Privacy Notice

1. Scope and controller

StayClarity is responsible for the personal information described in this Notice. It applies to the StayClarity website, accounts, reviews, photos, reports, support messages, and related security and moderation operations. It does not cover a third-party listing site you visit from a StayClarity link.

Contact us at privacy@stayclarity.com. Please do not email identity documents or other sensitive records unless we ask you to use a secure channel.

2. Information we collect

• Account and authentication: email address, user ID, public username, account status, session and sign-in records, policy acceptances, and age confirmation that you are at least 18. We do not ask for your birth date or government ID at sign-up.
• Contributions: ratings, review text, normalized public listing URLs, optional photos, photo attestations, publication choices, helpful votes, reports, appeals, and related timestamps.
• Moderation and support: review status, verification outcome, staff decisions and reasons, report details, communications, account actions, and privacy or legal requests.
• Device, network, and security: request metadata, browser and device information, security-check results, error and performance events, and short-lived HMAC-derived network identifiers used for rate limiting. StayClarity does not store a raw IP address in its rate-limit table, although infrastructure and security providers may process IP addresses in their logs.

We collect information directly from you, automatically when you use the service, from the public listing URL you submit, and from service providers that help us authenticate, host, secure, deliver, and monitor the service. Do not submit sensitive personal information about yourself or anyone else in a review, photo, report, or username.

3. Photos

Photos are uploaded to private storage and converted to a sanitized JPEG with location and camera metadata removed. The original upload is queued for deletion after processing. A verification photo remains private and is available only to you, authorized staff, and providers supporting the review process. Review photos are published only if you selected them for publication and the review is approved. Removing a review or deleting the account queues its related photo objects for deletion.

Metadata removal reduces risk but cannot remove details visible in the image itself. Do not upload faces, documents, access codes, vehicle plates, precise routines, or other identifying or sensitive details.

4. How and why we use information

• Provide the service: authenticate you, maintain your account, connect reviews with listing URLs, process photos, publish approved content, record helpful votes, and provide exports and deletion tools.
• Safety and integrity: enforce limits, prevent fraud and manipulation, moderate content, investigate reports, secure accounts, debug failures, and maintain reliable operations.
• Communicate and comply: send sign-in messages, respond to support, privacy, appeal, and legal requests, preserve evidence when required, and meet legal obligations.

Where applicable, our legal bases are performance of our contract with you, our legitimate interests in providing and protecting a trustworthy review service, compliance with legal obligations, and consent where law requires it. You may withdraw consent for future processing, but that does not affect processing already performed or processing based on another lawful basis.

We do not use behavioral advertising, sell personal information, share it for cross-context behavioral advertising, or use sensitive personal information to infer characteristics. We do not make decisions with legal or similarly significant effects solely by automated means.

StayClarity does not currently provide an AI chatbot or use generative AI to create, summarize, score, rank, approve, reject, or respond to reviews, reports, or photos. Image tools validate files and create metadata-stripped copies; authorized staff make publication and moderation decisions. Security providers may use automated systems to identify abusive traffic, but those systems do not decide whether a review is published.

5. What becomes public

Approved reviews may display your username, rating, review text, publication date, verification label, aggregate helpful count, and the processed review photos you chose to publish beside the normalized listing URL. Public content can be copied or reshared by others outside our control. Your email, individual helpful votes, reports, private verification photo, policy acceptances, and moderation records are not public.

6. When we disclose information

We disclose only the information needed to vendors that operate and protect the service. Current providers and purposes are:

• Supabase: authentication, database, private file storage, API infrastructure, and transactional authentication email.
• Vercel: website hosting, delivery, and operational logs.
• Cloudflare Turnstile, when configured: bot and abuse prevention during sensitive actions.
• Sentry, when configured: scrubbed error and performance monitoring without session replay.

These providers process information under contract and their own security and privacy obligations. Error monitoring is configured to redact authorization data, emails, request bodies, review and report text, and URL query strings.

We may also disclose information when you direct us to; to investigate abuse or protect rights, safety, and security; to comply with valid legal process; or as part of a financing, merger, acquisition, reorganization, or sale, subject to appropriate notice and safeguards. A copyright or illegal-content notice may be shared with the affected contributor where permitted. We do not publish reports or rent personal information.

7. International processing

Our providers may process information in the United States, Mexico, and other countries whose laws may differ from yours. Where required, we use contractual and other recognized safeguards for international transfers and provide more information on request.

8. Cookies and local storage

We use necessary authentication cookies to keep you signed in and session storage to remember an internal return path and the listing you selected during the current browser session. Cloudflare Turnstile may set or read necessary data to distinguish people from abusive traffic. We do not use advertising cookies. Blocking necessary storage can prevent sign-in, security checks, or review submission from working.

9. Retention and deletion

We retain account and contribution data while the account or content is active. Original photo uploads are short-lived and queued for deletion after sanitization; abandoned and failed uploads are removed through scheduled cleanup. Processed photos follow the related review. Removing a review hides it immediately and starts its deletion or redaction lifecycle. Account erasure revokes sessions, removes authentication and storage objects, and redacts personal review, report, and moderation text.

Reports, moderation decisions, security records, and legal requests are kept only as long as reasonably necessary for safety, integrity, disputes, and legal compliance. Minimal non-identifying audit tombstones may remain. Backup deletion follows the provider’s rotation cycle, and a documented legal hold can pause deletion only for the information and time required.

10. Your privacy rights

Depending on where you live, you may have rights to know or access, correct or rectify, delete or cancel, restrict processing, object, receive a portable copy, withdraw consent, and appeal a denied request. Mexico’s access, rectification, cancellation, and opposition rights are commonly called ARCO rights. California residents may also ask about the categories, sources, purposes, and recipients of personal information and receive equal service for exercising rights. We do not sell or share personal information in a way that requires an opt-out link.

Use account settings when possible, or submit a privacy request. We verify requests proportionately, usually through the account email, and may allow an authorized agent where required. You may also complain to your local privacy or data-protection authority.

11. Security

We use access controls, private storage, signed URLs, encryption in transit, rate limits, metadata removal, audit trails, and data minimization intended to protect information. No system is completely secure. Contact security@stayclarity.com if you believe data or an account is at risk.

12. Adults only

StayClarity account and contribution features are for people 18 and older and are not directed to children. If we learn that a minor created an account or submitted personal information, contact us so we can investigate and delete it as appropriate.

13. Changes to this Notice

We may update this Notice as the service or law changes. We will post the new effective date and provide reasonable notice of material changes. Where required, we will request consent before using information for a materially different purpose.