TeoStays — Privacy Policy
Effective date: September 19, 2026 Last updated: September 19, 2026
Applies to: teostays.com (our marketing site) and app.teostays.com (our application), together the “Services.”
1. Who we are
TeoStays is operated by TEOSTAYS LLC, a New Mexico limited liability company (“TeoStays,” “we,” “us,” “our“). The TeoStays name and marks are used under license from TEOSTAYS IP LLC. TEOSTAYS LLC is responsible for the personal information described here.
TeoStays is a directory and search platform for work enabled stays. Guests search, we show results ranked by fit, and we hand off — guests book directly with hosts on the hosts’ own sites. We are not a booking service, broker, or agent, we do not process payments for stays, and we are not a party to any agreement between a guest and a host.
That limits what we hold: no stay payment details, no reservation records, no booking history.
2. The short version
We built TeoStays to collect as little as possible, and we’ve verified it rather than assumed it.
- We don’t track you. No analytics, no advertising pixels, no third-party scripts of any kind on either property. Both were scanned page by page to confirm this.
- We don’t sell or share your personal information, including for cross-context behavioral advertising as California defines it.
- Almost no cookies. Visiting our marketing site sets one, from our security provider. Using the application sets two, both essential.
- We collect what your request needs. For guests, the stay you’re looking for. For hosts, your listing and annual listing details.
- Guests don’t need an account. You can submit a request without one.
- We don’t share guests’ and hosts’ personal information with each other. If that ever changed, Section 6.1 sets out what we’d do first.
This summary aids readability; the sections below control.
3. What we collect
3.1 Guests — when you submit a stay request
- Email address — the only contact detail we require
- City or market you’re looking in. If your city isn’t on our list you can type it in, and we keep what you typed along with your email address so we know where to expand
- Dates or date range, if you provide them
- Budget range — minimum and maximum, whether you want to see stays slightly above your maximum, and whether you’d prefer lower-priced options when results score similarly
- Amenity preferences — which work enabled amenities you mark as required versus preferred
- Request and results records — the request, the results generated for it, and whether and when we emailed you about them
- Results link records — when we email you a link to your results we store a one-way hash of the link token alongside your email address, plus its expiry and whether it’s been used. The link itself is never stored.
- Account information, only if you create an account — an email address for passwordless sign-in. Optional; requests work without one.
3.2 Hosts — when you list a property
- Name, email, and phone (phone if provided)
- Property details — name, market, description, bedrooms/bathrooms/sleeps, price range, and the URL of your own booking site
- Amenity declarations and provenance — the work enabled amenities you declare, with a record that you declared them and when
- Property notes — a free-text field for things guests should know (parking, HOA restrictions, stairs, quiet hours). These are for our internal review and are not shown to guests
- Annual listing and billing identifiers — status, renewal dates, and the customer and subscription identifiers assigned by Stripe
- Account credentials — an email address for passwordless sign-in
We don’t collect your address or your card details. Both are entered on Stripe’s hosted checkout page and stay with Stripe. We keep no copy.
3.3 Contact form on our marketing site
If you use the Questions/Comments form on teostays.com, we collect your name, email address, and message, plus the date, time, and page URL of the submission. This is delivered to our support mailbox by email.
We do not capture your IP address or browser details through this form. Those fields are available in the form software and are deliberately switched off.
3.4 Collected automatically
- Server and request logs. Our hosting and security providers record standard technical data when you visit — IP address, browser and device type, pages requested, referring page, timestamps — for operating, securing, and debugging the Services. Our own application code does not capture your IP address.
- Product interaction events. In the application we record a small number of interaction events — changing an amenity between none, preferred, and required, and applying your selections. These record which amenity and which state, nothing more. They contain no email address, no IP address, and no device information, and they are not linked to your request. They stay in our own database and go to no third-party analytics service.
3.5 What we don’t collect
No government ID numbers, no financial account numbers, no precise geolocation, no biometric data, no health information, and no special or sensitive categories of personal information. We don’t buy personal information from data brokers and we don’t build advertising or interest profiles.
The guest request form has no free-text box beyond your email address and, if your city isn’t listed, the city name you type. Dates are pickers, budget is numeric, amenities are tiles. There is nowhere to write something we didn’t ask for.
Comments are disabled on our articles, so we collect no comment data, commenter IP addresses, or comment cookies. Visitors cannot upload files to our site.
4. How we use personal information
- Generate results — apply required amenities, compare your budget range against host acceptance ranges, and rank by fit with what you asked for
- Deliver results, and notify you when new qualifying listings appear later
- Operate host listings — process the annual listing fee through Stripe, keep listings active or paused by payment status, send renewal notices
- Review and curate listings against our work enabled standard before they can appear in results
- Send service email — request confirmations, results notifications, sign-in links, annual listing messages
- Answer your questions submitted through our contact form
- Secure and improve the Services — prevent abuse, debug, and understand product usage from our own first-party data only
- Comply with law and enforce our terms
We do not use personal information for advertising, and we make no automated decisions producing legal or similarly significant effects.
5. Cookies and similar technologies
On our marketing site (teostays.com), one cookie is set:
| Cookie | Set by | Purpose |
|---|---|---|
__cf_bm |
Cloudflare | Distinguishes human visitors from automated traffic. Security/bot management. |
In our application (app.teostays.com), two cookies are set, both essential:
| Cookie | Purpose | Lifetime |
|---|---|---|
sb-<project>-auth-token |
Keeps you signed in after you use a sign-in link. Set by our authentication provider; may be split across numbered cookies when the session token is large. | Up to 400 days |
ts_match_link_origin |
Records that you arrived via a results link, so we can apply the right checks to that session. | Up to 400 days |
Both are essential, both are httpOnly (not readable by scripts), and both are restricted to our own site.
We use no advertising cookies, no analytics cookies, no tracking pixels, no session replay, no fingerprinting, and no localStorage or sessionStorage. Because every cookie above is strictly necessary, no consent banner is required and there is nothing to opt out of.
Tokenized results links. Results emails contain a single-use, short-lived link to your results. The token identifies your request, is view-only, expires, and works once. Expired links can be reissued.
Third-party content. Neither property loads scripts, fonts, iframes, images, or other resources from third parties. Links to our social media profiles are ordinary links — nothing loads from those platforms unless you click through, at which point their own privacy policies apply.
6. How we share personal information
6.1 Between guests and hosts
Today we do not share guests’ and hosts’ personal information with each other. Your results link to each host’s own website; hosts don’t receive your details, and you don’t receive theirs.
If that ever changes, here’s what we commit to. The service could one day involve sharing a guest’s request details — criteria, budget range, dates — with hosts in the guest’s results so they can evaluate the request. A host’s contact information would be released to a guest only with that host’s consent, given at the time and revocable. Each party would control the release of their own information.
We will not begin any such sharing unless and until we have first (a) updated the Privacy Policy, the Guest Terms, and the Host Agreement; (b) provided advance notice; and (c) obtained consent where required by law. Nothing changes silently.
6.2 Service providers
| Provider | Role | What it receives |
|---|---|---|
| Supabase | Application database and authentication | The broadest set: guest requests and results, host and listing records, interaction events, sign-in identifiers |
| Vercel | Hosts and serves app.teostays.com |
Standard server and request log data |
| Kinsta | Hosts and serves teostays.com |
Standard server and request log data |
| Cloudflare | Security and content delivery in front of teostays.com |
Visitor IP addresses and request metadata; sets the __cf_bm cookie |
| Stripe | Host annual listing payments | Host name, email, and billing address, entered directly on Stripe’s hosted checkout, plus payment records. Card details never reach our servers, and we hold no copy of the address. |
| Resend | Sends our outgoing email for both properties | Recipient addresses and message contents, including tokenized results links and contact-form submissions |
| Titan | Our email mailboxes | Messages sent to and from our @teostays.com addresses, including contact-form submissions and any correspondence with us |
Sign-in link emails are sent through Supabase‘s email service rather than Resend.
One thing worth stating plainly: when something goes wrong in our application, the error is written to our hosting provider’s logs. Those log entries can include the data being processed at the time — for example, the contents of a request that failed to save. We don’t do this deliberately, and the logs are retained on our provider’s schedule rather than kept by us.
6.3 Other disclosures
We may disclose personal information to comply with law or valid legal process; to enforce our terms; to protect the rights, safety, or property of TeoStays, our users, or others; and in connection with a merger, acquisition, financing, or asset sale, with notice as described in Section 12.
6.4 We do not sell or share your personal information
We do not sell personal information and do not share it for cross-context behavioral advertising, as California defines those terms. We have not done so in the preceding twelve months. We disclose nothing to data brokers or advertising networks.
7. Retention and deletion
We keep personal information only as long as we need it for the purposes described in this policy, after which we delete or de-identify it.
How long that is depends on what the information is and why we hold it:
- Guest requests and results records — while your request is active, and for a reasonable period afterward so we can answer questions about results you received
- Host records — for the duration of your annual listing, and afterward as needed for tax, accounting, and dispute purposes
- Contact form messages — for as long as needed to answer your question and keep a record of the exchange
- Interaction events — for a limited period, to understand product usage
- Email delivery records and server logs — according to our providers’ own retention schedules
Asking us to delete your information. Email support@teostays.com from the address associated with your request or listing and we will delete it, unless we’re required to keep something by law. We’ll confirm when it’s done. Some records held by our providers — email delivery logs, payment records at Stripe — are subject to their own retention schedules and legal requirements, and we’ll tell you what that means in your case.
8. Security
We protect personal information with measures appropriate to its sensitivity:
- Encryption in transit across both properties, with HTTP Strict Transport Security enforced
- Security response headers on both the application and the marketing site, including a content security policy, clickjacking protection, and MIME-type protection
- Row-level access controls in our database, so each account can only reach its own records
- Authenticated email — our outgoing mail is cryptographically signed (DKIM) and SPF-authorized, so recipients can verify it genuinely came from us
- Payment isolation — card data is handled entirely by Stripe and never reaches our systems
- Results links that are single-use, view-only, short-lived, and stored only as a one-way hash
No system is perfectly secure and we cannot guarantee absolute security.
9. Your choices and rights
Wherever you live, you can:
- Access or correct the information we hold about you
- Delete your request, listing, or account
- Stop non-essential email — every results notification includes an unsubscribe link, and you can ask us to stop at any time. Essential service messages (annual listing, security) may continue while your account is active.
Email support@teostays.com. We verify identity by confirming control of the email address associated with your information, and respond within the time the law requires.
9.1 State privacy rights
Some US states give residents additional rights over their personal information. If you live in one and believe you have rights we haven’t described here, contact us at support@teostays.com and we’ll respond.
The rights above are offered to everyone who uses TeoStays, regardless of where you live.
10. Children
The Services are for adults. We don’t knowingly collect personal information from anyone under 18, and will delete it if we learn we have.
11. Visitors outside the United States
TeoStays is operated from the United States and intended for users in the United States. If you access the Services from elsewhere, your information is transferred to, stored in, and processed in the United States, where privacy laws may differ from those where you live.
12. Changes to this policy
If we make material changes we’ll update the date above and notify you — by email or in the Services — before they take effect. Continuing to use the Services after that means you accept the updated policy.
For the change described in Section 6.1, we will give notice and obtain consent where required before any sharing begins.
13. Contact us
TEOSTAYS LLC 500 4th St NW, Ste 102, PMB 2477 Albuquerque, NM 87102 United States
Email: support@teostays.com