Privacy Policy

Effective date: 2026-08-16
Last updated: 2026-08-16

Who we are

Happy Haven STR ("we," "us," "our") is a short-term rental management company based in Salt Lake City, Utah. Our website is happyhavenstr.com. Privacy contact: welcome@happyhavenstr.com.

We operate as Happy Haven STR, LLC. Our registered address is 3225 McLeod Dr, Suite 100, Las Vegas, NV 89121, United States. We manage short-term rental properties in Utah and communicate with guests, property owners, cleaners, and vendors through this website, the guest portal, and the cleaner, vendor, and owner portals.

This policy covers what we collect through those surfaces, why, who we disclose it to, how long we keep it, and the choices you have. It applies to direct bookings made with us. A booking made through Airbnb, VRBO, Booking.com, or Furnished Finder is also covered by that platform's own privacy policy for the data the platform collects.

What information we collect

Booking information: name, email, phone number, stay dates, party size, payment confirmation references (card numbers are processed by Stripe and never touch our servers).
Guest communications: messages you send to our team or to Heavenly, our AI concierge, and SMS replies.
Consent records: TCPA SMS opt-in with timestamp, IP address, and the consent language version you saw.
Technical data: IP address and basic request logs for security and rate limiting.

We also hold, where the relationship creates it:

Access information: the door code issued for your stay and the window it is valid for. Door codes are derived from the last four digits of the phone number on the booking.
Stay records: damage or incident reports, cleaning and inspection records for the property you stayed in, and any service-recovery notes.
Portal accounts: for team members, property owners, cleaners, and vendors — name, email, role, and authentication credentials held by our authentication provider. We never see or store your password.
Owner and vendor financial records: payout and invoice records for the property owners and service vendors we contract with.

We do not collect biometric information, precise device geolocation, or special categories of personal information, and we do not buy personal information from data brokers.

How we use it

To operate your booking (confirmations, door codes, stay messages), to respond to you, to meet legal obligations, and — only with your explicit opt-in — to send promotional messages. Heavenly uses your booking context to answer questions about your stay.

Specifically, we use the information above to:

Confirm and service the stay you booked, including sending the access code and arrival details.
Answer your questions, by email, by text, or through Heavenly.
Take payment and issue refunds through Stripe, and place or release the refundable damage hold described in our Terms of Service.
Keep the property and our systems secure — rate limiting, fraud prevention, and investigating damage or policy violations.
Meet tax, accounting, lodging-tax, and other legal obligations.
Send promotional messages about early check-in, late check-out, and returning-guest offers, only where you have opted in to receive them.

We do not use your information to build advertising profiles, and we do not make automated decisions about you that have legal or similarly significant effects. Heavenly answers questions using the context of your own booking and the property's knowledge base; it is not used to score or rank guests.

Sub-processors that operate the service: Stripe (payments), Twilio (SMS), Resend (email), Supabase (database and authentication), Seam (door codes), OwnerRez (channel management), Anthropic and OpenAI (AI concierge processing), Vercel (hosting). The full sub-processor list with purposes is published to property owners. We do not sell personal information.

Sub-processors

Stripe — processes card payments and refunds. Stripe receives your card details directly; we receive only a confirmation reference and card metadata such as brand and last four digits.
Twilio — transmits the text messages you have asked for, and receives the mobile number needed to deliver them.
Resend — sends transactional and, where you opted in, promotional email.
Supabase — hosts the database and authentication for the site and portals.
Seam — issues and revokes the door code for your stay.
OwnerRez — synchronizes availability and reservations with listing channels.
Anthropic and OpenAI — process concierge questions and the property knowledge base. Your questions are not used to train their models.
Vercel — hosts and serves the website.

Beyond these sub-processors, we disclose personal information only:

To the property owner whose property you stayed at, limited to what they need for their own records and tax reporting.
To a cleaner or vendor dispatched to the property, limited to the stay dates and the task — not your contact details, unless the task requires contacting you and you have been told.
To our accountants, insurers, and legal advisors, under a duty of confidentiality.
Where required by law, legal process, or to protect someone's safety or our legal rights.
To a successor, if the business or a part of it is transferred, subject to this policy.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have not done either in the preceding twelve months.

Text messages and mobile information

If you opt in, we send text messages about your booking to the mobile number you give us. This section describes that program and how we treat the number.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

You opt in by checking an unchecked box during the booking flow at happyhavenstr.com that reads:

Checking the box is optional and is never a condition of booking or of any purchase. If you leave it unchecked, your booking completes normally and we reach you by email instead. When you do check it, we record the mobile number, the date and time, your IP address, and the exact version of the consent language you were shown, as proof of opt-in.

What we send

Messages about the stay you booked: booking confirmations, pre-arrival access codes, mid-stay check-ins, and checkout reminders. If you opted in, a limited set of promotional messages: early check-in offers, late check-out offers, and return-guest offers.

Message frequency varies with your booking; a typical stay receives 5 to 10 messages between booking and checkout. We do not send texts before 8:00 a.m. or after 9:00 p.m. property local time.

Cost

Message and data rates may apply. We do not charge you for these messages. Any charge comes from your own mobile plan.

How to stop, and how to get help

Reply STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to any message to end all messages from the program. You will receive one confirmation that you have been unsubscribed, and nothing after that. Reply START or UNSTOP to resubscribe.

Reply HELP or INFO to any message for help. You can also call or text the guest line at (435) 334-3915, or email us at the privacy contact above.

Opting out of text messages does not cancel your booking. We will continue to reach you by email about the stay you booked.

Mobile carriers are not liable for delayed or undelivered messages, and delivery depends on your carrier's network and on your handset. The full program terms are in our Terms of Service.

How we hold the number

Your mobile number and the consent record are used to deliver the messages described above and to prove that you consented. The number is disclosed only to Twilio, which transmits the messages, and to the mobile carrier that delivers them to your handset. Neither the number, the opt-in record, nor your consent is shared with any third party for marketing or promotional purposes, and neither is sold or rented.

Payment information and card data

Card payments are processed by Stripe using Stripe's own hosted payment fields. Card numbers, expiry dates, and security codes go directly from your browser to Stripe. They never reach our servers, our logs, our database, or our source control, and they never appear in an error message or a webhook payload. We operate at PCI-DSS SAQ A scope and file that self-assessment annually with Stripe. What we retain is the payment confirmation reference and card metadata such as the brand and the last four digits.

Security

Personal information is held in a database with row-level access rules, so a property owner sees only their own property's data and a guest sees only their own booking. Access to the internal operations system is limited by role, administrator accounts require two-factor authentication, and passwords must be at least 12 characters. Traffic to the site and portals is encrypted in transit. Access codes for doors are issued for a fixed window and expire on their own.

No system is immune to compromise. If a breach affects your personal information, we will notify you and the relevant regulators within the deadlines the applicable state law sets.

Retention

We keep personal information for as long as we need it for the purpose we collected it, and then for as long as the law requires us to keep the record.

Booking, payment, and tax records: retained for the period tax and accounting law requires. Stripe retains payment metadata for seven years as a compliance requirement of its own.
Guest contact details and communications: retained for the life of the guest relationship, so that a returning guest is recognized and a dispute can be answered.
SMS consent records: retained for as long as we may need to prove consent, which outlasts the stay itself.
Text message content: held by Twilio for approximately 30 days, with delivery metadata retained longer, under Twilio's own retention policy.
Door codes: the code expires at the end of the stay window; the record that one was issued is retained with the booking.
Request logs: retained short-term for security and rate limiting.

When you exercise a deletion right, we anonymize rather than destroy: your name, email, and phone number are replaced with placeholder values while the underlying financial and tax record is preserved, because that record is our own business record and is required to be kept.

Your privacy rights

Residents of California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have rights over their personal information. We extend the rights below to every guest, wherever they live, rather than gating them by state.

You may ask us to:

Know and access what personal information we hold about you, and get a copy of it.
Correct information that is inaccurate.
Delete your personal information, subject to the records we must keep, described under Retention.
Opt out of sale or targeted advertising. We do not sell personal information and do not use it for targeted advertising, so there is nothing to opt out of — but the right stands.
Not be discriminated against for exercising any of these rights. Your booking, your rate, and the service you receive do not change because you made a request.

You may request access, correction, or deletion of your personal information at welcome@happyhavenstr.com or (435) 334-3915. Deletion uses an anonymize-and-keep procedure for records we must retain (per our legal compliance manifest).

We respond within 45 days of a verified request, and will tell you if we need a permitted extension. To protect your information we verify a request against the booking it concerns before acting on it. An authorized agent may make a request on your behalf with written proof of authority. If we decline a request, we will say why, and residents of Virginia, Colorado, and Connecticut may appeal that decision by replying to our response; we will answer an appeal within 45 days.

Children

The service is intended for adults booking accommodation. We do not direct the site at children under 13 and we do not knowingly collect personal information from them. A guest booking a stay must be at least 18. If you believe a child has given us personal information, contact us and we will delete it.

Cookies and tracking

The site uses only strictly necessary cookies and browser storage — authentication tokens that keep team members and property owners signed in. We set no analytics, advertising, or cross-site tracking cookies, and we do not respond to Do Not Track signals because we do not track across sites. If analytics are ever added, this policy is updated and a consent mechanism ships with them. Full detail is in our Cookie Policy.

Changes

We will post changes here with a new effective date. Material changes are notified to guests with active bookings.

Contact

Happy Haven STR, LLC · 3225 McLeod Dr, Suite 100, Las Vegas, NV 89121 · (435) 334-3915. For privacy questions or to exercise a right, use the privacy contact at the top of this policy.