Privacy Policy

This Privacy Policy explains how Sustainable Life Investments, LLC, a Florida limited liability company ("SLI", "we", "us", or "our"), collects, uses, discloses, protects, retains, and deletes personal information. It applies to both of our websites and to every guest-facing service we operate. ParkPillow is a registered fictitious name (d/b/a) of Sustainable Life Investments, LLC.

1. Our Core Commitment

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not run advertising or ad-retargeting pixels on our websites. We have never done so. "Sell" and "share" are used here as those terms are defined by the California Consumer Privacy Act as amended by the CPRA and by comparable state privacy statutes. If we ever change this practice, we will update this page, change the "Last updated" date, and give you a clear and functional opt-out before the change takes effect.

2. Who We Are and How to Reach Us

Sustainable Life Investments, LLC — which operates the ParkPillow brand under its registered fictitious name (d/b/a) — is the controller of the personal information described here. For any privacy question, request, or complaint:

• Guest and booking matters: hello@parkpillow.com
• Corporate and all other matters: hello@sustainablelifeinvestments.com

3. Information We Collect

We collect only what we need to operate, and we collect it directly from you unless noted.

• Contact and inquiry data. Name, email address, phone number if you provide one, and the contents of your message.
• Reservation data. Reservation code, booking channel (Airbnb, Vrbo, Booking.com, direct), unit booked, check-in and check-out dates, number of guests, nightly rate and payout data where the channel provides it. Some of this arrives from the booking platform or from a calendar feed rather than from you.
• E-check-in data. Guest name, date of birth, emergency contact phone number, an image of a government-issued photo ID (not requested on Airbnb-channel check-ins), your electronic signature on our rental agreement, the version of the agreement you accepted, whether you asked us to email you a copy, and session metadata such as IP address, timestamp, and browser user-agent.
• Guest account data. If you create an account, your email address, a securely hashed password managed by our authentication provider, and links to your past and upcoming stays.
• Rewards data (opt-in only). Email address, phone number, your unique referral code, referral relationships, and a ledger of credits earned, redeemed, and expired.
• Messaging data. The content and metadata of email threads between you and our host team, including inbound replies routed to reply@mail.parkpillow.com.
• Website usage data. Pages visited, referrer, coarse location inferred from IP address, and error diagnostics captured by our hosting platform.

We do not knowingly collect Social Security numbers, financial account numbers, precise geolocation, health data, or information about your race, religion, political opinions, union membership, sexual orientation, or immigration status.

4. Government ID Images and Biometric Data

Where a booking channel requires identity verification, we ask for a photograph of a government-issued ID. We want to be precise about what happens to it:

• We do not perform facial recognition or facial-geometry matching. We do not create, capture, store, or use a biometric identifier or biometric template as those terms are defined by the Illinois Biometric Information Privacy Act (740 ILCS 14/) or the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001). We store an image and, in some cases, text read from it.
• The image is stored in a private, access-controlled bucket. It is never publicly linkable and can be viewed only by an authorized SLI administrator with a logged, legitimate reason.
• EXIF, GPS, and XMP metadata are stripped from uploaded images before storage, so location data embedded in your photo is not retained.
• Retention: we delete ID images no later than twelve (12) months after checkout, and sooner on request, unless a specific legal hold, insurance claim, chargeback, or law-enforcement request requires us to keep a copy longer.
• Airbnb-channel check-in forms do not request a government ID at all.

5. How We Use Your Information

• Confirming identity and eligibility to check in, and preventing fraud and party bookings.
• Fulfilling, servicing, and communicating about your reservation, including emergencies.
• Meeting Florida short-term rental, tourist development tax, sales tax, and guest-register obligations, including those under Chapter 509, Florida Statutes.
• Operating BnB Rewards!™: attributing stays, calculating and posting credits, verifying referrals, preventing duplicate or fraudulent claims, and sending you a secure magic link to view your balance.
• Emailing you a copy of the rental agreement you accepted, when you ask us to.
• Responding to inquiries, resolving disputes, and improving our websites.
• Establishing, exercising, or defending legal claims.

We do not use your personal information for advertising, and we do not build behavioral profiles about you.

6. Marketing Email and Text Messages

Transactional messages — booking confirmations, check-in links, access instructions, and replies to your own messages — are part of the service and are sent regardless of marketing preferences.

Marketing email complies with the CAN-SPAM Act: it identifies us, includes our physical postal address, and carries a working unsubscribe link that we honor promptly. We will not send you marketing text messages unless you have given prior express written consent through a separate, clearly labeled opt-in, consistent with the Florida Telephone Solicitation Act, section 501.059, Florida Statutes. Reply STOP to any text to opt out immediately.

7. Who Can See Your Information Inside SLI

Only authorized SLI administrators can view sensitive guest fields (government ID, date of birth, emergency phone, email address), and only when there is a legitimate reason. Those reasons are limited to:

• Confirming a guest's identity for a reservation or check-in issue.
• Verifying a rewards credit, redemption, or referral.
• Responding to an emergency at a property, a safety concern, or a valid law-enforcement, tax, or regulatory request.
• Investigating suspected fraud, abuse, or a violation of the rental agreement.

Every administrative access to a sensitive field is written to an internal audit trail with the administrator's identity and a timestamp. Staff who do not need access do not have it, and access is enforced in the database itself through row-level security, not only in the application.

8. How We Protect Your Information

• Date of birth, emergency phone, and email address are encrypted at rest using AES-256-GCM with keys we control.
• Government ID images live in a private bucket with no public URLs.
• All traffic between your browser and our services uses TLS.
• Row-level security policies restrict every table; administrative roles are held in a dedicated roles table and checked server-side.
• Input is validated and sanitized on the server, not only in the browser.
• Administrative access to sensitive data is logged and reviewable.

No system is perfectly secure, and we do not promise that ours is. If a breach affecting your personal information occurs, we will notify you and the applicable authorities as required by Florida's data-breach statute, section 501.171, Florida Statutes, and any other law that applies to you.

9. Service Providers (Sub-Processors)

These providers process data only on our behalf, under contract, and may not use it for their own purposes:

• Supabase — database, authentication, and private file storage.
• Cloudflare and Lovable — hosting, edge runtime, and error diagnostics.
• Resend — transactional and guest-thread email from mail.parkpillow.com.
• Google (Gemini via Lovable AI) — optical character recognition on reservation screenshots and optional review translation. Content is processed to produce a result and is not used by us to train models.
• Telegram — internal operational alerts to our host team. We do not send government ID images to Telegram.
• Booking channels (Airbnb, Vrbo, Booking.com) — independent controllers that pass reservation details to us.

10. Data Retention

• Government ID images: up to 12 months after checkout (see Section 4).
• Reservation and check-in records: retained while needed for tax, guest-register, insurance, and dispute purposes, generally several years after the stay.
• Rewards records: retained while your membership is active and for a reasonable period after, and in summary form where needed to prevent duplicate claims.
• Messaging threads: retained while the guest relationship is active and for dispute resolution.
• Website logs and diagnostics: short-term, per our hosting provider's defaults.

11. Your Rights and How to Exercise Them

The Florida Digital Bill of Rights applies only to controllers with more than one billion dollars in global annual revenue, and most other state privacy statutes apply only above volume thresholds we do not meet. Rather than hide behind that, we extend the following rights to every guest, regardless of where you live:

• Know what personal information we hold about you and get a copy.
• Correct inaccurate information.
• Delete your information, subject to the legal-retention limits in Section 10 and Section 12.
• Withdraw consent and leave the rewards program at any time.
• Receive confirmation that we do not sell or share your information for advertising.
• Complain to a data-protection authority where you live.

Email hello@parkpillow.com or use the deletion request tool in your guest account. We verify your identity before acting. Verified deletion requests enter a seven-day grace period — a deliberate protection against a mistaken or coerced request — after which we scrub your profile, messages, inquiries, and ID images and revoke your access tokens. We respond to requests within 30 days and will never discriminate against you for exercising a right.

12. What We Cannot Delete

Some records must survive a deletion request. We keep the minimum necessary: transaction and tax records required by Florida law, the guest register required for licensed transient lodging under Chapter 509, records subject to a legal hold or an open insurance, chargeback, or law-enforcement matter, and a minimal suppression record so that a deleted address is not re-contacted. Where a record must be kept, we anonymize the parts that are not legally required.

13. Children

Our services are for adults. Only a guest aged 18 or older may book, complete e-check-in, or join BnB Rewards!™. We do not knowingly collect personal information from anyone under 18, and we do not sell or share the personal information of anyone under 16. If you believe a minor has given us information, email us and we will delete it.

14. Cookies and Analytics

We use a small number of strictly necessary cookies to keep you signed in and to keep forms secure, plus minimal first-party analytics to understand how visitors use the site. We do not use advertising cookies, third-party ad pixels, or cross-site trackers. You can control cookies in your browser; blocking strictly necessary cookies will break sign-in.

15. International Transfers

We are a Florida business and our data is processed primarily in the United States. Some providers may process data in other countries; where personal data is transferred internationally, we rely on the safeguards those providers offer, including standard contractual clauses where applicable. If you are in the EEA or UK, our lawful bases are performance of a contract (your stay), legal obligation (lodging, tax, and safety records), legitimate interests (fraud prevention, security, service improvement), and consent (rewards and marketing).

16. Rewards Program

BnB Rewards!™ by SLI is opt-in. We use your information to attribute stays and referrals, calculate credits, prevent duplicate or fraudulent claims, and send you a secure magic link to view your balance. We do not sell member data or share it for marketing outside SLI. Full earning, redemption, expiration, referral, and anti-abuse rules are in the Rewards Program Terms.

17. Changes to This Policy

We may update this policy. Material changes are posted here with a new "Last updated" date, and where the change materially reduces your rights we will give notice before it takes effect. Continued use after an update means you accept the revised policy.

18. Contact

Sustainable Life Investments, LLC — questions, requests, or complaints: hello@parkpillow.com or hello@sustainablelifeinvestments.com. See also our Terms of Service and the Short-Term Rental Agreement.