Privacy Policy

This website is operated by the private owner of The Bayside Escape at 2144 Hoopersville Road, Fishing Creek, MD 21634, Fishing Creek, Maryland. For the purpose of data-protection law, the property owner is the data controller for the information this policy covers. You can reach the controller at info@thebaysideescape.com.

If your booking was placed through Evolve Vacation Rental Network, Airbnb, Vrbo, or another third-party platform, that platform is the primary controller for the data you submitted there. Their privacy policies apply alongside this one.

2.1 Information you give us directly. When you submit an inquiry, book a stay, message the AI concierge, sign up for Bayside Rewards, or apply to the affiliate program, you may provide:

• Name, email address, phone number, mailing address.
• Check-in / check-out dates, party size, pet information, trip preferences and accessibility needs.
• Payment-method details (entered into Stripe's secure card iframe — we never see or store your card number; see Section 4 for what is saved).
• Free-text messages sent to inquiry forms or the AI concierge chat (including any personal details you choose to share).
• For affiliates: social handles, audience size, payout method (Zelle, Cash App, or mailing address for paper checks).

2.2 Information collected automatically. When you visit the site we automatically receive:

• IP address and approximate geographic location (city/region level — never a precise address).
• Browser type, operating system, screen size, language, and referring URL.
• Pages visited, time on page, click and scroll behavior, and outbound link clicks.
• A random browser ID that this site keeps in your browser's local storage. It lets us see which pages the same browser viewed, including on earlier visits. Section 8 explains it, and lists every cookie and local-storage entry the site uses.
• Through the Meta Pixel, Meta receives the pages you view and the steps you take on this site, and contact details you type into its forms, in hashed form. Section 8 says exactly what it sends.

We use the information described above only for the following purposes:

• Processing your booking request — reviewing the request, contacting you, charging the deposit or the full amount on approval, and, on the deposit plan, charging the balance three days before check-in.
• Following up on your inquiry — the owner calls or texts you at the number you gave, in his business hours, and we email you about your dates.
• Guest communications — booking confirmations, arrival instructions, check-in / check-out reminders, and post-stay follow-up.
• Supporting your stay — answering inquiries through the AI concierge or by direct email; passing relevant information to the owner or authorized service providers (e.g., cleaners) as needed for your trip.
• Understanding how the site is used — counting visits and page views, and looking at the pages one browser viewed and where it came from, to find what is confusing or broken and which pages and links bring people here. This uses the browser ID described in Section 8. We do not store that ID with your name, email address, phone number or booking.
• Advertising — measuring which of our Facebook and Instagram ads lead to inquiries and bookings, and showing our ads to people who have visited this site, through the Meta Pixel and Meta's Conversions API (Sections 5 and 8).
• Fraud and abuse prevention — rate-limiting form submissions, blocking suspicious payment patterns, and protecting the owner from chargeback fraud.
• Affiliate program operation — tracking referral clicks tied to an affiliate's code, attributing resulting bookings, and calculating commissions.
• Legal compliance — responding to lawful requests, enforcing the rental agreement, and meeting tax-reporting obligations (e.g., IRS Form 1099 for affiliates over $600/year).

We do not sell your personal information to third parties. We do not use your information to send unsolicited commercial marketing without your explicit opt-in.

All card data is captured directly in Stripe's PCI-DSS-compliant payment fields and tokenized at Stripe — we (the owner) never receive or store raw card numbers, expiration dates, or CVCs.

When you submit a booking request, Stripe creates a Customer record under our account and saves a tokenized payment method (a reference such as pm_…) on that record. This token allows us to charge the deposit when the owner approves your request and to charge the remaining balance three days before check-in, both off-session per your agreement at checkout.

If the owner turns down your request, the token is detached from your customer record at Stripe at that point, so it can never be charged again. Otherwise it stays saved, to support refunds, chargeback evidence and your future bookings, and nothing removes it automatically.

You can ask us at any time to detach your saved card, by emailing the address in Section 15.

We share only the information necessary to operate this site and your booking. Our service providers are bound by contract or by their published terms to handle your data only for the purposes we direct.

• Stripe, Inc. — payment processing and tokenized card storage. stripe.com/privacy
• Base44 — our website hosting and database. base44.com/privacy
• Evolve Vacation Rental Network — only when your booking was placed or is being managed through Evolve.
• Meta Platforms, Inc. (Facebook / Instagram) — the Meta Pixel on this site and Meta's Conversions API, used to measure our ads and to show our ads to people who have visited this site. What they send, including contact details in hashed form, and how to opt out, are set out in Section 8. Meta's privacy policy
• Google LLC — answers to our Facebook and Instagram lead forms are saved to a Google Sheet and imported from there into our database. The Sheet keeps its own copy. Google's privacy policy
• Email delivery providers — for sending booking confirmations, owner notifications, and affiliate communications.
• Anthropic, PBC — the AI concierge chat is powered by Claude. Messages you send in chat are transmitted to Anthropic for response generation under their Commercial Terms; they do not train on this content.

Legal disclosures. We may disclose your information to law enforcement or other authorities if compelled by a valid subpoena or court order, or if we believe disclosure is necessary to protect the safety of guests, the owner, or the public.

Business transfers. If ownership of the property changes hands, guest records may transfer to the new owner under the same protections described here.

The chat widget on this site is an AI assistant powered by Claude (Anthropic). Messages you send are transmitted to Anthropic to generate a response and may be reviewed by the owner to improve the assistant or respond to questions it could not handle. Do not share government IDs, credit-card numbers, passwords, or other sensitive identifiers in chat — there is no need to, and the owner cannot guarantee end-to-end encryption of the chat transcript. Anthropic's commercial terms prohibit them from using the content of these messages to train their models.

An AI assistant answers one of our two numbers. When you call (223) 217-7919, you reach Jenn, our AI booking assistant, rather than a person, and calls to that line are recorded and transcribed. (223) 289-0934 is the owner's own phone: a person answers it.

You are told before you say anything. Maryland is an all-party-consent state, which means everyone on a call has to agree before it may be recorded. Before you say anything, the greeting tells you that an AI assistant is answering, that the call is recorded, and that it is handled under this policy. If you stay on the line after that, that is how you give your consent. If you would rather not be recorded, hang up and email info@thebaysideescape.com instead.

Why we do it. To take bookings over the phone, answer questions about the house, and keep an accurate record of what was said and agreed — so that a price you were quoted or a promise you were made can be checked later rather than argued about.

What we keep. The number you called from and the name you give; the dates, party size and any total quoted; what was discussed, what the call came to (booked, call back later, not the right house, and so on), and any note about following up; whether a voicemail was left or a follow-up email sent; how long the call lasted; and a short written summary of the call. We also log the technical side of each call — which lookup the assistant made and whether it succeeded — so that a call which went wrong can be found and fixed.

Who can see it. The owner, and the systems that run this site and the phone line: our database, where call records sit behind an admin-only login, and the phone service that answers (223) 217-7919, which is what records and transcribes the call. We do not sell call records and we do not use them to target advertising.

A copy, or deletion. Email info@thebaysideescape.com and tell us the number you called from, and we will send you what we hold about the call or delete it. Your other rights are in Section 10.

We use a small number of cookies and browser local-storage entries. None are used for third-party advertising auctions or cross-site behavioral targeting beyond the Meta Pixel referenced above.

• Strictly necessary — session token for the Rewards / affiliate dashboard login; CSRF protection; payment-iframe origin verification.
• Functional — affiliate referral code (kept in your browser until you clear this site's data or arrive through another affiliate's link, so an affiliate is credited even if you book later); intake-form draft data; UI preferences.
• Analytics: a browser ID — a random code such as anon_k3j9x2p1q_1695312000000, made the first time you open this site and kept in your browser's local storage (it is not a cookie) until you clear this site's data. It has no expiry date, and it says nothing about who you are. We record it with each page you view and with the few button presses we count. We also record it with the live record of your visit, which holds the page you are on, how long you have been on the site, your approximate city and country, your browser and device, and your IP address with its ending removed (for example 203.0.x.x), so that it no longer points to a single connection; and with an affiliate click, if you arrive through an affiliate's link. That lets the owner see which pages one browser has viewed, on this visit and on earlier ones, and whether it came through an affiliate link. We do not store it with your name, email address, phone number or booking. It never appears in a page address or a link, we never send it to Meta or any other company, and it only works on this site. It is kept with our hosting and database provider (Base44, Section 5) and sent only between your browser, our site and that database.
• Analytics: a tab ID — a second random code, kept in your browser's session storage and deleted when you close the tab. We use it to count how many people are on the site right now.
• Analytics: the visit, and the ad or link that brought you — if the address you arrived at carried campaign tags (utm_source, utm_medium, utm_campaign and utm_content, which name the ad or link, not you) or an ad click ID, cookies keep them for 30 days. Your browser's local storage also keeps a record of the current visit: a random visit number, when it started, those campaign tags, how many pages you have opened, how long the page has been on screen and whether you have scrolled past the price. A visit ends after 30 minutes with no activity. We record the campaign tags with the steps we count (opening the dates, seeing a price, going through to a listing site, sending an inquiry), so we can tell which ads lead anywhere. While you book, session storage notes that your booking request has been counted, so it is counted once.
• Advertising: the Meta Pixel — a script from Meta, with Meta's own cookies (such as _fbp and _fbc), that runs on every page of this site except the owner's admin pages, the guest stay portal (/my-stay) and group-share links. What it sends is set out below.

What the Meta Pixel sends to Meta. The address of each page you open and of the page that sent you; the steps we count, such as viewing the house, staying with a page or opening a second one, checking dates, starting a booking, sending an inquiry and completing a booking, with its value; which buttons you click; your IP address and your browser and device details; and Meta's cookies. It is also set to pick up contact details typed into forms on this site (your email address, phone number and name, and your city, state, ZIP code, country, date of birth or gender where a form asks for them) and send them to Meta in hashed form, which means scrambled in your browser before they leave it. Hashed is not the same as anonymous: Meta uses these details to match a visit to a Facebook or Instagram account.

What our server sends to Meta. When you send an inquiry on this website or make a booking, our server tells Meta through its Conversions API, sending your email address and name (and, for a booking, your phone number) hashed in the same way, and for a booking its reference number and value. That lets Meta count each one once and tell us which ads led to it. Apart from the reference numbers of bookings and of $100-credit claims, and the random visit number described above when we count a visit as engaged, which are used only so Meta counts each one once, we send Meta no ID of ours, and we never send it the browser ID described above.

Meta may combine what it receives with information it has from elsewhere on the internet, and uses it to measure ads and to decide who sees them. To opt out of ads based on it: in Facebook or Instagram, open Settings and then Ad preferences (facebook.com/adpreferences); use the Digital Advertising Alliance's opt-out page (optout.aboutads.info); or use a browser or extension that blocks trackers.

Your browser ID on this device: anon_xi4em32w7_1793744547597 If you ask us for a copy or deletion of your browsing records (Section 10), include it in your email. It is the only way we can find them.

You can clear or block cookies and site data in your browser settings. Clearing this site's data removes both IDs, the visit record and the campaign cookies from your browser, and a new browser ID is made the next time you visit. It does not delete what was already recorded (see Sections 9 and 10). Blocking strictly-necessary cookies will break login and checkout; blocking the others is safe.

We do not currently change what this site records, or switch off the Meta Pixel, when your browser sends a "Do Not Track" or Global Privacy Control signal.

We have not yet set fixed retention periods, and apart from the card case in Section 4, nothing deletes these records automatically. Until the owner sets periods, this is how long each is kept:

• Booking records — until the owner no longer needs them for tax, accounting and disputes.
• Inquiries and unconverted leads, including the copy of lead-form answers kept in the Google Sheet (Section 5) — until you ask us to delete them, or until the owner no longer needs them.
• Saved payment-method tokens — as described in Section 4.
• AI chat transcripts — until you ask us to delete them, or until the owner no longer needs them.
• Phone call records — we have not set a fixed period for these. They are kept until you ask us to delete them, or until the owner no longer needs them.
• Browsing records (page views, counted button presses, live-visit records, affiliate clicks, and the browser ID stored with them) — we have not yet set an automatic deletion period for these. They are kept, record by record, until the owner deletes them.
• Affiliate program data — for the life of the affiliate account, and afterwards until the owner no longer needs it for tax reporting.

You can ask us to delete records earlier — see Section 10.

Depending on where you live, you may have the right to:

• Know what personal information we hold about you and how it is used.
• Receive a copy of your data in a portable, machine-readable format.
• Correct inaccurate information.
• Delete your data, subject to legal retention obligations (e.g., booking records may need to be kept for tax purposes).
• Restrict or object to certain processing.
• Withdraw consent at any time where processing is based on consent (e.g., marketing).
• Opt out of the sale or sharing of your personal information — though, again, we do not sell your information.
• Lodge a complaint with a data-protection authority. For California residents this is the California Privacy Protection Agency; for EU/UK residents this is your national supervisory authority.

To exercise any of these rights, email info@thebaysideescape.com from the address associated with your record. We will respond within 30 days and will not discriminate against you for exercising your rights.

Browsing records. These are stored under a random browser ID, not under your name or email address, so we can only find them if you tell us the ID. Section 8 shows the ID stored on the device you are using now. If you have cleared this site's data since your earlier visits, those visits were recorded under an ID your browser no longer holds, and we cannot connect them to you.

We use reasonable technical and organizational safeguards to protect your personal information: TLS encryption in transit, hosted infrastructure with Stripe-grade payment isolation, row-level-security on our database tables, rate-limited and origin-validated public endpoints, and tokenization of all card data. No system on the internet is perfectly secure, but if a breach affecting your information occurs we will notify you and the appropriate authorities as required by law.

This website is intended for adults age 18 and over and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information through this site, please contact us and we will delete it promptly.

This site is operated from the United States. If you access it from outside the United States, please be aware that information you submit will be transferred to and processed in the United States, which may have different data-protection rules than your home country. By submitting information you consent to that transfer.

We may update this Privacy Policy from time to time. Material changes — such as new categories of data collected or new third-party sharing — will be reflected by updating the "Last updated" date at the top, and where required by law we will provide an additional notice. Continued use of the site after the effective date constitutes acceptance of the revised policy.

If you have any questions about this policy, want to exercise your rights, or believe your data has been mishandled:

The Bayside Escape
2144 Hoopersville Road, Fishing Creek, MD 21634
info@thebaysideescape.com