Data controller (responsible). ConsuStay, Inc., 1980 Colorado Blvd, Bullhead City, Arizona 86442, U.S.A. Privacy contact: support@consustay.com.
This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the rights you have. It serves as our privacy notice (aviso de privacidad) under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and as our privacy disclosure under U.S. state privacy laws, including the California Consumer Privacy Act as amended (CCPA/CPRA).
1. Who this applies to
This Policy applies to everyone who uses the Platform: Guests in the United States and Mexico, Hosts in Mexico, and visitors. Because Listings are located in Mexico, Mexican data-protection law applies to the processing of data relating to Hosts and to Guests in Mexico; U.S. state laws apply to Guests in the relevant U.S. states.
2. Personal information we collect
3. How we use your information
Under the LFPDPPP we distinguish between processing that is necessary and processing that requires your consent.
Necessary to provide the Marketplace Services (no separate consent required):
- Creating and managing your Account, and enabling Bookings, Reservations, and communications between Hosts and Guests.
- Processing payments, payouts, refunds, and Service Fees through Stripe.
- Verifying identity and eligibility, preventing fraud, and keeping the Platform secure.
- Providing customer support and resolving disputes.
- Complying with legal obligations, including Mexican tax withholding and reporting (see Section 5).
Processing that requires your consent (which you may withdraw):
- Sending marketing communications and using non-essential cookies for analytics or advertising.
- Processing any financial or sensitive data, and transferring your data across borders as described in Section 6.
- Enabling any optional features that rely on precise location or, in the future, biometric verification.
4. Automated decisions and AI
We may use automated systems for fraud detection, search ranking, and risk scoring. Any artificial-intelligence features are limited and, at present, forward-looking. Where an automated decision produces a significant effect on you, you may object and request human review, consistent with the LFPDPPP and other Applicable Law.
5. How we share your information
We do not sell your personal information for money. We share it only as described here:
- With Hosts and Guests as needed to facilitate a Booking or Reservation (e.g., a Host receives the information necessary to host a Guest).
- With Stripe to process payments, payouts, and refunds. Stripe processes your data under its own terms and privacy policy.
- With service providers acting on our behalf: identity-verification vendors, cloud hosting, email/SMS delivery, analytics, and mapping providers, under contracts that limit their use of your data.
- With the Mexican tax authority (SAT). Because Listings are in Mexico, we are legally required, as a digital intermediation platform, to report transaction information to SAT — including Host tax IDs (RFC) and, for lodging, property addresses — to withhold Mexican income tax (ISR) and value-added tax (IVA) from Host payouts, and to issue withholding certificates (CFDI). See the “Mexican Tax Withholding & Reporting” section of the Terms.
- With authorities where required by Applicable Law or valid legal process, or to protect the safety of Users, the public, or the Platform.
- In a business transfer (merger, acquisition, financing, or sale of assets), subject to this Policy.
6. International data transfers
Your information may be processed in the United States and in Mexico. When we transfer personal data of Mexican residents outside Mexico, we do so on the basis of your express consent and/or another lawful basis under the LFPDPPP, and we take reasonable steps to protect the data. By using the Platform and agreeing to this Policy, Users in Mexico consent to the cross-border transfer of their data to the United States for the purposes described here.
7. Data retention and deletion
We keep personal data only for as long as necessary for the purposes described, then delete it after a blocking period, consistent with the LFPDPPP. We retain certain data longer where required for tax and financial records, fraud prevention, dispute resolution, and legal compliance. Retention periods reflect the longer of the applicable legal requirement or the period necessary to provide the Marketplace Services.
8. Security and breach notification
We use reasonable administrative, technical, and organizational safeguards to protect personal information. No system is perfectly secure, so we cannot guarantee absolute security. If a security breach materially affects your personal data, we will notify affected Users and authorities as required by Applicable Law and within the timeframes it prescribes.
9. Your rights
If you are in Mexico (ARCO rights). You may request Access, Rectification, Cancellation, and Opposition (ARCO) with respect to your personal data, revoke consent, and limit the use or disclosure of your data. To exercise these rights, contact support@consustay.com with enough information for us to locate your data and verify your identity. We will respond within the timeframes set by the LFPDPPP. The supervisory authority is Mexico’s Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), which now exercises the data-protection functions formerly held by INAI.
If you are in the United States. Depending on your state, you may have the right to know what personal information we collect and how we use and disclose it; to access, correct, or delete it; to opt out of any “sale” or “sharing” (we do not sell your data); to limit the use of sensitive personal information; and to be free from discrimination for exercising these rights. California residents may use an authorized agent. To exercise these rights, contact support@consustay.com. We will verify your request before responding.
10. Children’s privacy
The Platform is for adults. You must be at least 18 years old (or the age of majority in your jurisdiction, whichever is greater) to use it. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.
11. Cookies
We use cookies and similar technologies as described in our Cookie Policy, which forms part of this Privacy Policy. You can manage non-essential cookies through our consent tool and your browser settings.
12. Changes to this Policy
We may update this Policy to reflect changes in our practices or the law. We will post the updated Policy with a new effective date and, where required, provide additional notice. Your continued use of the Platform after the effective date means you accept the updated Policy, except where Applicable Law requires fresh consent.
13. Contact
Privacy questions and rights requests: support@consustay.com. Postal: ConsuStay, Inc., 1980 Colorado Blvd, Bullhead City, Arizona 86442, U.S.A.