Privacy Policy
Last updated October 7, 2026
What we collect
Account details
Your name, email address, username and password.
Identity check
Before any money moves, everyone verifies through Stripe Identity with a government ID and a short video selfie. Stripe compares the two and tells us only whether it matched and your confirmed name. We never see or store the ID, the selfie or any biometric data; Stripe keeps that under its own privacy policy. If you live in Illinois, Texas or another state with a biometric privacy law, submitting a verification is your written consent to that collection, for identity verification only.
Disney Vacation Club® (DVC) contract details
If you are an owner, your deed, contract number, resort and point allotment, so we can confirm the contract is real.
Payment details
Stripe handles all payments. We never store full card numbers, security codes or bank account numbers.
Agreements and consents
When you sign a rental agreement or confirm an important action, we record the exact text you saw, the figures shown, the guest names, your e-signature, your IP address, your browser and the time. That is our proof of what you agreed to.
Messages and bug reports
What you write on the platform. Phone numbers, email addresses and social handles are stripped from messages before delivery, and both people are told when that happens. Our staff can read a message thread when handling a dispute or a report. Sharing contact details to take a deal off the platform is against our rules.
Collected automatically
The pages you visit and features you use, your browser, operating system, screen size and IP address, and session cookies that keep you signed in. We also detect visits from automated agents such as AI assistants, using signals that do not identify anyone.
How we use it and who sees it
We use your information only to run the marketplace: processing payments, holds, refunds and owner payouts; verifying users and owner contracts; creating and storing rental agreements; sending emails about bookings, deadlines and payouts; enforcing platform rules, including the 60 percent rental cap; detecting fraud and off-platform deals; resolving disputes; and meeting our legal obligations. We do not sell your information. We do use the Meta Pixel and Conversions API to measure our advertising and to build advertising audiences on Meta’s platforms, as described in the analytics section below.
Other users see only what the Disney reservation needs: guest names, dates and the agreement itself.
The companies that handle data for us, in full: Stripe (payments, payouts, identity checks), Supabase (database, login and file storage, including contract documents), Vercel (hosting), Resend (sends our emails), Upstash (rate limiting, sees IP addresses briefly), Google (analytics), Meta (advertising measurement) and Cloudflare Turnstile (bot protection at sign-up). Each may use your data only to provide its service to us.
We disclose information when the law requires it, or when needed to protect the safety and rights of our users.
How we protect it and how long we keep it
Data is encrypted in transit and at rest. Each account can only reach its own records. Sensitive pages are rate limited and protected against common web attacks, and every admin action goes into a log that cannot be edited.
We keep your records while your account is open. After you delete it, we keep only what tax, accounting or financial rules require, for up to 7 years. Signed agreements and audit logs are kept as records of the transaction. Stripe keeps identity data under its own retention policy.
Your rights
You can ask us to send you a copy of your data, correct it, delete your account and its data (except what the law requires us to keep), export it in a portable format, stop a particular use of it, or unsubscribe you from marketing email. Booking and payout emails continue while your account is open because they are part of the service. These rights apply wherever you live, including under California’s CCPA and the EU and UK GDPR.
Email hello@sleeparoundpoints.com for any of this, or any privacy question. We respond within 30 days.
Cookies, analytics and ads
Session and preference cookies keep you signed in and remember your settings; without them you cannot log in. For analytics we use Google Analytics 4 (page views, traffic sources and events like sign-ups; it sets cookies, and Google’s browser add-on opts you out), Vercel Analytics (page speed, no cookies, does not identify you) and Compass, our own tool, which records how our calculators are used with grouped signals that never leave our platform.
Our only advertising tool is Meta’s. The Meta Pixel and Conversions API tell us whether our ads lead to sign-ups by sending Meta limited event data, such as “a registration completed,” with a shared event ID so nothing is counted twice. You can switch this off for your browser with the toggle at the bottom of this page or in your Meta ad preferences. If your browser sends the Global Privacy Control signal, you are already opted out.
The rest
Children
The platform is for adults. We do not knowingly collect information from anyone under 18, and we delete it if we find we have.
Emails you send us
If you email hello@sleeparoundpoints.com, including forwarded DVC member letters such as enforcement notices, we may use it in our editorial work after removing names, membership numbers, reservation numbers and contact details. Say so in the email if you would rather we keep it confidential. We never sell or share what you send us.
Changes
For significant changes we email you at least 30 days before they take effect. Using the platform after a change means you accept it. The date at the top always shows the latest version.
Your privacy choices
We send limited event data to Meta to measure our advertising. Use the switch below to turn that off for this browser. We also honor the Global Privacy Control signal automatically. If your browser sends it, you are already opted out.