Privacy Policy

Effective Date: October 21, 2026

LawfulStay™ ("LawfulStay," "we," "us," or "our") is operated by LawfulStay LLC, a Colorado limited liability company. This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our website at lawfulstay.com (the "Site") and our related services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with our practices, please do not use the Service.

1. Information We Collect

Information You Provide Directly

• Account information: When you create an account, we collect your email address. You may also provide your name and professional role (e.g., property manager, investor, real estate agent).
• Payment information: When you purchase a subscription or report, your payment card details are collected and processed directly by Stripe, our third-party payment processor. We do not store your full credit card number on our servers. We receive a tokenized record of the transaction, the last four digits of your card, and billing details (name and address) from Stripe.
• Communications: If you contact us by email or through the Site, we collect the content of your messages and any information you choose to provide.
• Jurisdiction requests: If you request tracking for a specific jurisdiction or submit a regulation correction, we collect the details of that request.

Information Collected Automatically

• Usage data: We collect information about how you interact with the Service, including pages viewed, search queries, jurisdictions browsed, and features used. If you accept analytics cookies, this includes clicks, scrolling, and recordings of your visit (see TruConversion under Third-Party Services).
• Device and browser information: We collect your IP address, browser type and version, operating system, device type, and screen resolution.
• Geolocation data: If you use our "Track your location" feature, we request access to your device's geolocation with your permission. This data is used solely to identify your nearest tracked jurisdiction and is not stored on our servers.
• Referral information: We collect information about how you arrived at the Site, including referring URLs and search terms.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: To provide, maintain, and improve the Service, including delivering regulatory data, generating reports, and processing payments.
• Account management: To create and manage your account, authenticate your identity, and provide customer support.
• Regulatory alerts: To send you email notifications about regulatory changes in jurisdictions you track, including council agenda alerts, zoning updates, and permit requirement changes.
• Transactional communications: To send you account-related messages such as purchase confirmations, billing reminders, and security notices.
• Product updates: To inform you about new features, service changes, and other announcements related to the Service. You can opt out of non-essential communications at any time.
• Analytics and improvement: To understand how the Service is used, identify trends, and improve performance and user experience.
• Legal compliance: To comply with applicable laws, regulations, or legal processes, and to protect our rights and the rights of others.

3. Third-Party Services

We use the following third-party services to operate the Service. Each has its own privacy policy governing its handling of your data:

• Stripe (stripe.com/privacy) — Processes all payment transactions. When you make a purchase, your payment card information is transmitted directly to Stripe and is subject to Stripe's privacy policy and PCI-DSS compliance standards. We never see or store your full card number.
• Brevo (Sendinblue) (brevo.com/legal/privacypolicy) — Sends transactional and regulatory alert emails on our behalf. We share your email address and name with Brevo solely for the purpose of delivering emails you have requested or that are necessary for the Service.
• DigitalOcean (digitalocean.com/legal/privacy-policy) — Hosts the Service infrastructure. Your data is stored on DigitalOcean's servers in the United States.
• OpenStreetMap / Nominatim — Used for geocoding when you search by address. Your search query (city, county, or address) may be sent to the Nominatim geocoding service. No personally identifiable information is transmitted.
• TruConversion (truconversion.com/privacy-policy) — Website analytics, used only if you click Accept on our cookie banner. It records clicks, scrolling, mouse movement, and page visits, including session recordings, so we can see where the Site is confusing and improve it. Text typed into form fields is masked, and it does not run on sign-in, registration, or account pages. Card details are entered on Stripe's systems and are never visible to it.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

4. Cookies and Local Storage

The Service uses the following browser storage mechanisms:

• Authentication session data: We store your login state and account information in your browser's local storage to keep you signed in between visits. This is essential for the Service to function.
• Service worker: We use a service worker to cache static assets (HTML, CSS, JavaScript, images) for faster page loads and limited offline access. The service worker does not track your activity or collect personal information.
• User preferences: We store your selected jurisdictions, display preferences, and subscription tier in local storage to personalize your experience.

Analytics cookies (optional): If you click Accept on our cookie banner, TruConversion sets cookies to recognize your browser across pages and visits and to record how you use the Site. If you click Decline, or make no choice, it does not load. To change your choice, clear this site's data in your browser settings; the banner will appear again on your next visit.

We do not use advertising cookies or tracking pixels. We do not participate in ad networks or cross-site tracking programs.

You can clear local storage and cookies through your browser settings at any time. Doing so will sign you out and reset your preferences.

5. Data Retention and Deletion

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained until you request deletion of your account.
• Payment records: Transaction records are retained for up to 7 years as required for tax and accounting purposes.
• Usage data: Aggregated usage data that cannot identify you individually may be retained indefinitely for analytics.
• Email communications: Records of regulatory alerts and transactional emails are retained for up to 2 years.

To request deletion of your account and personal data, email us at ericmason.co@gmail.com. We will process your request within 30 days, subject to any legal retention requirements.

6. Data Security

We implement reasonable technical and organizational measures to protect your personal information, including:

• HTTPS encryption for all data transmitted between your browser and our servers.
• Payment data processed exclusively through Stripe's PCI-DSS certified infrastructure.
• Access controls limiting who can access user data on our systems.
• Regular backups of critical data.

No method of transmission over the internet is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

7. Your Rights Under GDPR (EEA/UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR):

• Right to access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request that we correct inaccurate or incomplete personal data.
• Right to erasure: You may request that we delete your personal data, subject to legal retention requirements.
• Right to restriction: You may request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability: You may request a machine-readable copy of the personal data you have provided to us.
• Right to object: You may object to the processing of your personal data for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time.

Our legal basis for processing your personal data includes: performance of a contract (providing the Service you have subscribed to), legitimate interest (improving the Service and communicating with you), and consent (where you have opted in to receive marketing communications or enabled geolocation).

To exercise any of these rights, contact us at ericmason.co@gmail.com. We will respond within 30 days.

8. Your Rights Under US State Privacy Laws

If you are a resident of California, Colorado, Connecticut, Virginia, or another US state with comprehensive privacy legislation, you may have the following rights:

• Right to know: You may request information about the categories and specific pieces of personal information we have collected about you.
• Right to delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to opt out of sale: We do not sell your personal information. There is no personal information sale to opt out of.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a request, email ericmason.co@gmail.com. We may need to verify your identity before fulfilling your request.

9. Children's Privacy

The Service is not directed at children under the age of 13 (or under the age of 16 in the EEA). We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under the applicable age, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at ericmason.co@gmail.com.

10. International Data Transfers

The Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We take steps to ensure that your data receives an adequate level of protection in the jurisdictions in which we process it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on this page with a revised effective date. If the changes are significant, we will also notify you by email. Your continued use of the Service after the effective date of the updated policy constitutes your acceptance of the changes.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: ericmason.co@gmail.com
• General inquiries: updates@lawfulstay.com

We will respond to all privacy-related inquiries within 30 days.