Data Protection

1. The Threat We Designed Against

Before writing a single line of code, we ran our own analysis of how competing rental sites expose owner data. We found four techniques used by scrapers:

• Plain HTML scraping — crawlers read tel: and mailto: links directly from page source. No JavaScript needed.
• Headless browsers — tools like Playwright execute JavaScript and decode client-side obfuscation (including base64-encoded contact details) in milliseconds.
• Unauthenticated APIs — many platforms expose owner PII via public REST endpoints with no authentication, making mass collection trivial.
• Rate limit evasion — scrapers use residential proxy pools and random delays (2–8 seconds between requests) to defeat naive IP-based rate limiting.

2. What Owner Data We Collect

• Name — used on your listing and in communication with renters.
• Email address — used for Owner Portal access and platform notifications. Never shown in public listing HTML.
• Phone number — kept in the private owner profile and not displayed on public rental listings.
• Payment information — processed exclusively by Stripe. We never store card numbers.

3. How We Protect Owner Contact Info

• Email never appears in HTML — owner email addresses are used server-side for Owner Portal and approved platform notifications. They are never included in a public listing response, even encoded.
• Phone stays private — owner phone numbers are not rendered on public rental pages. Listing contact actions use a protected Contact Owner web form instead of a public phone link. No renter account or app is required.
• Name truncation for inactive accounts — Inactive listings show “First L.” format instead of full name, making scraped data less useful for cross-referencing.
• Address precision control — you choose: Hidden (nothing shown), General (“The Villages, FL”), or Exact (full street address). Default is General.
• No public owner API — there is no unauthenticated endpoint that returns owner contact data. The owner profile API requires a valid session.
• PII scoped at query time — public listing queries omit private owner phone and email fields. The data does not reach the public render layer or the protected Contact Owner form.

For Property Owners

As a property owner on Stay The Villages, FL, you have direct control over what renters can see. Here’s what you can manage per-listing:

• Address precision — choose Hidden (nothing shown), General (village name only — default), or Exact (full street address). This applies to both the map embed and Google structured data.
• Private contact details — owner phone and email are not displayed on the public listing. Its protected Contact Owner form routes each inquiry only to the owner of the relevant property.
• Email is always private — your email address is never shown publicly. Renters use the listing's protected Contact Owner web form without needing an account or app.

Manage these settings in your property editor under Policies → Privacy & Visibility.

4. How We Protect Renter Info

• Inquiry details sent through a protected Contact Owner web form, or through any separately released STV mobile-app flow, are shared with the owner of the specific property and property contacts they have authorized, including co-hosts and notification recipients.
• We never sell or trade renter contact information. Authorized property contacts and service providers receive it only as described in the Privacy Policy.
• Inquiry data is retained for up to 2 years and can be deleted on request.

5. Our Technical Safeguards

• Server-side rate limiting — supported public mutation endpoints (platform contact, rental alerts, newsletter signup, and owner login or registration) enforce per-IP request limits in our database, independent of JavaScript. Protected property-inquiry writes fail closed when required checks do not pass.
• Cloudflare Turnstile CAPTCHA — challenge verification on supported public contact, signup, alert, and authentication forms. The property-inquiry form uses server validation, a honeypot, and layered rate limits.
• Honeypot fields — invisible fields on supported public contact, inquiry, and signup forms that automated tools fill in, triggering silent discard of the submission.
• HTTPS everywhere — all traffic is encrypted in transit via Cloudflare.
• bcrypt password hashing — owner passwords are hashed with bcrypt before storage. We cannot recover them.
• JWT auth on all owner routes — owner portal and admin routes require a valid signed session token stored in an httpOnly cookie.
• Docker-isolated deployment — the application runs in an isolated Docker container with no direct database exposure to the internet.

6. Bot Blocking Policy

We allow most crawlers — including search engines, AI assistants, and SEO tools we use for our own performance tracking (Ahrefs, Data for SEO). We block scrapers that are primarily used to harvest contact data for resale or competitor intelligence:

• SemrushBot
• MJ12bot
• DotBot
• PetalBot
• serpstatbot
• Bytespider

These are disallowed via robots.txt. Compliant crawlers will honor this. Combined with rate limiting and honeypots, this creates meaningful friction for non-compliant scrapers.

7. Report a Concern

If you believe your contact information has been harvested from this platform, or if you discover a security vulnerability, please email us at [email protected]. We commit to responding within 48 hours.