Privacy Notice

Who is responsible for your data

Gray Barns Properties, 132 Dana Road, Woodstock, Vermont 05091, United States, is the controller of personal information described in this notice. For any privacy question or request, contact kat@graybarnsvt.com.

Information we collect

• Booking request details you submit voluntarily: name, email address, phone number, property, requested dates, number of guests, and any message or special requests you include.
• Guest and stay information exchanged by email or through a listing platform in order to arrange, confirm, and service a stay.
• Technical and usage data automatically generated when you visit the site: IP address, browser and device type, referring page, pages viewed, and approximate location derived from IP. Where analytics or non-essential cookies are used, this data is only collected with your consent.
• Communications you send us, including email correspondence and its contents.

We do not knowingly collect information from children under 16, and we do not collect special-category data (such as health or biometric data). Please do not include sensitive information in booking messages.

Why we use it, and our legal basis

• To respond to booking requests and manage your stay — performance of a contract, or steps taken at your request before entering one (GDPR Art. 6(1)(b)).
• To send booking confirmations and service emails — contract performance and our legitimate interest in operating the rental (Art. 6(1)(b), 6(1)(f)).
• To keep records for tax, occupancy tax, and accounting — compliance with legal obligations (Art. 6(1)(c)).
• To secure the site and prevent fraud or abuse — legitimate interests (Art. 6(1)(f)).
• Analytics, review widgets, and other non-essential tracking — your consent, which you may withdraw at any time (Art. 6(1)(a)).

We do not sell your personal information, and we do not share it for cross-context behavioral advertising or targeted advertising.

Service providers and third parties

We use a small number of vetted providers who process data on our behalf under contract (including GDPR Art. 28 data processing terms and, where relevant, EU Standard Contractual Clauses for transfers outside the EEA/UK):

• Website hosting and database (Lovable / Supabase) — hosts the site and securely stores booking request submissions.
• Transactional email delivery — sends your booking confirmation and notifies our team.
• Trustindex — displays verified guest reviews collected from Airbnb, VRBO, and Google. The widget loads from Trustindex's servers and may set cookies or local storage; it is loaded subject to your cookie choices.
• Open-Meteo — supplies local Woodstock weather. Requests are made from your browser and include your IP address; no account or identifier is involved.
• Adobe Fonts (Typekit) — serves our display typefaces. Our body typeface is self-hosted on this site, and the Adobe request is made only if you allow functional cookies, so no font provider sees your IP address without your consent.
• Airbnb and VRBO — we import read-only availability calendars (iCal) from these platforms to show accurate availability. No personal data of yours is sent to them by our site. If you book through a platform instead of our form, that platform's own privacy policy governs the data you give it.
• Map and directions embeds — clicking a map link takes you to the provider's own site, governed by their privacy policy.

We may also disclose information where required by law, to enforce our terms, or to protect the rights and safety of guests, neighbors, and property.

International transfers

We are based in the United States, and our providers may process data in the US and elsewhere. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses together with supplementary technical and organizational measures. You may request more detail about these safeguards at kat@graybarnsvt.com.

How long we keep information

• Booking requests that do not become a stay: up to 24 months, then deleted.
• Completed stays and related correspondence: up to 7 years, to satisfy tax, occupancy tax, and accounting obligations.
• Server and security logs: typically 30–90 days.
• Consent records: for as long as needed to demonstrate compliance.

How we protect information

The site is served over HTTPS. Booking submissions are stored in an access-controlled database protected by row-level security, and only Kat Gray and our website manager can access them. We limit access on a need-to-know basis and review our providers' security practices. No system is perfectly secure, so please avoid sending payment card numbers or government ID numbers by email.

Your rights

Depending on where you live, you may have the right to access a copy of your personal information, correct it, delete it, restrict or object to certain processing, withdraw consent, receive your data in a portable format, and be free from discrimination for exercising these rights. Residents of California, Colorado, Connecticut, Virginia, and other US states with comprehensive privacy laws have equivalent rights, including the right to opt out of sale or targeted advertising — which we do not engage in.

To exercise any right, email kat@graybarnsvt.com. We will verify your request and respond within 30 days (extendable where permitted). You may use an authorized agent. If you are in the EEA or UK and are unsatisfied with our response, you may lodge a complaint with your local data protection authority.

You can also manage cookie consent and submit an opt-out request from our Do Not Sell or Share My Personal Information page.

Consent records

When you make a cookie choice we store a record of it so we can demonstrate consent under Article 7(1) GDPR: the categories you chose, the timestamp, the page, the notice version, your browser user agent, and a salted one-way hash of your IP address. We never store the raw IP address, and these records are used only as proof of consent. They are deleted after 24 months. When you submit the booking form we also record that you ticked the privacy and rental-terms box, together with the moment and the wording version.

Data retention

Booking request submissions are kept for up to 24 months so we can answer follow-up questions and honour repeat-guest requests, then deleted. Records we must keep for Vermont tax and accounting purposes are retained for seven years. Consent records are kept for 24 months. You can ask us to delete your data sooner at any time.

Automated decisions and profiling

We do not make decisions about you solely by automated means. Our booking form calculates a price estimate from rates, discounts, fees, and taxes, but all booking decisions are made by a person.

Changes to this notice

We will update this notice when our practices change and revise the "last updated" date above. Material changes affecting your rights will be highlighted on this page.