Legal

Privacy Policy

Effective: August 5, 2026

This Privacy Policy explains how Stayvera Inc. ("Stayvera," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use our websites, mobile applications, travel services, referral program, communications, and related features (collectively, the "Services").

1. Who We Are

Stayvera Inc. is a Delaware corporation with its principal contact address at:

Stayvera Inc., 1111B S Governors Ave STE 37958, Dover, DE 19904, United States

For privacy questions or requests, contact legal@stayvera.com.

For the personal information processed to operate the Stayvera platform, Stayvera generally acts as the controller or business that determines why and how the information is processed. Hosts, accommodation providers, airlines, travel suppliers, connectivity providers, payment providers, and other parties involved in a transaction may separately control information they receive for their own services, legal obligations, and operations. Their privacy notices also apply to their processing.

2. Scope

This Policy applies to visitors, account holders, guests, hosts, travelers, trip organizers and participants, eSIM purchasers and recipients, referral-program participants, people who communicate with us, and anyone whose information is provided to us in connection with the Services.

It covers, as available:

Stay and hotel discovery, booking, payment, and support.
Flights, passenger services, and after-sales support.
eSIM purchases, gifts, installation, activation, top-ups, and support.
Combined checkouts and linked travel products.
Group trips, invitations, participant details, and split payments.
Traveler profiles and saved travel preferences.
Vera, trip guides, voice input, and other AI-assisted features.
Host profiles, listings, calendars, onboarding, payouts, and imports requested by hosts.
Accounts, saved payment preferences, platform balances, referrals, rewards, reviews, messaging, notifications, marketing, and support.
Our websites, applications, forms, and related communications.

This Policy does not govern a third party's independent processing on a website, application, or service that it controls.

3. Personal Information We Collect

The information we collect depends on which Services you use and the choices you make.

3.1 Account and profile information

We may collect:

Name, email address, profile image, biography, city, country, preferred language, and account role.
Account identifiers, authentication status, sign-in method, session information, verification status, and security events.
Settings, saved preferences, notification choices, analytics choices, and consent records.
Information made available by a sign-in provider you choose to use.
Account creation, update, sign-in, and deletion information.

3.2 Traveler, passenger, and recipient information

When you create a traveler profile, book travel, arrange travel for someone else, or send an eSIM, we may collect information about you and other travelers, passengers, companions, or recipients, including:

Full name, display name, title, gender, date of birth, relationship to the account holder, email address, telephone number, city, country, and nationality.
Passport or identity-card number, document type, issuing country, and expiration date where required for travel.
Loyalty-program details and saved traveler preferences.
Accessibility, mobility, dietary, allergy, health-related, or other special-request information that you choose to provide for planning or fulfillment.
Notes you add to help distinguish or assist a traveler.

If you provide information about another person, you must have authority to do so, provide any notices required by law, and ensure the information is accurate. You should avoid providing sensitive information that is not needed for the requested service.

3.3 Searches, preferences, and location information

We may collect:

Searched destinations, dates, routes, airports, properties, guest and passenger counts, ages of child travelers, cabin class, price range, and other filters.
Viewed and saved properties, favorites, recent searches, interactions, and travel interests.
Travel-planning preferences, such as budget, pace, interests, food preferences, and mobility or comfort needs.
Addresses, place selections, property coordinates, and approximate location derived from an IP address.
Device location if a feature requests it, you permit it, and it is needed to provide the feature.

We may use this information to personalize search results, recommendations, and trip-planning features.

3.4 Stay and hotel information

For a stay search, request, or booking, we may collect:

Property, room, dates, number of adults and children, pricing, currency, taxes, fees, cancellation terms, and special requests.
Guest and host identifiers, booking status, confirmation references, check-in details, and booking messages.
Acceptance, decline, cancellation, no-show, refund, dispute, and support records.
Information returned by the host, property operator, inventory source, or accommodation supplier about availability and fulfillment.

3.5 Flight information

For flight search, checkout, booking, and support, we may collect:

Origin, destination, travel dates, itinerary, cabin, fare, passenger count, offer details, and search history.
Passenger and travel-document information described above.
Selected seats, baggage or other ancillary services, fare conditions, ticket or booking references, airline locators, and travel documents.
Booking, payment, fulfillment, cancellation, change, credit, disruption, reconciliation, and support information.
Information returned by airlines, inventory providers, and other travel suppliers.

3.6 eSIM information

For eSIM services, we may collect:

Purchaser and recipient name and email address.
Selected plan, destination or coverage area, data allowance, duration, intended use date, order and item references, and price.
Assignment, installation, activation, usage-status, top-up, delivery, failure, refund, and support information.
Device or technical information needed to deliver, install, activate, or troubleshoot an eSIM.

3.7 Combined checkout, group trip, and split-payment information

When products are linked or purchased together, or when a trip is organized with others, we may collect:

The relationship among stays, flights, eSIMs, guides, travelers, and trip participants.
Trip name, destination, dates, organizer, invitees, participants, invitation status, and participant contact details.
Each participant's assigned amount or share, payment status, authorization status, deadlines, refunds, and related communications.
Information shown to trip participants so they can understand the trip and their own payment responsibilities.

Other participants may see limited information such as your name, participant status, and relevant trip or payment status. We do not show one participant another participant's full payment credentials.

3.8 Payment, balance, refund, and payout information

When you pay, save a payment preference, receive a refund, use a Stayvera balance, or receive a host or referral payout, we and our payment providers may process:

Billing name, billing email, billing address, currency, amount, and invoice information.
Payment-customer and transaction identifiers, authorization and capture status, card type, last four digits, expiration month and year, and wallet type.
Saved-payment-method preference and default-payment setting.
Platform-balance credits, debits, availability, and transaction history.
Refund, reversal, chargeback, dispute, fee, fraud-review, and reconciliation information.
For payouts, legal or business name, business type, address, date of birth, telephone number, support contact, connected-account status, verification status, tax or compliance status, and limited bank-account summary information.

Payment and payout providers may collect full card, bank-account, government-identification, beneficial-owner, tax, and verification information directly. We generally receive transaction identifiers, status information, and limited summaries rather than full payment credentials.

3.9 Host and listing information

If you host or manage a listing, we may collect:

Host name, contact details, biography, profile and banner images, location, account status, and verification status.
Property address and coordinates, title, description, images, property type, amenities, capacity, house rules, rates, fees, currency, calendar, check-in and check-out details, cancellation terms, and listing status.
Business, tax, identity, compliance, and payout information needed to support hosting and payments.
Information you direct us to import or verify for your host profile or listings, including source references, import status, listing details, and aggregate rating or review information.
Booking, guest, payout, fee, cancellation, dispute, performance, and support records associated with your listings.

3.10 Messages, reviews, content, and safety information

We may collect:

Messages among guests, hosts, travelers, organizers, participants, and Stayvera.
Reviews, ratings, titles, responses, profile content, listing content, photos, trip-guide content, and other material you submit.
Block, report, moderation, complaint, safety, investigation, and resolution information.
Support messages, attachments, call or communication records, and feedback.

Messages and reports may be reviewed where reasonably necessary to provide support, investigate safety or fraud concerns, enforce our terms, or comply with law.

3.11 AI, Vera, trip-guide, and voice information

When you use Vera or another AI-assisted feature, we may process:

Prompts, messages, responses, conversation history, feedback, selected context, and associated account or trip information.
Voice input submitted for transcription and the resulting transcript.
Travel preferences, traveler details, bookings, group-trip context, saved items, and other information you choose or authorize the feature to use.
Trip-guide briefs, dates, destinations, guest counts, child ages, planning style, notes, generated guides, itinerary events, and source references.
Usage, token, reliability, safety, diagnostic, and error information.

AI inputs and relevant context may be sent to service providers that help us generate responses, transcribe voice input, retrieve information, or create guides. Analytics and diagnostic records may include content or excerpts from AI interactions or transcripts where enabled, reasonably needed for reliability, safety, support, or improvement, and permitted by applicable law and your settings.

3.12 Referral and reward information

When you open or share a referral link, provide a code, sign up through a referral, join the referral program, or receive a benefit, we may collect:

Referral code, attribution method, link interaction, capture and claim time, and referrer-referred account relationship.
Program enrollment, eligibility, participant group, rates, credits, and program settings.
Qualifying product, booking, completion, cancellation, refund, dispute, fraud-review, reward, reversal, and payout status.
Reward amount, currency conversion, availability, payment, and accounting records.
Technical and security signals used to preserve requested attribution, prevent duplicate claims, and investigate abuse.

Before account creation, first-party referral storage may preserve a requested attribution for up to 90 days, subject to your choices and applicable law. Once a valid referral is connected to an account, we may use that relationship to administer eligible activity during the first 365 days after sign-up and retain necessary program and transaction records as described in Section 10.

3.13 Communications, forms, and marketing information

We may collect:

Contact, waitlist, partner, host, investor, and support form submissions.
Name, email address, company, role, inquiry type, message, and any document or attachment you choose to provide.
Service, security, booking, payout, referral, legal, support, and notification communications.
Marketing choices and email delivery, bounce, unsubscribe, and suppression status.
Push-notification tokens and notification preferences.

3.14 Device, cookie, log, and analytics information

When you use the Services, we may collect:

IP address, browser, device type, operating system, app version, language, time zone, network, and device identifiers.
Page and screen views, referral source, searches, clicks, navigation, feature use, dates and times, performance, and interaction events.
Session, cookie, local-storage, preference, and authentication information.
Crash, diagnostic, application, security, fraud, rate-limit, and error logs.
Approximate country or region signals.
Interaction recordings, heatmaps, or content visible in the interface where an optional analytics feature is enabled and permitted.
Account identifiers and profile attributes used to connect activity across signed-in sessions.

4. How We Obtain Information

We obtain personal information:

Directly from you, including when you create an account, search, book, pay, host, message, review, use an AI feature, submit a form, or change a setting.
From another person arranging travel, purchasing an eSIM, inviting you to a trip, splitting a payment, or otherwise providing information on your behalf.
Automatically from your browser, device, and use of the Services.
From hosts, accommodation providers, airlines, connectivity providers, and other travel or fulfillment parties.
From authentication, payment, payout, communications, analytics, mapping, security, and other service providers.
From sources you direct us to use and from public or commercial sources where permitted by law.
From business partners, professional advisers, authorities, and parties involved in disputes or business transactions.

5. How We Use Personal Information

We use personal information to:

Provide, personalize, maintain, and improve the Services.
Create, authenticate, secure, support, and administer accounts.
Search, price, link, book, pay for, confirm, fulfill, change, cancel, refund, and support travel products.
Send required traveler, passenger, recipient, booking, and payment information to the parties that fulfill the requested service.
Create and manage traveler profiles, combined checkouts, group trips, invitations, and split payments.
Save payment preferences, maintain platform balances, issue invoices, process payouts, and keep transaction records.
Operate host onboarding, listings, availability, bookings, communications, reviews, imports, and payouts.
Provide AI assistance, voice transcription, trip planning, recommendations, and generated guides.
Operate referrals, attribution, benefits, rewards, fraud controls, and payouts.
Send confirmations, receipts, alerts, service messages, legal notices, and support responses.
Send marketing where you have opted in or where otherwise permitted by law, and honor opt-outs.
Understand use of the Services, measure performance, diagnose errors, test features, and improve usability.
Personalize search results, content, and recommendations.
Prevent, detect, and investigate fraud, abuse, security incidents, prohibited conduct, and payment risk.
Moderate content, resolve disputes, protect users, enforce our terms, and establish or defend legal claims.
Comply with legal, tax, accounting, sanctions, consumer-protection, regulatory, and law-enforcement obligations.
Support audits, financing, corporate transactions, and business continuity.

We may aggregate or de-identify information and use it for lawful purposes. We do not attempt to re-identify data that is treated as de-identified where prohibited by law.

We identify information that is required to create an account, complete a transaction, verify eligibility, process a payment or payout, or comply with law. If required information is not provided, we may be unable to provide the relevant Service. Preferences, profile details, and other information not identified as required are optional.

6. Legal Bases for Processing

Where applicable law requires a legal basis, we rely on one or more of the following:

Contract

We process information when necessary to provide a Service you request or take steps at your request before entering a contract. This includes accounts, searches, bookings, payments, traveler profiles, group trips, eSIM delivery, AI features, support, cancellations, refunds, and payouts.

Legitimate interests

We process information where necessary for our legitimate interests or those of another party, after considering the impact on your rights. These interests include operating and improving the Services, limited product analytics, personalization, securing accounts and transactions, preventing fraud, supporting users, enforcing terms, maintaining records, and protecting legal rights.

Where permitted, we use limited analytics based on these legitimate interests to understand whether the Services work, diagnose problems, improve features, and protect the platform. Where applicable law requires consent before optional storage or access on your device, session recording, or similar analytics, we request that consent before enabling the relevant technology.

You may object to processing based on legitimate interests as described in Section 11.

Consent

We rely on consent where required, including for certain optional cookies or analytics, precise device location, marketing, or sensitive information. You may withdraw consent at any time for future processing. Withdrawal does not affect processing already carried out lawfully.

Legal obligations

We process information to comply with laws and binding requests, including tax, accounting, sanctions, travel, payment, identity, consumer-protection, safety, and regulatory obligations.

Vital interests and public interest

In limited circumstances, we may process information to protect a person's vital interests or perform a task recognized by law as being in the public interest.

7. Cookies and Similar Technologies

We use cookies, local storage, software development kits, pixels, and similar technologies for:

Account sign-in, security, fraud prevention, routing, preferences, and core Service functions.
Remembering locale, privacy, notification, and referral choices.
Measuring performance, diagnosing errors, understanding feature use, and improving the Services.
Preserving referral attribution requested by a user.

Necessary technologies operate because they are required to provide and secure the Services. Optional analytics and similar technologies operate based on legitimate interests where permitted and on consent where applicable law requires it. You can use the privacy controls made available in the Services or your browser or device settings. Blocking necessary technologies may prevent parts of the Services from working.

We do not use personal information for third-party behavioral advertising.

8. How We Disclose Personal Information

We do not sell personal information. We do not disclose personal information to data brokers or use or disclose it for cross-context behavioral advertising or targeted advertising.

We disclose personal information only as reasonably necessary for the purposes described in this Policy, including to:

Travel and fulfillment parties

We disclose booking and traveler information to hosts, property operators, accommodation suppliers, airlines, inventory providers, connectivity providers, network operators, and other parties needed to quote, book, fulfill, change, cancel, or support a requested product. These parties may process the information under their own privacy notices.

People involved in your trip or transaction

We disclose relevant information to a guest, host, organizer, participant, invitee, payer, traveler, passenger, or eSIM recipient as needed to coordinate the trip, perform the booking, allocate payments, communicate, address safety, or provide support.

Service providers

We disclose information to providers that perform services for us, such as:

Hosting, databases, storage, content delivery, and application infrastructure.
Account authentication and security.
Payment, payout, identity, tax, fraud, and compliance processing.
Travel search, inventory, booking, fulfillment, and connectivity.
Email, push notifications, customer support, and document delivery.
Maps, address search, geocoding, translation, and localization.
AI processing, voice transcription, information retrieval, and guide generation.
Analytics, diagnostics, performance monitoring, and security.
Listing import and other operational processing requested by a user.

These providers receive information needed to perform their services. Analytics providers may process limited account, device, usage, interaction, and diagnostic information under our instructions even though we do not sell personal information or use it for behavioral advertising.

Other disclosures

We may also disclose information:

At your direction or with your consent.
In a public profile, listing, review, or other area that you choose to make public.
To professional advisers, auditors, insurers, investors, and financing sources subject to appropriate duties.
To courts, regulators, tax authorities, law enforcement, or other parties when required or permitted by law.
To protect a person, investigate fraud or abuse, enforce terms, address security or safety, or establish and defend legal claims.
In connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, subject to applicable safeguards.

We may disclose aggregated or de-identified information where lawful.

9. International Transfers

Stayvera is based in the United States and operates an international travel platform. We and the parties described above may process personal information in the United States and other countries, which may have data-protection laws different from those where you live.

Where required, we use recognized safeguards for international transfers, such as contractual protections, approved transfer clauses, transfer assessments, and supplementary technical or organizational measures. We may also rely on an adequacy decision, a valid certification framework, or another lawful transfer mechanism. You may contact legal@stayvera.com for more information about safeguards relevant to your information.

10. Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy. This ordinarily includes the period while your account or service relationship is active and, unless information is deleted earlier, until we receive and validate a deletion request.

After a valid deletion request, we deactivate the account and delete, de-identify, or restrict personal information that is no longer needed within a reasonable period, except to the extent retention remains necessary to:

Complete or document a booking, payment, refund, payout, referral, support matter, or other transaction.
Comply with tax, accounting, travel, sanctions, regulatory, recordkeeping, or other legal obligations.
Detect or prevent fraud, abuse, security incidents, duplicate accounts, or prohibited conduct.
Resolve disputes, enforce agreements, or establish, exercise, or defend legal claims.
Protect the rights, safety, and integrity of users, Stayvera, or others.
Honor opt-outs and suppression requests.
Complete limited backup and disaster-recovery cycles.

How long an exception applies depends on the type of information, the transaction or claim lifecycle, legal requirements, risk of harm, and technical backup cycles. We do not retain information under an exception longer than reasonably necessary for that purpose. Some information may be deleted from active systems before it is removed from restricted backups.

Deleting an account may not cancel a booking or resolve an outstanding payment, refund, dispute, payout, or legal obligation. Where available, you may request deletion through the Services or by emailing legal@stayvera.com.

11. Your Privacy Rights and Choices

Depending on your location and applicable law, you may have the right to:

Know whether we process your personal information and access it.
Receive information about the categories, sources, purposes, and recipients of your information.
Correct inaccurate personal information.
Delete personal information, subject to lawful exceptions.
Restrict or object to certain processing, including processing based on legitimate interests.
Receive a portable copy of certain information.
Withdraw consent for future processing.
Opt out of marketing, targeted advertising, sale, or qualifying sharing.
Limit certain uses or disclosures of sensitive personal information.
Appeal a denial of a privacy request where applicable.
Lodge a complaint with a competent privacy or data-protection authority.
Receive equal service and not be discriminated against for exercising a privacy right.

To make a request, email legal@stayvera.com. Please describe your request and the account or email address involved. We may verify your identity and authority before responding. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct identity verification.

We will respond within the period required by applicable law. If we deny a request, we will explain the reason and any available appeal process where required.

EEA, UK, Swiss, and similar rights

Where these laws apply, you may object at any time to direct marketing. You may also object to processing based on legitimate interests; we will stop unless we have compelling lawful grounds or need the information for legal claims. You may complain to the data-protection authority where you live, work, or believe an infringement occurred.

United States state privacy rights

Residents of states with applicable privacy laws may exercise the rights available in their state, including access, correction, deletion, portability, opt-out, limitation, appeal, and authorized-agent rights. The categories of information we may collect are described in Section 3; sources are described in Section 4; purposes are described in Sections 5 and 6; and recipients are described in Section 8.

We do not sell personal information or process it for targeted or cross-context behavioral advertising. Because we do not conduct those activities, there is no sale or targeted-advertising activity to opt out of. Where required, we honor legally recognized browser-based opt-out preference signals for processing to which those signals apply.

Marketing and notifications

We send marketing where you opt in or where otherwise permitted by law. You may unsubscribe using the link in a marketing email or a setting made available in the Services. You may control push notifications through the Services or your device. Marketing choices do not prevent non-marketing communications about accounts, security, bookings, payments, payouts, legal updates, or support.

Analytics and device choices

Where available, you may manage optional analytics through our privacy settings. You can also control cookies and device permissions through your browser or operating system. Withdrawing consent or changing a setting applies to future optional collection and does not require us to delete information that we must retain under Section 10; you may separately request deletion.

12. Sensitive Personal Information

Some Services require or allow information that may be considered sensitive under applicable law, including account credentials, precise property location, government-identity or travel-document information, financial information, and health, accessibility, or mobility information you choose to provide.

We use sensitive personal information to provide requested travel, payment, verification, personalization, safety, and support functions; comply with law; and secure the Services. We do not use it to infer characteristics for unrelated advertising. Where law requires consent or provides a right to limit a particular use, we will request consent or honor that right.

Where required by law, we obtain explicit consent before processing health, accessibility, mobility, allergy, or similar sensitive information voluntarily provided for travel planning or fulfillment. We disclose that information only as needed to fulfill the related request. Consent may be withdrawn for future processing, although withdrawal may prevent fulfillment of the request.

13. Referral Rewards and Benefits

Participation in referral programs is voluntary. Referral rewards and user credits are tied to qualifying referrals, bookings, and program activity under the applicable program terms; they are not payment for selling personal information. You may stop participating in future referral activity by contacting us, although transaction and reward records may remain subject to Section 10.

14. Automated Processing

We use automated tools to personalize results, detect fraud or abuse, assess transaction and account risk, route support, and assist with content or travel planning. Travel, payment, and verification providers may also use automated systems under their own notices.

We do not make a decision based solely on automated processing that produces a legal or similarly significant effect unless permitted by law and accompanied by any required notice, safeguards, and right to request human review.

15. Children and Minor Travelers

Accounts, bookings, purchases, hosting, and referral-program participation are intended for people who are at least 18 years old. The Services are not directed to children as account holders.

An authorized adult may provide information about a child who will travel as a guest or passenger. We process that information only for travel planning, booking, fulfillment, safety, legal obligations, and related support. The adult must have authority to provide the information and should provide only what is necessary.

If you believe a child has created an account or provided information without proper authorization, contact legal@stayvera.com.

16. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These may include access controls, authentication, encryption, logging, monitoring, provider safeguards, and incident-response procedures.

No system is completely secure. You are responsible for protecting your devices, account credentials, verification codes, and access to your email account. Contact us promptly if you believe your account or information has been compromised.

17. Third-Party Services

The Services may link to or integrate with services controlled by others. A host, travel supplier, payment provider, sign-in provider, map service, application store, or other third party may process your information under its own privacy notice. We are not responsible for the independent privacy practices of services we do not control.

18. Changes to This Policy

We may update this Policy to reflect changes in the Services, our practices, or applicable law. We will update the effective date and provide any additional notice required by law. If a material change requires consent, we will request it before applying the change to processing that depends on consent.

19. Contact Us

For questions, requests, or complaints about privacy, contact:

Stayvera Inc., 1111B S Governors Ave STE 37958, Dover, DE 19904, United States

legal@stayvera.com