Privacy Policy

1. Who we are

2. What we collect

Booking details

Your name, email address, phone number, the cabin you want, arrival and departure dates, number of guests, whether you are bringing a dog, and any message you write to us. [Identifiers; commercial information]

Payment information

Stripe processes your card and returns to us a payment status, a payment reference, the amount, and the last four digits and brand of the card. We never receive your full card number, expiry or security code. [Financial information, in limited form]

Identity verification

Stripe Identity checks a government-issued ID and, where required, a selfie. We receive the verification outcome and limited verified details such as your name and that you are over 18. We do not receive or store the document images or the biometric template. [Sensitive personal information]

Stay records

Confirmed reservations, cancellations, refunds, damage or house-rule issues, and correspondence with you about a stay. [Commercial information]

Technical and usage data

IP address, browser and device type, pages requested, referring page, and timestamps, recorded by our hosting platform in ordinary server logs and used for security, abuse prevention and rate limiting. [Internet or network activity]

Account and membership records

If you create an account or join Chalet Bruin Circle: your email address, first name, sign-in method, membership status and billing period, a record of the terms you agreed to and when, your referral code, and the referrals and rewards linked to your account. Referred guests' email addresses are stored only as a one-way hash so we can prevent self-referral without keeping the address. [Identifiers; commercial information]

Support contributions

The amount, payment status, and any email address or first name you choose to give. We only show a first name on the site if you tick the box asking us to. [Commercial information]

Merch orders

The item, amount and payment status, the email address your receipt goes to, any short message you ask us to print on a card, and — for the two items we mail — the United States delivery name, address and phone number you enter at Stripe's checkout. We use a delivery address and phone number only to make and send that order, to let the carrier reach you, and to answer questions about it. For digital items we also keep a record of your download link (stored only as a one-way hash), when it expires and how many times it has been used, so we can re-issue it if you ask. [Identifiers; commercial information]

Cookies and similar technologies

Strictly necessary cookies and local storage that keep the site working and remember your cookie choice, plus cookies set by third-party embeds only after you allow them. See the cookies section below.

3. Where the information comes from

• Directly from you, when you fill in a booking request, email us, or complete payment and identity verification.
• Automatically from your device, through ordinary server logs and necessary cookies.
• From our service providers: Stripe (payment and verification results), our email delivery provider (whether a confirmation was delivered), and our channel and calendar partners.
• From Airbnb, VRBO or Guesty, if you booked one of the cabins through those platforms rather than directly with us. In that case those platforms decide what they pass to us, and their own privacy policies also apply.

4. Why we use it

To take and manage your booking

Checking availability, quoting a price, confirming or declining a request, sending your confirmation and check-in details, and handling changes, cancellations and refunds. Without this information we cannot provide the stay.

To take payment

Processing your card payment through Stripe and keeping the record of it.

To verify who is renting the cabin

We are handing over the keys to a private home. Identity verification protects the property, our neighbours and other guests, and helps prevent payment fraud and chargeback abuse.

To communicate with you

Answering questions, sending your confirmation, and — in that confirmation only — suggesting a small number of things to do nearby. We do not run a marketing list and we do not send unsolicited promotional email.

To keep the site secure

Rate limiting, abuse detection, protecting against fraudulent or automated booking attempts, and diagnosing errors.

To meet legal and tax obligations

Keeping records required by tax, lodging and accounting rules, and responding to lawful requests.

5. Who we share it with

6. Identity verification in detail

• The check is run by Stripe Identity. You upload your ID, and in some cases a selfie, directly to Stripe — the images do not pass through this website.
• Stripe compares the document to the selfie and to its own fraud signals, and returns a result to us.
• We store only the verification outcome, the Stripe verification reference, and limited verified attributes such as the matched name and the confirmation that you are 18 or over.
• We never receive, request, store or retain the ID image, the selfie image, or any biometric template or facial-geometry data derived from them. Stripe's retention of those items is governed by Stripe's own privacy policy.
• We use the result solely to decide whether to confirm a reservation and to prevent fraud. We do not use it for advertising, profiling, scoring, or any automated decision with legal effects beyond confirming or declining that booking — a person reviews declines.
• If you would rather not verify your identity, you can book either cabin through Airbnb or VRBO instead, where those platforms run their own checks.

7. How long we keep it

8. How we protect it

• The whole site is served over HTTPS, and booking data is encrypted in transit and at rest.
• Card data is handled entirely by Stripe, a PCI-DSS Level 1 service provider. Our systems never hold a full card number.
• Access to booking records is restricted to authenticated administrators, enforced at the database level as well as in the application.
• Booking forms are validated on the server, rate limited, and protected against cross-site request forgery.
• Credentials and API keys are held as encrypted environment secrets and are never written into the website's code or sent to your browser.

9. Your California privacy rights

• Right to know what personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to.
• Right to access a copy of that information, in a portable format where technically feasible.
• Right to delete the personal information we hold about you, except where we must keep it for tax, legal, security or fraud-prevention reasons.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of and we do not need a “Do Not Sell or Share My Personal Information” link. If that ever changes, we will add one and update this policy before it takes effect.
• Right to limit the use of sensitive personal information. We already use it only for the verification purpose described above, which is a permitted purpose, so no limitation is required.
• Right to non-discrimination. Exercising any of these rights will never affect your price, your booking, or the service you receive.

How to make a request

10. Your Washington privacy rights

• Consumer health data. The Washington My Health My Data Act protects health-related information. We do not collect, use, share or sell consumer health data, we do not infer health conditions from your booking, and we operate no geofence around any health facility. If you voluntarily tell us about a mobility need or an allergy so we can prepare the cabin, we use it only for that stay and delete it afterwards, and you can ask us to delete it sooner.
• Access, correction and deletion. Washington residents may make the same access, correction and deletion requests described in the California section, using the same email address, and we handle them the same way.
• No targeted advertising or profiling. We do not use your information for targeted advertising, profiling with significant effects, or any sale of personal data.

11. If you are outside the United States

12. Cookies and tracking

Strictly necessary storage

Keeps the site functioning, secures form submissions, and remembers the cookie choice you made. These cannot be switched off without breaking the site, and they do not track you across other websites.

Optional third-party embeds

The Bear Valley mountain cameras are YouTube players that set their own cookies. They stay blocked until you allow them, and they do not load at all if you decline.

13. Children

14. Changes to this policy

15. Contact us