1. Plain-English Summary

We are Short Stay in LA, a furnished-rental property management company based in Beverly Hills, California. When you fill out a form on our Site, send us an email, or call us, we collect what you tell us so we can answer you and follow up about managing your home. We use a small set of well-known service providers (hosting, transactional email, analytics, advertising platforms) to run the Site and to market it responsibly. We honor Global Privacy Control as a valid opt-out under California law, and we do not knowingly collect data from anyone under 16. If at any point you want us to forget you, write to legal@shortstayinla.com and we will.

2. Scope

This Privacy Policy applies to shortstayinla.com and to any offline information you give us by phone, email, text, or in person. Our service providers process information on our behalf under written agreements that restrict their use of it to the purpose we engaged them for.

3. Information We Collect

In the past twelve (12) months we have collected the following categories of personal information, as defined by the California Consumer Privacy Act, Cal. Civ. Code § 1798.140:

Identifiers. Name, email address, phone number, postal address, IP address, device identifiers.
Customer records (Cal. Civ. Code § 1798.80(e)). Name, address, telephone number, and contact information submitted through our lead form, calculator, or by email.
Commercial information. Records of services requested, inquiries made, and prior communications with us.
Internet or other electronic network activity. Pages viewed, referring URL, search terms that led to the Site, time on page, scroll depth, basic device and browser metadata, and other telemetry described in our Cookie Policy.
Geolocation. Approximate location derived from your IP address (city or region level). We do not collect precise GPS location through the Site.
Professional and property information. The property address, neighborhood, type, bedroom and bathroom count, approximate square footage, and any owner-stated value or notes you submit.
Inferences.Inferences we draw from the above to assess fit and to estimate revenue, including the calculator output and the lead-routing tag (for example, “calculator” or “lead-form”).

We do not collect categories of sensitive personal information for the purpose of inferring characteristics. We do not knowingly process biometric identifiers, government IDs, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, genetic data, or the contents of mail, email, or text messages where we are not the sender, recipient, or intended recipient.

4. Sources

We get the categories above from (a) you directly, when you fill out a form or contact us; (b) your device and browser, when you visit the Site; and (c) our service providers (for example, our advertising platforms tell us which ads led to a click).

5. How We Use Information

respond to your inquiry and prepare an honest earnings estimate;
onboard your property if you become a managed owner;
send transactional messages about your inquiry or your property;
send marketing messages only to the extent you have opted in;
operate, secure, and improve the Site;
measure the effectiveness of our marketing channels and ad spend;
detect, prevent, and respond to fraud, abuse, and security incidents;
comply with law and respond to lawful requests by public authorities;
establish, exercise, or defend legal claims.

6. Who We Share With

We share personal information with the following categories of recipients, under written agreements that restrict their use of it:

Hosting and infrastructure. Vercel Inc. hosts the Site and processes server logs (including IP, user agent, timestamp, and URL).
Transactional email. Resend Inc. delivers lead notifications, calculator estimate emails, and our follow-up replies.
Internal alerts. The Telegram Bot API delivers alerts to a private team channel so we can respond to leads quickly.
Analytics. Google Analytics 4 (GA4) for aggregate-level traffic measurement.
Advertising and conversion tracking.Meta (the Facebook Pixel and Conversions API) and Google Ads conversion tracking, so we can measure ad performance and reach similar audiences. Where we use these tools to retarget or build similar audiences we treat that as “sharing” for purposes of California law (see Section 7).
Call tracking. A call-tracking provider (for example, CallRail) may assign a tracked phone number to your visit so we can measure which channel drove your call. Calls may be recorded for quality and training where lawful and clearly disclosed.
Professional advisors. Our attorneys, accountants, insurers, and auditors, where they have a need-to-know.
Government or law enforcement. When we are required to disclose by valid legal process, or to protect the rights, safety, or property of any person.
Successors. A buyer or successor in interest in connection with a merger, financing, restructuring, or sale of all or part of our business. Any successor is bound to honor this Policy as it applied to the information transferred.

We do not sell personal information for money. We do engage in “sharing” as that term is defined under the California Privacy Rights Act (cross-context behavioral advertising) when we use third-party advertising platforms (for example, Meta, Google Ads) for retargeting or for building similar-audience models. You can opt out of sharing at any time by following the instructions on our Do Not Sell or Share My Personal Information page, by setting Global Privacy Control in your browser, or by emailing legal@shortstayinla.com.

We do not knowingly sell or share the personal information of any person under 16 years of age.

8. Retention

We retain personal information only for as long as we need it for the purposes described above, then we delete or de-identify it.

Inquiry data (lead-form and calculator submissions): up to 24 months from your last interaction with us, then deletion, unless you ask us to delete it sooner or you become a managed owner.
Server logs (Vercel):typically up to 30 days, subject to our hosting provider’s retention.
Email and transactional records (Resend):up to 30 days for delivery logs; the email body itself remains in the recipient’s mailbox per their own retention.
Analytics (GA4): up to 14 months at the event level; aggregate reports retained indefinitely.
Advertising platforms (Meta, Google Ads):per each platform’s retention policy; we use hashed identifiers where available.
Managed-owner records: for the duration of the management relationship plus seven (7) years for tax, audit, and California trust-account record retention obligations.

9. California Rights (CCPA / CPRA)

California residents have the right to:

know what personal information we have collected, used, disclosed, and sold or shared about you in the past twelve (12) months;
receive a copy of that information in a portable format;
correct inaccurate personal information we hold about you;
delete personal information we have collected from you, subject to legal exceptions;
opt out of the sale or sharing of personal information for cross-context behavioral advertising;
limit the use and disclosure of sensitive personal information (we do not currently process sensitive personal information for inference purposes, but this right still applies);
not receive discriminatory treatment for exercising any of these rights.

10. Global Privacy Control

We honor the Global Privacy Control (GPC) signal sent by your browser or browser extension as a valid request to opt out of the sale or sharing of your personal information. If you visit the Site with GPC enabled, we will not initialize advertising tags that engage in cross-context behavioral advertising for that visit.

11. How to Submit a Privacy Request

Submit any privacy request at /privacy/requests or by email to legal@shortstayinla.com from the email address you provided. We will acknowledge your request within ten (10) business days and respond substantively within forty-five (45) days, with one optional 45-day extension where reasonably necessary. We may need to verify your identity before responding to a request to know, delete, or correct.

12. Authorized Agents

You may use an authorized agent to submit a request on your behalf. We will require the agent to provide written permission from you and we may require you to verify your identity directly with us before we respond. We may deny a request from an agent who cannot provide proof of authorization.

13. EU and UK Rights (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection under the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR. Our lawful bases for processing are:

Performance of a contract or pre-contractual steps (Art. 6(1)(b)): handling your inquiry and preparing an estimate.
Legitimate interests (Art. 6(1)(f)): securing the Site, measuring marketing performance, and following up about property management services we believe may interest you.
Consent (Art. 6(1)(a)): non-essential cookies, advertising tags, and any SMS or call recordings.
Legal obligation (Art. 6(1)(c)): tax, audit, and regulatory recordkeeping.

You have the right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal) and the right to lodge a complaint with your supervisory authority. For the UK, that is the Information Commissioner’s Office (ico.org.uk).

14. Quebec Law 25

If you are a Quebec resident, the Act respecting the protection of personal information in the private sector applies. You have the right of access, rectification, withdrawal of consent, data portability, and the right to be informed before your personal information is used to render a decision based exclusively on automated processing. We do not make such decisions about you. Our person in charge of the protection of personal information can be reached at legal@shortstayinla.com.

15. International Transfers

We are based in the United States. If you access the Site from outside the United States, your information will be transferred to, stored in, and processed in the United States. Where required, transfers from the EEA, the UK, or Switzerland to the United States rely on the EU-US Data Privacy Framework (where the recipient is certified) or on Standard Contractual Clauses. You can request a copy of the SCCs we rely on by emailing legal@shortstayinla.com.

16. Security

All form submissions are transmitted over TLS. Data at rest is stored on infrastructure that uses encryption at rest. Access to personal information is limited to personnel who need it. We use rate limiting, a honeypot field, and basic abuse heuristics on the lead form to keep bots out. No method of transmission over the internet is one hundred percent secure. We will notify affected users and applicable regulators of a personal-information breach as required by law.

17. Children

The Site is not directed to children under 16 and we do not knowingly collect their personal information. If you are a parent or guardian and believe we have collected data from a child under 16, email legal@shortstayinla.com and we will delete it.

18. Do Not Track

Some browsers send a “Do Not Track” (DNT) signal. There is no industry standard for how a website should respond. We honor Global Privacy Control as described in Section 10, and we treat GPC as the operative signal.

19. Changes

If we materially change this Policy, we will update the “Last updated” date at the top of the page and, where required by law, notify you in advance.

20. Contact

Privacy questions and requests: legal@shortstayinla.com or /privacy/requests. Mailing address: [BUSINESS ADDRESS: TBD, Beverly Hills, CA].

Last updated: 2026-05-24 · Pending counsel review.

Reach us at legal@shortstayinla.com. Short Stay in LA, [ENTITY: Short Stay in LA, LLC, to confirm], [BUSINESS ADDRESS: TBD, Beverly Hills, CA].