Privacy policy

Last updated 6 October 2026

This policy explains what personal information StateSide collects, why, who we share it with and your rights. StateSide (stateside.online) is run by TM Properties (“we”, “us”). We are the controller of the information described here, and we follow UK data protection law (the UK GDPR and the Data Protection Act 2018).

Questions or requests about your information: email info@stateside.online. Our ICO registration number is ZC268601.

1. What we collect

If you enquire about a villa

Your name, email address, phone number (optional), dates, number of guests and your message.

If you sign up for launch news

Your name, email address, whether you’re a guest or an owner, anything you add in the notes box and, for owners, your resort, ZIP code, number of bedrooms and phone number.

If you list a villa (owners)

• Account details: your name, email address, phone number and password (stored scrambled, so we can’t see it).
• Your listing: the details, prices, calendar links, photos and contact details you add. We remove location data hidden inside photos when you upload them.
• Verification details you give us so we can check your villa is genuine, such as links to other listings, your licence number and notes. These are never shown to guests.
• Payment records: the amount, date and what was paid for. Payments are handled by Stripe; we never see or store your card details.

If you’re invited to review a stay

Your name and email address (from your enquiry, or given to us by the villa owner because you stayed with them), and your review, star rating, stay date and the name you choose to show. Your email is never published.

If you turn on phone notifications

A technical address for your phone or browser, provided by its push service (Google, Apple or Mozilla), so we can tell you about new enquiries (owners) or special offers (guests). The notification wording is collected from our site, not sent through those services. Turn notifications off at any time in your phone’s settings.

When anyone uses the site

• A single cookie that keeps you logged in and protects our forms from misuse. It’s essential for the site to work, so we don’t ask for consent, and it’s deleted when you close your browser.
• If you choose to see prices in pounds or dollars, a small cookie remembers that choice for a year. It’s only set when you make the choice, and holds nothing else.
• Our hosting company keeps standard server logs, such as your IP address, browser type and the pages you visit, for security and to fix problems.
• Simple visitor statistics, so we know how many people use the site and how they found it: the page you visited, the website that sent you, whether you’re on a phone or computer, and your browser’s language setting. We don’t use cookies for this, don’t store your IP address, and can’t follow you from one day to the next. On the owner sign-up form we also note how far through the form a visitor got (for example “reached the password box”) and, if the form showed an error, what kind of error. We never record what you type unless you create an account. If you ask us to set up your listing, we keep the photos and details you send to build it. Any ownership document you send is seen only by us, kept where it can’t be reached from the web, and deleted once we’ve checked it (and in any case within 60 days). Some resort pages have a YouTube video. Nothing loads from YouTube until you press play; when you do, YouTube’s own privacy policy applies to the video. We use this in our legitimate interest in running and improving the site.

We don’t use advertising or tracking cookies, and we don’t sell your information.

2. Why we use it, and our legal basis

3. Enquiries go to the owner

When you send an enquiry, we pass your details to that villa’s owner so they can reply. From then on, the owner uses your information for your booking as an independent business, under their own responsibility, and you deal with them directly. Many owners are based outside the UK, including in the United States.

If you tick the box allowing it, and the villa can’t take your booking, its owner may pass your enquiry (your name, contact details, dates, number of guests and message) to up to three other villa owners nearby whose villas are free for your dates. We email you to say which villas it went to. If you don’t tick the box, your enquiry only ever goes to the owner you chose.

If you confirm a booking through StateSide, we keep the booking details and what you add (the lead guest’s name, phone and address, the names and ages of everyone staying, and arrival details), so you and the owner both have a record. Only that villa’s owner sees them, and they’re deleted with your enquiry after two years.

Messages you and the owner send each other through StateSide (on the site, or by replying to our emails) are kept with your enquiry so you can both see the conversation, and are deleted with it after two years.

4. Who else handles your information

We use trusted service providers who only process information on our instructions:

• GoDaddy: website hosting and database (servers may be in the United States).
• Brevo (France): sends our emails to owners and guests.
• Google: delivers notification emails to our own inbox.
• Microsoft 365: our business email.
• Stripe: takes owners’ listing and feature payments.

When pages load, your browser also fetches fonts from Google Fonts, photos from Pexels, map images from OpenStreetMap and map software from Cloudflare. These services receive your IP address and browser details, as with any website you visit. If you use a share button, the service you choose (such as WhatsApp or Facebook) handles that under its own policy.

We may also share information if the law requires it, or to protect people from fraud or harm.

5. Transfers outside the UK

Some of these providers store or access information outside the UK, including in the United States and the European Union. Where they do, we rely on UK adequacy regulations or approved safeguards, such as the UK’s international data transfer agreement or addendum, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified.

6. How long we keep it

• Enquiries: 2 years, then deleted automatically.
• Launch sign-ups: until you unsubscribe, or 2 years after we last emailed you.
• Owner accounts and listings: while the account is open. When it’s closed, we delete it within 3 months, apart from payment records.
• Reviews: published reviews stay on the listing while it’s on StateSide. Unused review invitations are deleted after a year.
• Payment records: 6 years, as required for tax.
• Visitor statistics: 13 months, then deleted automatically.
• Server logs: kept by our host for a limited period, normally no more than a few months.

7. Your rights

You can ask us to:

• give you a copy of the information we hold about you
• correct anything that’s wrong
• delete your information
• restrict how we use it, or object to us using it (including for any marketing)
• give your information to you, or another organisation, in a common format

Where we rely on consent, you can withdraw it at any time, for example by replying “unsubscribe” to any email. To use your rights, email info@stateside.online. We’ll reply within one month. It’s free, though we may need to confirm who you are.

If you’re unhappy with how we’ve handled your information, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113.

8. Keeping it safe

The site uses an encrypted connection (HTTPS), passwords are stored scrambled, and only we can see the admin area. No system is completely secure, but we take reasonable steps to protect your information.

9. Children

StateSide is for adults. You must be 18 or over to send an enquiry or create an account.

10. Changes

We’ll update this page if anything changes and show the new date at the top. If the changes are significant, we’ll tell owners by email.