Privacy Policy

This Privacy Policy explains how StanHattie LLC ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you use CouchSurfer (the "Platform"). By using the Platform, you consent to the practices described here.

1. Information We Collect

Information You Provide

• Account data: name, email address, password (hashed), profile photo, bio, vibe tags.
• Listing data: address, photos, descriptions, house rules, pricing.
• Booking data: dates, number of guests, messages, payment info (handled by our payment processor — we do not store raw card numbers).
• Communications: messages sent between hosts and surfers via the Platform.
• Reviews: content you submit about other users.

Information Collected Automatically

• Usage data: pages visited, search queries, clicks, booking flows.
• Device data: IP address, browser type, operating system, device identifiers.
• Location data: approximate location derived from IP address; precise location only if you grant permission during listing creation.
• Cookies & similar technologies: session tokens, preferences. See Section 4.

2. How We Use Your Information

Purpose	Legal Basis
Providing and improving the Platform	Contract performance
Processing bookings and payments	Contract performance
Vibe matching between hosts and surfers	Contract performance / Legitimate interest
Account verification and security	Legal obligation / Legitimate interest
Customer support	Contract performance
Analytics and product development	Legitimate interest
Marketing communications (with consent)	Consent
Fraud prevention and safety	Legitimate interest / Legal obligation

3. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

• Between users: Your public profile (name, avatar, bio, vibe tags, reviews) is visible to other users. Address details are shared with a Surfer only after a booking is accepted.
• Service providers: We share data with trusted vendors who help us operate (payment processing, email delivery, analytics, cloud hosting). These vendors are contractually bound to protect your data.
• Legal compliance: We may disclose information to comply with applicable law, regulation, legal process, or governmental request.
• Safety: We may share information to protect the rights, property, or safety of users or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your data is subject to a different privacy policy.

4. Cookies & Tracking

We use cookies and similar technologies to:

• Maintain your session and authentication state.
• Remember your preferences.
• Understand how users interact with the Platform (analytics).

You can configure your browser to reject cookies, but some features of the Platform may not function correctly without them. We do not use third-party advertising cookies.

5. Data Retention

We retain personal data for as long as your account is active or as necessary to provide services, comply with legal obligations, resolve disputes, and enforce agreements. After account deletion, we may retain anonymized or aggregated data for analytics purposes. Messages and booking records are retained for up to 3 years following the stay.

6. Security

We implement industry-standard security measures including TLS encryption for data in transit, bcrypt password hashing, CSRF tokens, and regular security audits. No method of transmission over the Internet is 100% secure. We cannot guarantee absolute security but are committed to protecting your data.

7. Your Rights

Depending on your location, you may have rights to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and personal data, subject to legal retention requirements.
• Portability: Receive your data in a structured, machine-readable format.
• Objection / Restriction: Object to or restrict certain processing activities.
• Withdraw consent: Where processing is based on consent, you may withdraw at any time.

To exercise any of these rights, contact us at hello@stanhattie.com. We will respond within 30 days.

8. Children's Privacy

The Platform is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If we learn that we have collected such information, we will delete it promptly.

9. International Transfers

Your information may be processed in the United States or other countries where our service providers operate. By using the Platform, you consent to the transfer of your data to countries that may not provide the same level of data protection as your home country. We apply appropriate safeguards such as Standard Contractual Clauses where required.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the Platform. Continued use after the effective date constitutes acceptance.

11. Contact Us

StanHattie LLC — Privacy Team
Email: hello@stanhattie.com
Phone: (833) 278-5002
Website: stanhattie.com