Privacy Policy

Ivy & Oak (“we,” “us,” or “our”) operates the direct-booking website at ivyoak.house (the “Site”) for a single short-term rental property located at 3 CR 1057, Oxford, Lafayette County, Mississippi 38655. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have over it.

By using the Site or submitting a booking, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

We collect only the information necessary to operate the booking platform and manage your reservation.

Information you provide directly:

• Full legal name, email address, and phone number
• Stay dates, number of guests, and special requests
• Government-issued photo identification (when required for identity verification at Host's discretion)
• Any communications you send us through the Site's messaging system

Information collected automatically at booking:

• IP address and device/browser information — captured at the moment you accept the Rental Agreement as a legally binding audit record of your electronic acceptance under the E-SIGN Act and the Mississippi Electronic Commerce Act (Miss. Code Ann. § 75-12-1 et seq.)
• Booking acceptance timestamp

Payment information:

We use Stripe to process all payments. We never receive, see, or store your full card number, CVV, or bank account details. Stripe returns a tokenized payment method reference that we store solely to process authorized charges under the Rental Agreement (including the $500 security deposit and any documented damage charges up to $5,000). Stripe's privacy practices are governed by Stripe's own Privacy Policy at stripe.com/privacy.

2. How We Use Your Information

We use the information we collect for the following purposes only:

• Booking fulfillment— confirming your reservation, issuing a booking confirmation, coordinating check-in access via smart lock, and processing payment.
• Transactional communications— sending booking confirmations, check-in instructions, check-out reminders, and post-stay follow-up via email, SMS, and/or WhatsApp. See Section 3 for full SMS/WhatsApp disclosure.
• Legal and audit record-keeping— maintaining records of executed rental agreements, electronic signatures, IP addresses, and payment authorizations as required by Mississippi law and for use in dispute resolution.
• Tax reporting— reporting rental income and associated guest stay records as required by the Mississippi Department of Revenue, Lafayette County, and the City of Oxford.
• Fraud prevention and security— verifying guest identity, preventing unauthorized bookings, and protecting the integrity of the booking platform.
• Regulatory compliance— responding to lawful requests from government authorities.

We do not use your personal information for advertising, behavioral profiling, or marketing to third parties.

3. SMS & WhatsApp Messaging Consent

Business identification: All SMS and WhatsApp messages you receive are sent by Ivy & Oak in connection with your reservation at ivyoak.house.

How consent is obtained:By completing a booking on ivyoak.house and accepting the Rental Agreement at checkout, you expressly consent to receive transactional SMS and/or WhatsApp messages from Ivy & Oak related to your reservation. Consent is obtained at the point of booking through an affirmative opt-in checkbox presented before payment is processed.

Message purpose: Messages are strictly transactional and include: booking confirmation, payment receipts, check-in instructions and door access codes, check-out reminders, and post-stay damage or deposit communications. We do not send marketing or promotional messages.

Message frequency: You will typically receive 3–5 messages per reservation across the booking lifecycle (confirmation, pre-arrival, check-in, check-out, and deposit resolution). Frequency may vary slightly depending on reservation circumstances.

Data rates: Message and data rates may apply. Messaging rates are determined by your mobile carrier.

Opt-out: You may opt out of SMS messages at any time by replying STOP to any message. You may reply HELPat any time to receive contact information for Ivy & Oak. Opting out of messages does not cancel your reservation or modify any obligations under the Rental Agreement.

No third-party sharing for marketing: Your phone number is never shared with third parties for marketing purposes.

4. Sub-Processors & Data Sharing

We share your data only with the following named sub-processors, each bound by their own data protection commitments, and only to the extent necessary to provide their respective services:

We do not sell, rent, or trade your personal information to any third party for any purpose. We do not use advertising networks or third-party tracking pixels on the Site.

We may disclose your information to law enforcement, courts, or government agencies when required by applicable Mississippi or federal law, valid legal process, or to protect the safety of persons or property.

5. Data Retention

We retain personal information for 7 years following the completion of your stay. This retention period is aligned with:

• Mississippi's 6-year statute of limitations for written contract claims (Miss. Code Ann. § 15-1-49), with one additional year of buffer for claim accrual timing;
• Mississippi's and the IRS's 7-year recommended retention period for tax and financial records;
• Practical requirements for dispute resolution, insurance claims, and audit documentation.

After 7 years, personal data is securely deleted or anonymized unless a legal hold requires continued retention.

You may request early deletion of your data (subject to active legal hold obligations) by contacting us at contact@ivyoak.house. We will respond to verified deletion requests within 30 days.

6. Your Rights

Regardless of your location, you may contact us at any time to:

• Access a copy of the personal data we hold about you.
• Correct any inaccurate or incomplete information.
• Request deletion of your data, subject to legal retention obligations.
• Request a record of your booking acceptance (IP address, timestamp, agreement version) for your own legal records.

California residents (CCPA): Although we do not specifically target California residents, the CCPA grants California residents the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. California residents may submit requests to contact@ivyoak.house.

EEA/UK residents (GDPR/UK GDPR): Although we do not specifically operate in the European Economic Area or United Kingdom, individuals in those jurisdictions have rights including access, rectification, erasure, restriction of processing, and data portability under the GDPR or UK GDPR. Our legal basis for processing is contractual necessity (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)). EEA/UK residents may submit requests to contact@ivyoak.house.

We include these provisions because the Site is publicly accessible worldwide and we believe these rights are reasonable regardless of jurisdiction.

7. Children

The Site is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. All reservations require the booking guest to be at least 18 years of age. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at contact@ivyoak.house and we will delete it promptly.

8. Security

We implement industry-standard technical and organizational measures to protect your personal information, including TLS/SSL encryption in transit, access controls limiting data access to authorized personnel and sub-processors, and secure tokenized payment processing through Stripe. No method of electronic transmission or storage is 100% secure. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date at the top of this page. If changes are material, we will provide notice on the Site's homepage for at least 30 days. Continued use of the Site after changes are posted constitutes acceptance of the revised Policy.

10. Contact

For any privacy-related questions, requests, or concerns:

Ivy & Oak
ivyoak.house
contact@ivyoak.house
Oxford, Mississippi 38655