Privacy Policy

1. Introduction & Scope

Oasis Retreats USA LLC ("Oasis Retreats," "we," "us," or "our") is a vacation rental management company headquartered in Sheridan, WY, with operations in Florida, North Carolina, and Missouri. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you visit oasisretreatsusa.com, interact with our booking platform at oasis.directbyhost.com, contact our team, or use any service we provide.

This policy applies to all personal information we process regardless of the medium — website, email, phone, or in person. It does not apply to third-party websites or services we link to; those are governed by their own privacy policies.

By using our website or services you acknowledge the practices described in this policy. If you do not agree, please do not use our services or submit personal information to us.

2. Information We Collect

We collect information directly from you, automatically through your use of our website, and from third-party service providers.

Personal Information

When you submit an inquiry, create a profile, or correspond with our team: your name, email address, phone number, and mailing address.

Booking Information

When you reserve a property: travel dates, property selection, number of guests, special requests, and correspondence related to your stay.

Payment Information

Payments are processed by our third-party booking platform (DirectByHost) and their payment processor. We do not receive, store, or have access to full credit card numbers, CVV codes, or bank account details. We retain only transaction confirmation data (reservation ID, amount, date) for accounting and tax purposes.

Technical Information

Collected automatically when you visit our website: IP address, browser type and version, operating system, device identifiers, referring URL, pages visited, and session duration.

Communication Data

Records of your communications with us including inquiry form submissions, emails, and support tickets — including the content of those communications.

Property-Related Data

For guests who have completed a booking: check-in and check-out timestamps, smart lock access codes (temporary, generated per stay), and property condition notes.

3. How We Use Your Information

• Booking fulfillment — process and confirm reservations, coordinate check-in details, and manage your stay from arrival to departure.
• Communication — respond to inquiries, send booking confirmations, pre-arrival instructions, post-stay follow-ups, and resolve service issues.
• Marketing — send newsletters and promotional offers if you have opted in. You may opt out at any time via the unsubscribe link in any email or by contacting hello@oasisretreatsusa.com.
• Analytics & improvement — understand how visitors use our website and improve the guest experience over time.
• Legal compliance — meet federal, state, and local legal obligations including tax reporting and responding to lawful government requests.
• Safety & security — detect fraud, investigate security incidents, and protect the safety of guests, property owners, and our team.
• Owner services — if you are a property owner, manage your listing, provide monthly performance reports, and coordinate maintenance.

4. How We Share Your Information

We do not sell your personal information. We do not share personal information with advertisers or data brokers for their own marketing purposes. We share information only in the following limited circumstances:

• Service providers — cleaning crews, maintenance contractors, and local property managers receive limited booking data needed to prepare for your arrival. All are bound by confidentiality obligations and prohibited from using your data for any other purpose.
• Booking platform (DirectByHost) — reservations are processed through oasis.directbyhost.com, which maintains its own privacy policy governing information collected at checkout.
• Payment processors — payment data flows directly between you and our payment processor. We receive only transaction confirmation data.
• Legal and regulatory — we may disclose information when required by law, court order, or government regulation, or to prevent fraud or protect safety.
• Business transfers — in the event of a merger or acquisition, personal information may transfer to a successor entity with prior notice to affected users.

5. Your Privacy Rights

Regardless of your location, you may exercise the following rights with respect to the personal information we hold about you:

• Access — request a copy of the personal information we have collected.
• Correction — request correction of inaccurate or incomplete information.
• Deletion — request deletion of your personal information, subject to our legal retention obligations.
• Opt-out of marketing — unsubscribe from marketing communications at any time via the unsubscribe link in any email or by contacting us directly.
• Portability — request a machine-readable copy of your data where technically feasible.

To exercise any of these rights, email privacy@oasisretreatsusa.com with "Privacy Request" in the subject line. We will acknowledge within 10 business days and respond substantively within 30 calendar days.

6. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights. This section supplements the rest of this policy and applies to California residents only.

Your California Rights

• Right to Know — the categories and specific pieces of personal information collected, the purposes for collection, and third-party sharing.
• Right to Delete — request deletion of personal information, subject to certain exceptions (completing a transaction, legal obligations).
• Right to Correct — request correction of inaccurate personal information in our records.
• Right to Opt-Out of Sale or Sharing — we do not sell personal information and do not share it for cross-context behavioral advertising.
• Right to Limit Sensitive Personal Information — we do not use sensitive personal information beyond what is necessary to provide our services.
• Right to Non-Discrimination — we will not deny service or provide inferior service because you exercised any privacy right.

Categories of Personal Information Collected (Last 12 Months)

Submitting a California Request

Email privacy@oasisretreatsusa.com with the subject "CCPA Request." We verify your identity before processing any deletion or disclosure request. You may designate an authorized agent with written proof of authorization.

7. Other State Privacy Rights

Residents of the following states have privacy rights under applicable state law. We honor all verifiable requests consistent with each law's requirements:

• Virginia (VCDPA) — access, correct, delete, portability, and opt out of targeted advertising and profiling.
• Colorado (CPA) — access, correct, delete, portability, and opt out of targeted advertising, sale, and profiling.
• Connecticut (CTDPA) — access, correct, delete, portability, and opt out of sale and targeted advertising.
• Texas (TDPSA) — access, correct, delete, portability, and opt out of sale, targeted advertising, and certain profiling.
• Other states — as new state privacy laws take effect we will honor the rights they grant. Contact privacy@oasisretreatsusa.com with questions about your state.

8. Children's Privacy (COPPA)

Our website and services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. We also do not knowingly collect personal information from users between 13 and 16 without verifiable parental consent where required by law.

If we become aware that we have inadvertently collected information from a child under 13, we will delete it promptly. If you believe we have collected such information, contact us at privacy@oasisretreatsusa.com.

9. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information against unauthorized access, disclosure, alteration, and destruction:

• Encryption of data in transit (TLS) and at rest using industry-standard protocols
• Role-based access controls limiting who can access personal data internally
• Regular security assessments and third-party vendor security reviews
• Employee training on data handling, phishing awareness, and incident response
• Incident response procedures with prompt notification as required by applicable law

No method of transmission or storage is 100% secure. In the event of a breach affecting your rights, we will notify you as required by applicable law.

10. Data Retention

• Booking and transaction data — retained for 7 years to satisfy federal and state tax record-keeping obligations.
• Marketing preferences and email lists — retained until you opt out or request deletion.
• Technical and analytics data — retained for up to 26 months, then aggregated or deleted.
• Inquiry and communication data — retained for 2 years from last contact (booking retention applies if a booking arises).
• Property access data — smart lock codes invalidated at checkout; access logs retained 90 days for security purposes.

11. International Visitors

Oasis Retreats is operated in the United States. If you are visiting from outside the US, any information you provide will be transferred to, processed, and stored in the United States, where data protection laws may differ from those in your country. By using our services, you consent to this transfer.

We do not currently offer services under the EU GDPR framework. Contact privacy@oasisretreatsusa.com with questions about international data handling.

12. Do Not Track / Global Privacy Control

Our website does not currently respond to browser-level "Do Not Track" (DNT) signals, as no uniform industry standard has been established.

We do honor the Global Privacy Control (GPC) signal as required by the CPRA. If your browser transmits a GPC signal, we treat it as a request to opt out of the sale or sharing of your personal information for cross-context behavioral advertising.

13. Changes to This Policy

When we make material changes to this policy, we will update the "Last updated" date, post a notice on our homepage for at least 30 days, and send email notification to users with active accounts or recent bookings. Continued use of our services after changes become effective constitutes acceptance of the updated policy.

14. Contact Information

If you have questions, concerns, or requests related to this Privacy Policy, please reach out through any of the following:

We acknowledge all privacy requests within 10 business days and respond substantively within 30 calendar days. California residents: we respond within 45 calendar days of a verified request, with a possible 45-day extension where reasonably necessary.

For full details on cookies we use, please read our Cookie Policy.