appropriate authorization, we will take appropriate action. Contact privacy@yostays.com if you believe this has occurred.

The Services may link to websites, apps, maps, payment services, or other services that we do not control. Their privacy practices are governed by their own notices. Review those notices before providing information to them. A link or integration does not constitute an endorsement of the third party's privacy or security practices by YoStays!

We may update this Privacy Policy to reflect changes in our Services, practices, or legal obligations. We will post the revised policy and update the effective date. If a change materially affects your rights, we will provide additional notice where required, such as through the Services or by email. We will not apply materially different practices retroactively without appropriate notice or consent where required by law.