Privacy Policy

Information We Collect

Information You Provide

We collect information you voluntarily provide when you interact with our website, including:

• Booking and Inquiry Details: Name, email address, phone number (if provided), number of guests, requested dates, any message you include, and your optional answer to "How did you hear about us?" when you book or submit a booking inquiry. Your acknowledgment of our Terms & Conditions and House Rules is recorded with the submission. A property-specific rental agreement is provided separately for review and e-signature after booking and before check-in.
• Contact Form Submissions: Name, email address, the contents of your message, and your optional answer to "How did you hear about us?" when you use our contact form.
• Communications: Any information you include in emails or other correspondence with us.
• Payments: Payment is made at booking through our secure Stripe-powered checkout. For a deposit booking, the balance is charged to the same card only when the signed rental agreement carries a separate consent naming the card, amount and date and those details still match; otherwise we send a Stripe-hosted payment link. Your full card number and security code are entered on Stripe's pages and are never collected or stored by this website. For direct bookings, as a condition of booking, the card is kept securely on file with Stripe (not by this website) until 90 days after check-out. Its permitted uses are limited by the signed rental agreement to that one separately authorized balance charge, documented damage costs, and documented holdover charges.

Information Collected Automatically

When you visit our website, certain information is collected automatically:

• Usage Data: Pages visited, entry and exit pages, active engagement time, scroll completion, outbound links, form interactions, referring website, and campaign parameters. This is collected both by Google Analytics 4, if enabled, and by our own first-party system, which keeps it as a per-browser visit history described under Cookies and Tracking Technologies below.
• Device Information: Browser type, operating system, screen resolution, and broad device type. We do not use canvas, audio, font, or similar device fingerprinting.
• IP Address and Approximate Location: Our hosting provider processes request information, which may include your IP address, to deliver and protect the site. Google Analytics 4 uses an IP address at collection time to estimate broad location, such as country and city, then discards it before the address is logged by Google Analytics. We do not request GPS location. When you submit the booking or contact form, your IP address is recorded with the submission and time to prevent spam and abuse and to document your acknowledgment of our terms. The browser identifier described under Cookies and Tracking Technologies is recorded with it as well, so that a submission can be matched to the visit that produced it; that record holds no name, address, phone number or message text of its own.

On-Site Security Cameras (During Your Stay)

The exterior of Woodland Chalet is monitored by outdoor security cameras: a doorbell camera at the front entrance, a spotlight camera at the trash-can area, a driveway camera, and two cameras facing the woods behind the house (one on each side). These devices record exterior areas only, and the doorbell camera may also capture audio at the front entrance. No camera can view the outdoor hot tubs, the indoor pool, or any interior space, and there are no cameras inside the home.

Recordings are used for property security, arrival and delivery awareness, wildlife deterrence, and enforcement of the occupancy and event rules in our House Rules. Footage is reviewed only when a security, safety, or rule-violation concern arises. Recordings are overwritten automatically on a rolling basis by the camera system and are kept longer only when needed to document a specific incident, in which case the relevant clips are retained with the related booking records.

How We Use Your Information

We use the information we collect to:

• Process and confirm your booking reservations
• Communicate with you about your stay, including check-in instructions and property details
• Respond to your inquiries and customer service requests
• Send booking confirmations, receipts, and follow-up communications
• Improve our website, content, and overall guest experience
• Analyze website usage to understand how visitors interact with our site
• Protect against fraudulent transactions and ensure the security of our website

We do not use this information for automated decision-making, and no automated system decides whether you may book.

We keep a record of each visitor's activity on our site, described under Cookies and Tracking Technologies below. It is stored on our own servers, is never sold, shared, or used for advertising, and is used to understand how guests find us and to respond well when they get in touch. When a booking is completed and paid for, the booking's reference is written onto that browser's visit history, so we can tell which way of finding us actually produced a stay.

Information Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following limited circumstances:

• Payment Processor: We use Stripe to process payments securely. Payment is made at booking through Stripe's checkout. For a deposit booking, the balance is charged to the same card only under the separate, matching consent in the signed rental agreement; otherwise it is collected through a Stripe-hosted payment link. Your full card number and security code are entered on Stripe's pages and are never seen or stored by us. For direct bookings, Stripe retains the booking card on file, as a condition of booking, until 90 days after check-out. Its permitted uses are limited by the signed rental agreement to that one separately authorized balance charge, documented damage costs, and documented holdover charges. See Stripe's Privacy Policy.
• Email Delivery: Booking and contact emails are delivered through Brevo, our email service provider, which processes recipient addresses on our behalf.
• Analytics: If we enable Google Analytics 4, Google processes information about use of our website on our behalf. Advertising personalization and Google Signals are disabled in our site tag. See Google's Privacy Policy.
• Hosting and Security: Our hosting provider processes your data (including server logs) as part of delivering and securing this website.
• Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities.

My Trip: Guest Accounts

Guests who book with us directly get a page of their own at My Trip, holding their dates, what they have paid, their rental agreement and, close to the date, how to get into the house. It is the only part of this site you can sign in to. If you booked through Airbnb or Vrbo, or if you never create an account, none of this applies to you and nothing in this section is collected.

What an Account Holds

• Your Email Address and a Password Hash: The account is your email address and a password you choose. We never store the password itself, only a one-way cryptographic hash of it that cannot be reversed (see Data Security below). We never see it, cannot recover it, and will only ever help you replace it.
• Which Bookings Are Yours: An account is matched to bookings by email address. It holds no separate copy of your booking; the booking record described elsewhere in this policy remains the one record of your stay.
• What It Never Holds: No card number, no card expiry, no security code, and no bank detail of any kind. Card details are entered on Stripe's pages and are never seen by this website. The account also holds no address, no message you have written to us, and no browsing history.
• Setting It Up: The link that lets you set a password arrives by email, works once, and expires. Finishing also requires one thing that email does not contain: the last four digits of the card you paid with, or for bookings that keep no card on file, the exact amount you have paid. This is deliberate. It means a confirmation email forwarded to a group chat, or sent to a mistyped address, cannot become an account.

The Trip Page's Own Record

Alongside each booking we keep a small file for its trip page, separate from the booking record itself. It holds:

• Whether a shared trip link has been created for that booking, and whether it has been revoked.
• An access log of who opened the arrival details and when, with the visiting address stored only as a keyed hash rather than the address itself. This exists so that a question about who was given a door code has an answer.
• The type and time of any request you send us from the page, for example a message or a cancellation request. The text of what you write is not stored here. It lives in the email that reached us, like any other message you send us.
• Where the owner has entered them, the details needed for your arrival: the link and PIN for the in-house guest app, and any door code specific to your stay. These are readable only by a signed-in guest whose stay has met every condition for release, they are never included in any email or log, and they are removed when your stay ends.

Sharing Your Trip Page

You can share your trip page with the people travelling with you. A shared link shows the dates, the house and area information, and, once your stay is fully in order and close enough to check-in, how to get in. It never shows money, your rental agreement, or anything about a card. Each view is recorded in the access log described above. You can revoke the link at any time from the page, and it stops working at the end of check-out day whether you revoke it or not.

If You Cannot Get In

Email us at woodlandchaletdcl@gmail.com and we will send you a fresh setup link or sign you out everywhere. Sign-in errors are deliberately vague about whether an address is one of ours, so if something is not working, writing to us is faster than guessing.

Cookies and Tracking Technologies

Most of this site sets no first-party session cookies. The one exception is My Trip, the signed-in page for guests who booked with us directly: signing in there sets a session cookie, described below. Everywhere else, we store an identifier and related information in your browser's own local storage, also described below, to keep a record of how this browser uses the site. If Google Analytics 4 is enabled, it may set analytics cookies to help us understand how the website is used; it is switched off on My Trip. Our hosting provider may also set security or performance cookies.

Cookies We Use

• My Trip Session Cookie: When you sign in to My Trip we set one cookie named ahe_trip. It holds a signed record of which account and which booking you are signed in to, when it was issued and when it expires, and nothing else: no name, no email address, no password, and nothing about a card. It is marked HttpOnly and Secure, so scripts cannot read it and it only travels over an encrypted connection. It lasts 24 hours from your last visit and no more than 14 days from signing in, whichever comes first, and "Log out" or "Log out everywhere" ends it immediately. If you never sign in, this cookie is never set.
• Shared Trip Links: If the person who booked shares their trip page with someone travelling with them, opening that link sets the same cookie in a limited form: it is tied to that one booking, carries no account, expires at the end of check-out day, and can be revoked by the person who booked at any time.
• Visit History (Local Storage, Not a Cookie): When you first arrive, we store a randomly generated identifier in your browser's local storage. It is not derived from any information about you, and by itself it identifies a browser rather than a person. Using it, we record on our own servers how you reached us (for example a search engine, a social link, or typing the address directly), the pages you view and how long you spend on them, and any dates you price or select on our booking page. Local storage may also hold a second value, a marker set only on our own browsers by visiting a special link, so that our testing does not get counted as guest activity. It says nothing about you and is never set on a visitor's browser unless we deliberately open that link on it.
• Linking Your Booking or Inquiry to Your Visit: If you book or submit our booking inquiry or contact form, the name, email address, and phone number you provide are associated with that visit history, so we can see what a guest was interested in before getting in touch. This happens only when you choose to submit a form. If that visit goes on to become a paid booking, the booking's reference is recorded on the same visit history, which is how we tell which channel produced a stay; the reference is added by our payment webhook only after the payment is confirmed. We do not purchase information about you, obtain your identity from other companies, follow you across other websites, or track you across devices.
• Analytics Cookies: Only if analytics is enabled. Google Analytics 4 cookies (_ga, _ga_*) help distinguish visits and sessions so we can understand traffic patterns, popular pages, and conversion paths. Google processes this data on our behalf and may treat the identifiers involved as personal data; see Google's Privacy Policy.
• Performance Cookies: Caching/security cookies may be set by our hosting provider for security and performance optimization.

Managing Cookies

You can block or delete cookies through your browser settings without preventing access to this site or its inquiry forms. Clearing site data for this website also removes the identifier described above, and the site works normally without it. To have the visit history on our servers deleted as well, email us at woodlandchaletdcl@gmail.com. You can also opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy:

• Booking Records: Retained for at least 7 years to meet tax and legal record-keeping requirements, then deleted once no longer legally required.
• Card on File: For direct bookings, the booking card is retained on file by Stripe until 90 days after check-out, then released.
• Contact Form Submissions: Retained for up to 2 years, then deleted unless part of an active booking or ongoing correspondence.
• Analytics Data: Google Analytics data is retained according to our GA4 configuration.
• Hosting Request Data: Our hosting provider may process request information under its own retention settings for operations, security, and abuse prevention. Our current hosting plan does not give us raw web access logs.
• Cookies: The My Trip session cookie lasts at most 24 hours from your last visit and 14 days from signing in; a shared trip link expires at the end of check-out day. This site sets no other cookies of its own. Analytics cookies (if enabled) typically expire after 2 years; any hosting-provider security/performance cookies follow that provider's settings.
• My Trip Account: Your email address and password hash are kept while you have a booking with us and for 24 months after your most recent check-out, so that a returning guest keeps the password they chose. After that the account is deleted automatically. You may ask us to delete it sooner at any time.
• The Trip Page's Own Record: The file described under My Trip, including the access log, the shared-link record and any arrival details, is deleted 30 days after check-out. Arrival details and shared links stop working at the end of check-out day, 30 days before the file itself goes.
• Visit History: Retained until you ask us to delete it, since guests often research a stay months before booking. The identifier in your browser, and the testing marker described above if it was ever set, remain until you clear site data for this website. You may request deletion at any time; see Your Rights.

Your Rights

You have the following rights regarding your personal information:

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may request that we correct any inaccurate or incomplete information.
• Deletion: You may request that we delete your personal information, subject to any legal retention requirements.
• Opt-Out: You may opt out of receiving non-essential communications from us at any time.
• Stop Being Recognized: Clear site data for this website in your browser and everything we stored there is removed, including the identifier, so we no longer recognize you on return. This does not affect browsing, pricing a stay, or submitting an inquiry.
• Delete Your Visit History: Email us and we will delete your visit history and anything associated with it, and confirm when it is done. We retain booking and payment records where the law requires, and will tell you if that applies.
• Delete Your My Trip Account: Email us and we will delete the account and its password hash, and confirm when it is done. This does not cancel or alter a booking, and it does not delete the booking record itself, which we keep for the period described under Data Retention.
• Sign Out Everywhere: From My Trip you can end every signed-in session at once, on every device, without waiting for us.

To exercise any of these rights, please contact us at woodlandchaletdcl@gmail.com. We will respond to your request within 30 days.

Children's Privacy

Our website is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. All bookings must be made by an individual who is at least 30 years of age, in accordance with our house rules. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

Third-Party Links

Our website may contain links to third-party websites, including Airbnb, resort websites, and local activity providers. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party website you visit.

Data Security

We take reasonable measures to protect your personal information from unauthorized access, use, or disclosure. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and our website
• Secure payment processing through a PCI-compliant provider (Stripe), on Stripe-hosted pages
• A static website with no content-management system and no SQL database, which keeps the surface exposed to attack small. Bookings and guest accounts are held as individual files outside the public web folder, unreadable over the web, and only a small number of purpose-built endpoints can reach them at all.
• Passwords for My Trip are never stored. What we keep is a one-way cryptographic hash produced with a deliberately slow, salted algorithm (argon2id, or bcrypt where the server does not offer it), which cannot be reversed into your password. When you choose a password we check it against public breach corpora, using a method that never sends us or anyone else the password itself. Repeated wrong guesses are slowed down per address, sign-in errors never reveal whether an email address is one of ours, and changing or resetting your password signs out every other device.
• Restricted access to personal information on a need-to-know basis

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Your continued use of our website after any changes constitutes your acceptance of the updated policy.