Your Data, Protected

Privacy Policy

We take your privacy seriously. Here's how we collect, use, and protect your information.

Last updated: April 18, 2026

Our Commitment

Four pillars of how we protect your privacy

Encrypted

All data encrypted in transit and at rest

PII Redacted

Phone numbers and emails auto-redacted in messages

Transparent

Clear about what we collect and why

Your Control

Access, correct, or delete your data anytime

Full Policy

Introduction

Sleep Around Points (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our marketplace platform at www.sleeparoundpoints.com.

Information We Collect

2.1 Information You Provide

●Account Information: First name, last name, email address, username, and password when you create an account
●Identity Verification: Government-issued ID image and short video selfie via Stripe Identity, required for all users (both owners and renters) before money changes hands. Stripe uses biometric technology to compare the selfie to the ID and confirm a match; Stripe retains this biometric data under Stripe’s Privacy Policy. Sleep Around Points receives only the verification result and the confirmed name; we never receive or store the raw ID, selfie, or biometric template. If you are a resident of Illinois (BIPA), Texas (CUBI), or another state with a biometric privacy statute, your submission of a verification constitutes your written consent to this collection and retention for the sole purpose of identity verification.
●DVC Contract Data: For owners: deed documents, contract numbers, resort details, and point allotments uploaded for admin verification
●Payment Information: Processed securely through Stripe. We never store full card numbers, CVVs, or bank account details on our servers
●Rental Agreements: E-signatures, guest names, agreement text, and SHA-256 content hashes generated during the booking process
●Messages: Communications sent through our in-platform messaging system (subject to automatic PII redaction)
●Bug Reports: Issue descriptions, page URLs, and device information submitted through our reporting tool

2.2 Information Collected Automatically

●Usage Data: Pages visited, features used, and actions taken on the Platform
●Device Information: Browser type, operating system, screen size, and IP address
●Cookies: Session cookies for authentication and site access preferences

How We Use Your Information

We use collected information to:

●Provide and maintain our marketplace services
●Process payments, payment holds, refunds, and owner payouts
●Verify the identity of all users and the DVC contracts of owners
●Generate and store legally binding rental agreements
●Send transactional emails (booking confirmations, deadline reminders, payout notices)
●Enforce platform rules including the 35% rental cap and rate limiting
●Detect and prevent fraud, abuse, and off-platform circumvention
●Resolve disputes between renters and owners
●Comply with legal obligations

Information Sharing

4.1 Between Users

When a booking is confirmed, limited information is shared between the renter and owner to facilitate the Disney reservation, primarily guest names. We protect sensitive information through pseudonymous display handles and automatic PII redaction in messages. Users are prohibited from sharing contact information to arrange off-platform transactions.

4.2 Service Providers

We work with trusted third-party providers to operate the Platform:

Stripe

Payments and renter-fund hold via Stripe Connect; identity and biometric verification via Stripe Identity; owner payouts to Connected Accounts. Subject to Stripe’s Privacy Policy.

Email Provider

Transactional email delivery (booking confirmations, etc.)

Database Provider

Secure data storage and authentication services

Hosting Provider

Application hosting, CDN, and edge computing

4.3 Legal Requirements

We may disclose information if required by law, court order, or government regulation, or to protect our rights, safety, and the safety of our users.

Data Protection

Security Measures

●Encryption in transit (TLS/SSL) and at rest
●Row-level security policies in our database, so users can only access their own data
●CSRF protection, HSTS, and Content Security Policy headers
●Rate limiting on all sensitive endpoints to prevent abuse
●Immutable audit logs for all administrative actions

PII Protection

Our platform automatically scans messages for personally identifiable information (phone numbers, email addresses, and social media handles) and redacts them before delivery. This prevents off-platform transactions and protects user privacy. Both parties are notified when redaction occurs.

Your Rights

You have the right to:

●Access: Request a copy of your personal data
●Correction: Update inaccurate information through your dashboard settings
●Deletion: Request deletion of your account and associated data
●Portability: Receive your data in a portable format
●Opt-out: Unsubscribe from marketing communications (transactional emails cannot be opted out of while your account is active)

These rights cover the principal obligations under the California Consumer Privacy Act (CCPA) and the European Union’s General Data Protection Regulation (GDPR). California residents and EU/EEA/UK residents may exercise them regardless of where Sleep Around Points is operated from.

To exercise these rights, contact us at privacy@sleeparoundpoints.com.

Data Retention

We retain your information for as long as your account is active and as needed to provide our services. Rental agreements, payment records, and audit logs are retained for legal compliance and dispute resolution.

After account deletion, we may retain certain data for legal compliance or fraud prevention for up to 7 years, as required by financial regulations. Identity verification data is handled according to Stripe’s retention policies.

Cookies and Analytics

We use cookies for:

●Essential: Authentication sessions and site access verification
●Functional: Remembering preferences and checkout state

We do not use third-party advertising or tracking cookies. You can manage cookie preferences through your browser settings, though disabling essential cookies will prevent you from logging in.

Analytics. Sleep Around Points uses two analytics services. (1) Google Analytics 4 measures page views, traffic sources, and conversion events (such as account signup or booking completion) using cookies and a Google-issued client identifier; data is subject to Google’s Privacy Policy. (2) Vercel Analytics, provided by our hosting platform, measures page views and performance without cookies and without personally identifiable information. We also collect first-party product analytics for interactive tools (for example, the DVC Commercial Use Meter) using only bucketed, non-identifying signals; see the Children’s Privacy and Your Rights sections for how to request deletion.

Email and newsletters. Transactional emails (booking confirmations, payout alerts, required legal notices) are sent while you have an active account. Any marketing or editorial newsletter we send is opt-in and includes an unsubscribe link in every message; unsubscribing does not affect transactional delivery.

Children’s Privacy

Our Platform is not intended for users under 18 years of age. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us immediately and we will delete it.

Changes to This Policy

We may update this Privacy Policy periodically. For significant changes, we will notify you at least 30 days in advance via email. Continued use after changes constitutes acceptance. The “Last updated” date at the top of this page indicates the most recent revision.

Editorial Correspondence

Emails sent to hello@sleeparoundpoints.com, including any submitted DVCM correspondence (such as enforcement letters), may be used for editorial content. We redact identifying information (names, membership numbers, reservation numbers, and contact details) before any publication. If you do not want your submission used editorially, state that in the email body and we will treat it as confidential. We do not sell or share submitted correspondence with third parties.

Contact Us

For privacy-related questions or concerns, contact us at privacy@sleeparoundpoints.com. We will respond within 30 days of receiving your request.

Questions About Privacy?

We're here to help. Reach out to our privacy team with any questions or concerns.

privacy@sleeparoundpoints.com