Privacy Policy

Data Controller

This Privacy Policy is issued by TER PR LLC, a Puerto Rico limited liability company, doing business as The Estate Reserve ("TER," "The Estate Reserve," "we," "us," or "our"). TER PR LLC is the data controller responsible for the collection, use, storage, and protection of your personal information as described in this policy. Our registered address is in Puerto Rico. For all privacy-related inquiries, contact privacy@theestatereserve.com.

1. Information We Collect

We collect the following categories of personal information:

• Identifiers: Name, email address, phone number, mailing address, and government-issued ID (at check-in).
• Commercial Information: Booking history, payment records, property preferences, and transaction details.
• Internet & Electronic Activity: Pages visited, time spent, browser type, device information, IP address, and referral URLs collected via cookies and analytics.
• Geolocation Data: Approximate location derived from IP address.
• Inferences: Preferences and interests derived from your interactions with our services.
• Payment Information: Credit card details are processed securely through Stripe. We do not store your full card number on our servers.
• Communications: Records of correspondence with our concierge team, including email, chat, WhatsApp messages, and SMS.
• Messaging Data: If you interact with our WhatsApp concierge or SMS services, we collect message content, timestamps, and your phone number. Messages are processed by our AI concierge system and may be reviewed by our team for quality and safety purposes.
• Biometric Identifiers: Facial geometry derived from government-issued ID photographs, collected solely for identity verification at check-in. Such data is collected only with your express consent.
• AI Interaction Data: If you interact with our AI-powered concierge services, we collect conversation content, interaction patterns, and service preferences to improve our concierge quality.

2. How We Use Your Information

We use personal information for the following purposes:

• Process and manage your bookings and payments.
• Communicate with you about reservations, account activity, and customer support.
• Send promotional communications (with your consent; you may opt out at any time).
• Improve our services, website experience, and personalization.
• Detect and prevent fraud, unauthorized access, and other illegal activities.
• Comply with legal obligations and enforce our Terms of Service.
• Process messages through our AI-powered concierge system, including natural language processing of WhatsApp and SMS communications, to provide personalized concierge services.
• Verify identity using biometric comparison of check-in photographs against government-issued ID.

3. Information Sharing

The Estate Reserve has NOT sold personal information in the preceding 12 months. We do not sell your personal information. We may share your information with the following categories of recipients:

• Property Owners & Managers: To fulfill your booking and coordinate your stay.
• Payment Processors (Stripe): To process transactions securely. Stripe's privacy policy governs their use of your data.
• Cloud Infrastructure (AWS): For secure data storage and hosting.
• Analytics Providers: We may use analytics tools such as Google Analytics to understand usage patterns and improve our services. When active, analytics providers act as data processors on our behalf, and their respective privacy policies govern their processing of data collected through cookies. Analytics data is aggregated where possible. Analytics cookies are only set when you consent to non-essential cookies via our cookie consent banner.
• Email & Communication Services: To send transactional and promotional communications.
• Identity Verification: When required for check-in or fraud prevention.
• Law Enforcement: When required by law, subpoena, or court order.
• AI Service Providers: Our AI concierge system processes messages through third-party AI providers. Messages are processed in real-time for response generation and are not used for AI model training. Our AI providers are contractually prohibited from retaining or using your data beyond the immediate processing request.

4. Data Security

We implement industry-standard security measures including encryption in transit (TLS/SSL) and at rest, secure payment processing via PCI-compliant processors, access controls, and regular security assessments. However, no method of transmission over the internet or electronic storage is 100% secure.

5. Cookies & Tracking

We use cookies, local storage, and similar technologies to improve your browsing experience, remember preferences, track affiliate referral codes (with your consent), and analyze site usage. Non-essential cookies and tracking technologies are only activated after you provide consent via our cookie consent banner. For detailed information about all cookies and client-side storage we use and how to manage them, please see our Cookie Policy.

6. US State Privacy Rights

If you are a resident of California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), or another US state with consumer privacy legislation, you have the following rights:

7. European Economic Area, United Kingdom & Switzerland Privacy Rights

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional rights and disclosures apply under the EU General Data Protection Regulation (EU GDPR, Regulation 2016/679), the UK General Data Protection Regulation (UK GDPR, as retained under the Data Protection Act 2018), and the Swiss Federal Act on Data Protection (nFADP/DSG), respectively:

8. Canadian Privacy Rights

If you are a Canadian resident, your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation (including Quebec's Act Respecting the Protection of Personal Information in the Private Sector, as amended by Bill 25). You have the right to access, correct, and request deletion of your personal information. For Quebec residents, we will obtain explicit consent before collecting, using, or disclosing your personal information, and you have the right to data portability and to be informed of automated decision-making. To exercise these rights, contact privacy@theestatereserve.com. We will respond within 30 days.

9. Brazilian Privacy Rights (LGPD)

If you are located in Brazil, the Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018) provides you with specific rights regarding your personal data. TER PR LLC processes your data under the following legal bases as applicable: consent, contractual necessity, legitimate interest, or legal obligation. Your rights under the LGPD include:

• Right to Confirmation and Access: Confirm whether we process your data and obtain access to it.
• Right to Correction: Request correction of incomplete, inaccurate, or outdated data.
• Right to Anonymization, Blocking, or Deletion: Request anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in violation of the LGPD.
• Right to Data Portability: Request portability of your data to another service provider.
• Right to Deletion: Request deletion of personal data processed with your consent.
• Right to Information: Obtain information about public and private entities with which we have shared your data.
• Right to Revoke Consent: Revoke consent at any time, without affecting the lawfulness of processing carried out prior to revocation.
• Right to Oppose: Oppose processing carried out in violation of the LGPD.
• Right to Review Automated Decisions: Request review of decisions made solely on the basis of automated processing of personal data.

10. Mexican Privacy Rights (LFPDPPP)

If you are located in Mexico, the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP) and its Regulations provide you with ARCO rights (Acceso, Rectificación, Cancelación, Oposición):

• Access (Acceso): Request access to your personal data in our possession.
• Rectification (Rectificación): Request correction of inaccurate or incomplete personal data.
• Cancellation (Cancelación): Request deletion of your personal data when it is no longer necessary for the purposes for which it was collected.
• Opposition (Oposición): Oppose the processing of your personal data for specific purposes.
• Revocation of Consent: Revoke consent previously granted for the processing of your personal data.
• Limit Use or Disclosure: Request that we limit the use or disclosure of your personal data.

11. Asia-Pacific Privacy Rights

TER is committed to respecting the privacy rights of individuals in the Asia-Pacific region. The following provisions apply to residents of the listed jurisdictions:

12. Middle East & Africa Privacy Rights

TER respects the privacy rights of individuals in the Middle East and Africa. The following provisions apply:

13. Caribbean Privacy Rights

As TER operates extensively in the Caribbean, we are committed to complying with data protection laws across the region:

• Bahamas: TER complies with the Data Protection (Privacy of Personal Information) Act 2003. Bahamian residents have the right to access and correct personal information.
• Barbados: TER complies with the Data Protection Act 2019. Barbadian residents have rights of access, rectification, erasure, and data portability.
• Cayman Islands: TER complies with the Data Protection Act 2017. Cayman Islands residents have rights of access, rectification, erasure, restriction, portability, and objection.
• Jamaica: TER complies with the Data Protection Act 2020. Jamaican residents have rights of access, correction, and deletion.
• Trinidad and Tobago: TER complies with the Data Protection Act 2011. Residents have rights of access and correction.
• U.S. Virgin Islands and British Virgin Islands: TER applies applicable US federal privacy standards (USVI) and UK GDPR standards (BVI) respectively.
• For all Caribbean jurisdictions, to exercise your privacy rights, contact privacy@theestatereserve.com.

14. Do Not Track & Global Privacy Control

We recognize and respond to Global Privacy Control (GPC) browser signals. When we detect a GPC signal, we treat it as a valid opt-out of sale/sharing of personal information. We also honor Do Not Track browser signals by limiting tracking to essential, functional purposes only.

15. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected individuals within 72 hours of discovery, in accordance with Florida Statute 501.171 and other applicable state breach notification laws. Notification will include the nature of the breach, categories of data affected, and steps you can take to protect yourself. TER will offer affected individuals complimentary credit monitoring services for a minimum of 12 months following any breach involving sensitive personal information.

16. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe we have collected information from a child under 16, please contact us at privacy@theestatereserve.com.

17. International Transfers

Your personal information is primarily stored and processed in the United States (AWS us-east-2 region). If you access our services from outside the United States, your information will be transferred to and processed in the US, where data protection laws may differ from those in your jurisdiction. We implement appropriate safeguards for international data transfers in accordance with applicable laws, including Standard Contractual Clauses (SCCs) for EEA transfers, UK International Data Transfer Agreements (IDTAs) for UK transfers, and equivalent mechanisms recognized under applicable data protection frameworks in other jurisdictions. We conduct Transfer Impact Assessments (TIAs) where required to evaluate the level of data protection in recipient countries. By using our services, you acknowledge and consent to this transfer, subject to the safeguards described in this policy and in the jurisdiction-specific sections above.

18. Automated Decision-Making

The Estate Reserve does not engage in automated profiling or decision-making that produces legal effects or similarly significant effects on individuals. Any automated processing (such as fraud detection) is supplemented by human review.

19. AI & Automated Processing Transparency

TER uses artificial intelligence to power its WhatsApp and digital concierge services. Here is how our AI systems operate:

• When you send a message to our concierge, it may be processed by an AI system before or instead of a human agent.
• The AI system analyzes your message to understand your request and generate a helpful response.
• AI responses are generated in real-time and are not pre-written.
• Your messages are NOT used to train AI models. Our AI providers are contractually prohibited from using your data for model training or improvement.
• Human team members may review AI conversations for quality assurance, accuracy verification, and safety monitoring.
• You may request human assistance at any time by typing "HUMAN" or "AGENT" in the conversation.
• AI-generated responses may contain inaccuracies; critical information (pricing, availability, policies) should always be confirmed with a human representative.
• Conversation data is encrypted in transit and at rest using AES-256 encryption.

20. Puerto Rico Data Protection

For users in the Commonwealth of Puerto Rico, the following additional protections apply:

• Puerto Rico Act 232 of 1942 (Social Security Number Protection Act) — TER does not require Social Security Numbers for bookings. If an SSN is provided for tax or verification purposes, it is encrypted, access-restricted, and never shared beyond legal requirements.
• Puerto Rico is subject to certain provisions of HIPAA where health data is involved in wellness services. Health disclosures provided for wellness or spa experiences are treated as sensitive personal information with enhanced protections.
• TER does not engage in profiling or automated decision-making that produces legal or similarly significant effects on Puerto Rico consumers.
• Puerto Rico consumers may exercise their privacy rights by contacting privacy@theestatereserve.com.

21. Biometric Data Practices

In compliance with the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code Ann. § 503.001), the Washington Biometric Identifier statute (RCW 19.375), and similar state biometric privacy laws:

• Purpose: TER collects facial geometry data solely for the purpose of verifying guest identity at check-in by comparing check-in photographs against government-issued ID.
• Consent: Biometric data is collected only after obtaining your informed, written consent.
• Storage: Biometric data is stored using AES-256 encryption in access-controlled environments.
• Retention: Biometric data is retained for no more than 30 days after checkout, then permanently destroyed.
• Destruction: Upon expiration of the retention period, biometric data is destroyed using industry-standard data sanitization methods (NIST 800-88 guidelines).
• Disclosure: Biometric data is never sold, leased, traded, or otherwise disclosed to third parties, except as required by valid legal process.
• Opt-Out: You may decline biometric verification; alternative identity verification methods (manual ID inspection, verification questions) will be provided at no inconvenience.
• Written Policy: TER maintains a publicly available written policy governing the collection, retention, and destruction of biometric data, available upon request.

22. Data Retention

We retain personal information for as long as necessary to fulfill the purposes outlined in this policy, or as required by law. Booking records are retained for 7 years for tax and legal compliance. Government-issued ID collected at check-in is retained for no more than 30 days after checkout, then securely destroyed. Marketing consent records are retained for the duration of the consent plus 3 years. You may request deletion at any time, subject to legal retention requirements. AI concierge messages: retained for 90 days for service quality and safety review, then automatically and permanently deleted. Biometric identifiers: retained for no more than 30 days after checkout, then securely destroyed using industry-standard data sanitization methods. Service worker cache data: stored locally on your device and managed by your browser settings.

23. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For material changes, we will provide notice via email or a prominent notice on our website.

24. Contact

For privacy inquiries, data access requests, or complaints, contact us at privacy@theestatereserve.com or by WhatsApp at +1 (786) 820-0234.