Privacy policy

Stays For Less is a trading name of Alpenglow Holdings LLC, a U.S.-registered company, registered address 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, US. It decides how your data is used. Privacy questions: [email protected].

We have not appointed a representative in the UK or the EU. Please contact us directly at the address above.

• Bookings: the booker’s name, email address and phone number, the name of the guest staying when you book for someone else, the lead guest’s name for each further room, the guests’ nationality, the number of adults and children’s ages in each room, any special requests, the hotel, rooms, dates, price, booking reference and status. The guest names, the booker’s email and phone and any special requests go to the hotel with the booking. When you book, your IP address, the country it is in, your browser’s language and its user agent go to our booking supplier with the booking, for its fraud checks.
• Messages: your name, email address, optional booking reference and what you write to us through the help form.
• Your currency choice: stored in a cookie so prices stay in the currency you picked. Your country, taken from your connection, picks the phone country code checkout starts with.

We never see or store your full card number. Payments are taken on a secure form provided by our booking supplier and processed by Stripe, which handle your card details under their own privacy policies.

We use PostHog, hosted in its EU cloud, to see how the site is used: the pages you view, what you click, steps such as searching and paying, and errors the site runs into. It runs without cookies or browser storage, so it remembers nothing between page loads, and it does not record your screen. Our server also sends PostHog a log of each booking step, with the booking reference and status and never card details.

While we advertise on Google, Google’s ads tag runs on the site and sets the cookies listed below, and when you book after clicking one of our ads we tell Google that the ad led to a booking, with its value.

Everything the site, or a provider on it, keeps in your browser:

• currencyKeeps prices in the currency you picked.Stays For Less · 1 year
• sfl_attributionOnly when you arrive from an ad link: which campaign brought you. It is saved with a booking you make.Stays For Less · 90 days
• sfl_booking_…Lets the browser that entered your details see them again on your confirmation page.Stays For Less · 1 year
• sfl_purchase_… (browser storage)Makes sure a completed booking is counted once in our measurement.Stays For Less · Until you clear it
• sfl_analytics_off (browser storage)Remembers that you turned analytics off.Stays For Less · Until you clear it
• sfl:last-search (browser storage, this tab only)Fills the home page search form with your last search.Stays For Less · Until you close the tab
• tsr-scroll-restoration-v1_3 (browser storage, this tab only)Remembers how far down each page you were, so Back returns you to the same place.Stays For Less · Until you close the tab
• __ph_opt_in_out_… (browser storage)Only if you turn analytics off on a page where PostHog has loaded: keeps it off.PostHog · Until you clear it
• _gcl_au, _gcl_awOnly while we advertise on Google: links a booking to the ad that brought you.Google · 90 days
• __stripe_mid, __stripe_sidOn the payment step: fraud prevention.Stripe · 1 year; 30 minutes
• _grecaptcha (browser storage), _GRECAPTCHA (a google.com cookie), firebase-app-check-database and firebase-heartbeat-database (browser databases)Only when you send the help form: the check that you are not a bot.Google · Until you clear them
• __cf_bmMay be set when Cloudflare checks a visit for bots.Cloudflare · 30 minutes

• To make your booking with the hotel and manage it afterwards: to perform our contract with you.
• To take payment and arrange refunds: to perform our contract with you.
• To send the booking emails listed below: to perform our contract with you.
• To answer your messages: our legitimate interest in helping you.
• To keep the site safe from bots, abuse and fraud: our legitimate interest in protecting the site and guests.
• To measure how the site and our ads work: our legitimate interest in improving the site. You can turn it off above.
• To keep records for tax and accounting: our legal obligations.

You do not have to give us your details, but we need them to make a booking: without a name, email address and phone number we cannot book a room for you.

• A booking confirmation straight after you book, plus a copy if you ask for one.
• A check-in reminder 3 days before you arrive.
• A receipt when you write to us, and our reply.

We share only what each of these needs to do its job:

• Nuitee (LiteAPI): Our booking supplier and the merchant of record. It takes your payment and receives the booking: guest names, the booker’s email and phone, nationality, the party and children’s ages, special requests, and the IP address, country, language and browser of whoever books. Privacy policy
• Stripe: Processes the card payment on Nuitee’s payment form, and receives your card details. Privacy policy
• The hotel: Receives, through Nuitee and its suppliers, the lead guest’s name for each room, the booker’s email and phone, the dates, the party and any special requests.
• Resend: Sends our emails: your name, email address and booking details. Privacy policy
• PostHog: Measures how the site is used, from its EU cloud and without cookies. Privacy policy
• Google: Firebase App Check and reCAPTCHA Enterprise check that the help form is not sent by a bot, using technical data such as your IP address and browser. While we advertise on Google, its ads tag measures which ads lead to bookings. Privacy policy
• Cloudflare: Carries every visit to the site and our email routing, so it sees your IP address and the pages you request. Privacy policy
• Contabo: Hosts our server and database, where your booking and messages are stored. Privacy policy

We do not sell your data.

We are based in the United States, and so are most of our providers, so your data is processed there. Your booking also goes to the hotel, in the country where it is. Where data leaves the UK or the European Economic Area, we rely on our providers’ safeguards, such as the Standard Contractual Clauses or the EU-US Data Privacy Framework, where they apply.

We keep your data only as long as we need it to manage bookings and meet our legal duties:

• Bookings you paid for: 7 years from the booking, for tax and accounting records.
• Checkouts you did not pay for: 90 days.
• Messages sent through the help form: 2 years.
• Measurement data in PostHog: 1 year.
• Our nightly database backups: 14 days, so data we delete is gone from the backups 14 days later.

We delete what has passed its period once a month. Our providers keep what they hold for us, such as payment records, under their own policies.

Depending on where you live, you can ask us to:

• give you a copy of the data we hold about you;
• correct it, or delete it;
• restrict how we use it, or object to a use based on our legitimate interests;
• send it to you or to another company in a common format;
• stop a use you consented to, at any time.

Email [email protected]. We reply within one month, and may ask you to confirm who you are first. If you are not happy with our answer, you can complain to your data protection authority, such as the Information Commissioner’s Office in the UK or the authority in your EU country. Booking terms are in our terms of service.

What we collect: identifiers (name, email address, phone number and IP address), booking details, nationality, how you use the site (pages viewed and clicks, without cookies) and your approximate location (the country your connection is in).

Why: to make and manage your bookings, take payments, answer your messages, protect the site from fraud and bots, and measure how the site and our ads work.

Selling and sharing: we do not sell personal data. While we advertise on Google, its ads tag and the record that an ad click led to a booking may count as “sharing” for cross-context behavioural advertising under California law. You can opt out with the analytics and ad measurement switch above.

Global Privacy Control and Do Not Track: if your browser sends a Global Privacy Control signal, we treat it as that opt-out: Google’s ads tag does not load and no ad click is recorded. We do not respond to Do Not Track signals, because there is no common standard for them.

Your rights: you can ask to know what we hold about you and get a copy, to correct or delete it, and to opt out of sharing, and we will not treat you differently for doing so. Email [email protected]. Someone you authorise can ask for you. We confirm who you are before we act, and reply within 45 days.

The site is not meant for anyone under 18, and only an adult can make a booking. We do not knowingly collect data from children, other than a child guest’s age when an adult books a room for them.