Privacy Policy

The company responsible for this website — the "controller", in European terms — is STANZA TRAVEL LLC, a Florida limited liability company (Florida Division of Corporations, Document No. L26000463955; Articles of Organization filed September 3, 2026), doing business as "STANZA". Principal and mailing address: 3590 Rockerman Road, Miami, FL 33133, United States. Registered agent: Andrés Muñoz, at the same address. Until a dedicated mailbox is announced on this page, write to [email protected] or to the address above (section 18). We have not appointed a data protection officer, a representative in the European Union or the United Kingdom, or an encarregado in Brazil (sections 12 and 13).

This policy covers stanzahotels.com in the six languages we publish (English, Spanish, Portuguese, French, German and Italian), its request form, reservation preview and concierge chat, and our web crawler, StanzaBot (section 16). It does not cover the hotels' own websites, which have their own policies, and it is not a contract. Where translations differ, the English version is the reference.

Beyond the connection data and the anonymous visit count that any page view generates (D and C below), we collect nothing about you until you act. Every category comes from you or your browser; we buy nothing from data brokers, social networks or other companies.

Where it goes. A request (A) or a preview reservation (B) is sent to our own server, hosted by Railway (section 6), where a signed-in STANZA operator reads it; your device keeps only its reference (section 5). Name, email and dates are needed to answer a request; the phone and the message are optional — leave them out if you prefer, and nothing else changes.

We do not collect user accounts or passwords, card or bank details, government identifiers, precise geolocation, biometrics, your browsing on other websites, or information about children as individuals — only the number travelling and, in a search, their ages, for the stay.

Your email is used only to answer your request; your phone only to reach you about it. We send no marketing emails, texts or calls. Should we ever start, we will first obtain the consent the law requires — prior express written consent for automated texts or calls under the TCPA and Florida law, and the consent Canada's anti-spam law (CASL) requires where it applies — identify ourselves, and include an unsubscribe link and our postal address, as CAN-SPAM requires. We make no automated decisions about you (section 15) and build no profiles.

STANZA sets no cookies for visitors, loads no third-party fonts, pixels or advertising trackers (our typefaces are served from our own domain) and does not track you across other websites. One third-party script runs on every page: Cloudflare's visit counter, described under "Visit counting" below; it stores nothing on your device. Nothing non-essential is stored on your device, and there is no cookie banner. This is everything your browser stores or sends:

Visit counting

Ours. One event per page view, search, gallery opening, request or preview reservation goes to our own server: event name, page path without search terms or dates, language, hotel shown and time (category C, section 3). No cookie, no identifier, no IP address written.

Cloudflare's. Cloudflare, which routes this site's traffic, inserts a small script (beacon.min.js, about 10 KB, served from static.cloudflareinsights.com) into every page: Cloudflare Web Analytics. When a page loads, and when you move to another page within the site, the script reports to Cloudflare, Inc. (United States): the page address — for a search, that includes the dates and party size, although Cloudflare states it does not log what follows the "?" —, the address of the site that brought you here, your browser and operating system with their versions, the time the page took to load and its Core Web Vitals, and a random number for that page load. The report travels through Cloudflare's own network under this site's address, so Cloudflare sees the connection's IP address as it does for every page and derives your country from it. Cloudflare states that this service uses no client-side state — no cookie, no local storage —, that it does not fingerprint you by IP address, browser string or any other data, and that it does not track individuals across websites; a "visit" is simply a page view that arrived from another site. Cloudflare keeps the raw reports for 7 days, then a sample of about 10 %, and shows us totals for the last six months; it acts as our processor under its data-processing addendum (section 6). We read only totals — pages viewed, referring sites, countries, load times — to know what is read and how fast it loads, never for advertising.

How to avoid it. The switch below and the Global Privacy Control and Do Not Track signals stop our own count only: Cloudflare's script does not read them, and we have no per-visitor switch for it. A content or tracker blocker (Adblock Plus, Brave, the DuckDuckGo extension and similar tools) blocks the script, and so does disabling JavaScript for this site; the site works the same without it.

Do Not Track and Global Privacy Control. Switch off our visit count on this page ("Don't count my visits"). We honour the Global Privacy Control signal and the older Do Not Track setting: a browser sending either is never counted by us, and we treat the signal as an opt-out from any sale or sharing of personal information — which we do not do in any case. That is our answer to CalOPPA's Do Not Track question. Apart from Cloudflare's counter described above, no other party collects information about your activity here. If we ever add advertising, marketing measurement or any further third-party analytics, we will ask for consent first wherever the law requires it and list every cookie here before it is set.

We never sell personal information, never share it for cross-context behavioural or targeted advertising, and have not done so in the preceding twelve months. Your information reaches only:

• The providers that run the site, on our instructions: Railway Corporation (hosting, United States) and Cloudflare, Inc. (domain, DNS, network proxy, security and visit counting, United States). Cloudflare's data-processing addendum, with the EU Standard Contractual Clauses and UK Addendum, applies to our account; we are completing Railway's. Our source code on GitHub contains no guest information.
• Hotels and a booking partner — only when a real reservation exists, which is not the case today. Nothing sent on this site reaches a hotel or booking partner. When live booking opens, the holder's name, children's ages, dates and room will go to the hotel and our booking partner to hold the room; this page will be updated first.
• Your browser's speech service, only if you dictate (section 3, E).
• Public authorities, courts or regulators, where the law obliges us or to defend our rights.
• A successor, if STANZA is ever sold or merged, under this policy.

Today our server has no persistent disk: the files holding A to C are erased at every redeployment, which currently happens often, so nothing has yet reached the periods above. The periods above are maximums; ask, and we delete your request or preview reservation sooner.

The site is served over HTTPS. On this site, requests and preview reservations are readable only by a STANZA operator signed in with the operator key, through a signed session that expires after twelve hours; the key is compared in constant time and sign-in is limited to five attempts per fifteen minutes. Every endpoint that accepts data checks that the call comes from this site, caps the body at 8 KB and rate-limits by a shortened hash of the IP address held only in memory (for the public endpoints the hash changes every day). Guest data never enters source control, our booking connector redacts names, emails and phone numbers from its technical logs, no third-party script runs on our pages, and no card or bank details are captured here.

No system is perfectly secure. If a breach affects your personal information we will notify you and the authorities as the law requires: affected Florida residents within 30 days and, from 500 residents, the Florida Department of Legal Affairs (Fla. Stat. §501.171); the competent supervisory authority within 72 hours, and you without undue delay where the risk is high (GDPR, UK GDPR); the ANPD within its periods (Brazil). We keep a written breach-response runbook and record every incident in a register.

These rights are available to every visitor in the United States, whatever your state. STANZA does not today meet the volume, revenue or business-size thresholds that bring most state privacy laws into force for a business — including those of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island — but we honour the rights they describe anyway:

• Know and access what we hold about you, its sources, purposes and recipients — including the specific third parties, if any, that received it (today none; only the service providers in section 6); correct it; delete it; and receive a copy in a portable format.
• Opt out of sale, of sharing or processing for targeted advertising, and of profiling for decisions with legal or similarly significant effects. We do none of these; a Global Privacy Control signal is honoured as that opt-out regardless.
• Sensitive data: we do not ask for it, and leaving it out changes nothing about your request. If you include a sensitive detail in your message, we use it only to prepare the stay you requested (its inclusion is your consent), infer nothing from it, and delete it on request.
• No discrimination: no denial of service, different price or lower quality for exercising a right.

How to exercise them. Email [email protected] (subject "Privacy request") or write to the address in section 18, from the email you gave us, quoting your reference if you have one. Verification: we match your request to the email and reference on record and may ask you to confirm from that address; there are no accounts to log into. Authorized agents may act for you with your signed permission or a power of attorney; we may confirm with you directly. Timing: we acknowledge within 10 business days and answer within 45 days, extendable once by 45 days with an explanation; no charge except for manifestly unfounded or repetitive requests. Appeals: if we decline all or part of a request we say why; reply "Appeal" within 60 days and we decide within 45 days, in writing, with the contact of your state Attorney General — in California also the California Privacy Protection Agency.

Nevada (NRS 603A): we do not sell covered information; our designated request address for Nevada residents is [email protected] (subject "Nevada request") or the postal address in section 18, and we answer a verified request not to sell within the time above. California "Shine the Light" (Civil Code §1798.83): we disclose no personal information to third parties for their direct marketing; a request under this law will receive that answer.

STANZA is a Florida company. The Florida Digital Bill of Rights (Fla. Stat. §501.701 and following) applies to controllers with more than $1 billion in global revenue that meet further conditions; STANZA is not a covered controller, and we honour the rights in section 9 for Florida residents anyway. We do not sell sensitive data or any personal data, we do not process precise geolocation, and we make no telephone sales calls and send no marketing texts (Fla. Stat. §501.059). Under the Florida Information Protection Act (Fla. Stat. §501.171) we take reasonable measures to protect personal information and follow the breach-notice timeline in section 8.

Notice at collection. When you send a request or a preview reservation we collect the categories below for the purposes in section 4 and keep them for the periods in section 7. We do not sell or share personal information, and we use sensitive personal information only for the purpose you asked for. STANZA does not currently meet the thresholds that make the CCPA, as amended by the CPRA, apply to a business; we honour these rights regardless.

None of the categories below is sold or shared, and none has been in the preceding twelve months.

Every category we hold is processed for a business purpose by the service providers in section 6 (hosting and network), under contracts that restrict them to our instructions; none has been disclosed to any third party for a business purpose. Your California rights — know, delete, correct, portability, opt out of sale or sharing, limit sensitive personal information, non-discrimination — and our verification, agent, appeal and 45-day process are in section 9. We honour Global Privacy Control (section 5). We sell or share no one's personal information, including that of consumers under 16, offer no financial incentives, and are not required to publish request metrics.

STANZA is established in the United States, with no establishment in Europe. Because we offer our service in your languages, the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection apply, and STANZA TRAVEL LLC is the controller. We have not designated a representative under Article 27 GDPR or UK GDPR; we are assessing whether one is required and will name them here if so. Meanwhile, write to us directly (section 18).

Legal bases are in section 4. Your rights: access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21, below), withdrawal of consent (7(3)), and not to be subject to a solely automated decision with legal or similar effects (22; we make none). We answer within one month, extendable by two for complex requests, free of charge. You may complain to the supervisory authority where you live or work; in the United Kingdom also to us first (section 164A, Data Protection Act 2018) and to the Information Commissioner's Office; in Switzerland to the Federal Data Protection and Information Commissioner.

Your right to object. You may object at any time to the processing we base on legitimate interest — the visit count and site security (section 4). The visit count switches off in one click on this page; for anything else, write to us (section 18) and we stop unless we can show compelling legitimate grounds that override your interests.

International transfers. Your information is processed in the United States, whose law differs from yours. STANZA is not certified under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. DPF. When you send us a request you give your information directly to a controller outside Europe; under the European Data Protection Board's guidelines that is not a "transfer" in the sense of Chapter V, and the GDPR protects it in our hands because we are subject to it (Article 3(2)). The transfers we make — to the providers that run the site — rest on their data-processing agreements incorporating the EU Standard Contractual Clauses and the UK Addendum: Cloudflare's applies today; we are completing Railway's, and this page will say when it is done. Ask us for details of these safeguards.

Brazil. This site is published in Portuguese for Brazil, so the Lei Geral de Proteção de Dados (Lei 13.709/2018) applies and STANZA TRAVEL LLC is the controlador, responsible for the processing described here; the providers that run the site act on our instructions as operadores. We have not appointed an encarregado; our channel for data subjects is in section 18. We process your request and preview reservation at your request (Art. 7, V), security and the visit count on legitimate interest (Art. 7, IX), and a sensitive detail you volunteer with your specific consent (Art. 11, I). You may obtain confirmation, access, correction, anonymisation, blocking or deletion, portability, information on sharing and on refusing consent, and revoke consent (Art. 18), and petition the Autoridade Nacional de Proteção de Dados; we answer access requests within the fifteen days of Art. 19 and the rest without undue delay. Your data is processed in the United States, which the ANPD has not recognised as adequate. Giving us your request directly is international collection, not a transfer, under ANPD Resolution 19/2024 (Art. 6); the transfer we make to the providers that run the site is being formalised under that Resolution, and until then rests on the necessity of running the service you asked for (Art. 33, IX, with Art. 7, V).

Canada. We collect, use and disclose your information with the consent implied by your request, for the purposes on this page; you may access and correct it and complain to the Office of the Privacy Commissioner of Canada. It is stored in the United States and subject to U.S. law.

This site is for adults planning a stay and is not directed to children. We do not knowingly collect personal information from anyone under 18, and never from a child under 13 within the meaning of the U.S. Children's Online Privacy Protection Act (COPPA). The number of children travelling with you — and, in a search, their ages — is used only to find the right rate and prepare the stay. If we learn that a child has sent us personal information, we delete it; parents or guardians may write to us (section 18).

• Search and filters run on catalogue data and keep nothing about you; a search adds one anonymous event to the visit count (section 3, C), and its page address — with the dates and party size — passes through the connection data (section 3, D).
• The concierge chat is an automated assistant, not a person: it answers from fixed templates and this site's own data; no AI model is involved, the conversation is not stored, and nothing you type in it is sent anywhere — unless you choose "send a request" from the chat, in which case your last message pre-fills the request form, which you review and send yourself (category A). It never books for you. If an AI model is ever connected, its first message will say so and this page will change first.
• The Stanza Score is our own editorial index of hotels, computed from public facts about each hotel, never from information about you.
• We make no automated decision about you with legal or similarly significant effects and build no profiles.

To build the collection, our own scripts read public hotel pages, newsrooms and image libraries where their robots.txt allows it, identifying themselves with the User-Agent StanzaBot/1.0 (+https://stanzahotels.com/bot/; [email protected]). StanzaBot honours robots.txt, waits at least two seconds between requests to the same host, reads nothing behind a login, submits no forms, never works around a block, and never reads review sites or booking platforms. The only personal information it may retain is a photographer's or author's name as published, which we keep to credit them (see /credits/). Two lines in a robots.txt file — User-agent: StanzaBot and Disallow: / — keep it off a site; details, contact and takedown at stanzahotels.com/bot/.

Each version carries a number and an effective date at the top; this is version 3.1. When the site changes — live booking opens, persistent storage arrives, a dedicated mailbox or a European representative is appointed — we publish a new version here. Material changes are announced with a notice at the top of this page for at least 30 days, except where a change is required by law with immediate effect. Earlier versions are available on request.

STANZA TRAVEL LLC (doing business as STANZA) · 3590 Rockerman Road, Miami, FL 33133, United States · Email: [email protected] — subject "Privacy request" for any request under this policy. A dedicated privacy mailbox will be published on this page as soon as it is in service.

For the European Union, the United Kingdom, Switzerland, Brazil and Canada the same contact applies; no representative, data protection officer or encarregado has been appointed. The hotels featured on this site are not affiliated with STANZA and hold no information from it.