Privacy Policy

1. Information We Collect

We collect the following types of information:

From renters:

• Mobile account and session information — when an existing account holder signs in to the STV app, we process the name and email address associated with the account, account roles, a randomly generated installation identifier, device platform, app version, and session-security metadata. The app stores its refresh token in the operating system's secure storage and holds its short-lived access token in memory.
• Saved homes and app activity — the public listing slug, saved or removed state, and timestamps for homes attached to a signed-in account. Production app controls that create or remove saved homes remain disabled until the signed store build is separately verified; existing account-owned saved-home records may still be displayed.
• Trip and agreement review — account-linked property, stay dates, agreement status and timestamps, and the redacted agreement text made available to the signed-in account. The released app does not treat an unsigned agreement as a confirmed stay.
• Property-inquiry information — name, email address, phone number, desired dates, and messages sent through a released STV mobile-app inquiry flow, plus records retained from the former web inquiry flow. The website does not offer renter registration or a property-inquiry form.
• Rental alerts and legacy waitlists — email address and selected rental criteria submitted for a rental alert, plus previously collected property-waitlist records retained under the policy below.
• Newsletter signups — email address submitted to receive platform updates.
• App launch alerts — if launch-alert signup is opened, the email address and selected mobile platform you submit so we can send the requested notice. This purpose is separate from newsletters, property waitlists, rental alerts, and accounts.
• Lease information — if an owner uses our lease tool to send you a rental agreement, we collect your name, email, phone, lease dates, and electronic signature (including signature image and timestamp). The active lease-signing flow does not request a government-ID upload.

From property owners:

• Account information — name, email address, phone number, and profile bio.
• Property information — listing details, photos, pricing, availability, and address (subject to your Privacy & Visibility settings).
• Mobile owner-workspace information — authorized owners may view account-owned listings, inquiry and message history, calendars, leases, co-hosts, guidebooks, service providers, cleaners, support records, pricing, referrals, and settings. Depending on the feature, these records can include guest, co-host, vendor, or cleaner names and contact details, property addresses, message text, door or Wi-Fi instructions, lease dates and status, rates, and referral-credit information. Owner mutations remain independently gated.
• Verification documents — new government-ID and ownership-document uploads are disabled while private storage, authenticated access, and bounded deletion controls are validated. Legacy submissions await a separately authorized deletion process. A verification status may remain on a listing after the underlying document is removed.
• Subscription & billing — subscription plan, billing cycle, and subscription status. We never receive or store card numbers. Payment details are handled entirely by Apple, Google, or Paddle, depending on where the purchase is made.
• Lease & signature data — lease agreements generated through the platform, associated renter signature images, and signed PDF documents are stored on our servers. Lease links should be treated as confidential while private-media delivery controls are being hardened; do not include government-ID numbers or images in lease text.
• Cleaning session data — if you use the cleaner access feature, we collect cleaner name, phone number, and photos taken during cleaning sessions (before/after photos of property rooms).

Automatically collected:

• Usage and request data — pages or app screens requested, timestamps, referring URLs where available, IP address, request headers, and security or delivery signals processed by our servers and network providers. We do not currently embed third-party advertising or cross-service tracking in the app.
• Android map service data — the Android Google Maps SDK may automatically process IP address, device and request metadata, an SDK identifier, crash or diagnostic metrics, and map interactions such as pan and zoom. The STV app does not request your device's precise or approximate GPS location; listing coordinates come from the published property record.
• Cookies — we use a functional session cookie (stv_session) to maintain an authenticated Owner Portal or administrator session. Public rental browsing does not require a renter account. We do not currently use third-party tracking cookies.

2. How We Use Your Information

• Connect renters with property owners in The Villages
• Respond to Owner Portal, listing, and general platform-support form submissions
• Deliver property inquiries sent through a released STV mobile-app flow
• Maintain historical ownership-verification status. New document-based owner identity and ownership verification remains disabled unless separately released.
• Process subscription payments and manage billing
• Generate, deliver, and store lease agreements on behalf of owners
• Send transactional emails related to inquiries, leases, and platform activity
• Send automated emails configured by owners to leads and renters
• Send an app-launch notice you specifically request
• Authenticate existing mobile accounts and protect device sessions
• Display account-owned saved homes, trips, agreements, and authorized owner records
• Improve our website and services

3. Information Sharing

When you send a property inquiry through a released STV mobile-app flow, we share your contact details (name, email, phone number, and message) with the relevant property owner so they can respond. The same sharing applies to retained legacy web inquiries. The current website does not accept new property inquiries.

New identity-document collection and automated identity-document review are disabled. Legacy files may previously have been processed by a configured service provider. Legacy object and processor deletion requires a separately authorized, source-gated cleanup; verification documents are not shared with renters.

We do not sell, trade, or rent your personal information to third parties. We may share anonymized, aggregated data for analytics purposes.

4. Cookies

We use a single functional session cookie (stv_session) to maintain your browsing session. This cookie is essential for site functionality and does not track you across other websites. We do not currently use third-party advertising or tracking cookies. The native app does not use this browser cookie; it keeps its refresh token in operating-system secure storage.

5. Data Retention

We retain data for the following periods:

• Inquiry, rental-alert & legacy waitlist data — up to 2 years from submission unless a shorter approved product-specific period applies.
• App launch alerts — up to 12 months after the latest request, or 30 days after withdrawal. We delete them sooner after the requested notice is sent, the alert program ends, or you request erasure.
• Native sessions — active device sessions and refresh-token families last no more than 90 days. Security metadata may be retained for up to 30 additional days to investigate token reuse or account abuse.
• Saved homes — retained until removed from the account or handled through an approved account deletion or erasure request. The production app's save/remove controls remain disabled until the signed store build is separately verified.
• Owner account data — retained for the life of the account and up to 1 year after account deletion.
• Verification documents — new collection is disabled. Legacy government-ID, ownership-document, and automated-review records await a separately authorized deletion process that clears database references only after object deletion succeeds. Backup and processor expiry must also be verified; contact us to request deletion of a legacy record.
• Lease agreements & signatures — retained for 7 years from the date of signing, consistent with standard contract retention practices.
• Property photos — retained while the listing is active. Deleted within 90 days of listing removal.
• Cleaning session photos — automatically deleted 30 days after the cleaning session date. Session records (date, cleaner, notes) are retained for 1 year.

You may request deletion of your data at any time by contacting us.

6. Your Rights

You have the right to request access to, correction of, or deletion of your personal data at any time. When launch-alert signup is open, the app page also provides a direct withdrawal form. To delete your account, see Delete Your Account. To exercise other rights, email us at . We will respond to your request within 30 days.

7. Third-Party Services

We use the following third-party services to operate the Site and the STV app:

• Apple and Google — for purchases made inside the iOS and Android apps. Their respective privacy policies govern their handling of payment data.
• Paddle — for purchases made on the web, acting as merchant of record. Paddle's privacy policy governs their handling of payment data.
• Resend — for transactional email delivery. Email addresses are shared with Resend solely for the purpose of delivering account-verification messages, released mobile-app or legacy inquiry notifications, lease documents, and platform alerts.
• Self-hosted storage (MinIO) — for storage of property photos, lease PDFs, and cleaning session photos. New identity-document collection is disabled; legacy identity objects await the separately authorized deletion process. Data is stored on our own servers, not a third-party cloud provider.
• Cloudflare Turnstile — CAPTCHA verification on public forms to prevent automated abuse. Turnstile processes form interaction data to distinguish humans from bots.
• Cloudflare network services — delivery and protection of public web and API traffic. Cloudflare may process IP addresses, request headers, timestamps, and security signals under the configured service and log-retention settings.
• Google Maps Platform — the Android app uses Google Maps SDK to display published listing areas. The SDK automatically processes the service data described above. STV does not enable device-location collection for this map, and we do not use map-service data for advertising or cross-service tracking.
• AI enhancement service — property photos submitted for AI enhancement are processed by a third-party AI service. Photos are transmitted securely and are not used to train AI models. Use of AI photo enhancement is optional and owner-initiated.
• Identity-document AI — automated identity-document review is disabled. We do not send new renter IDs, owner IDs, or ownership documents to an external AI provider. Any future activation requires a separate processor review and updated notice.

8. Children's Privacy

The Villages is a 55+ active adult community. This Site is not directed at children under the age of 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Your continued use of the Site after any changes constitutes acceptance of the revised policy.

10. Contact

If you have questions about this Privacy Policy, contact us at .