Privacy Policy
Stay at Mare · www.stayatmare.com Effective date: October 18, 2026 Last updated: October 18, 2026
This Privacy Policy explains how Stay at Mare collects, uses, shares and protects personal information when you visit www.stayatmare.com (the "Site"), chat with Mari, our AI assistant, book a stay, sign up for our newsletter, or otherwise contact us. We have tried to keep it plain and readable.
1. Who we are and how to contact us
Stay at Mare is a 14-room boutique hotel at 59 Calle Taft, San Juan, Puerto Rico 00911. It is owned and operated by PDDK LLC ("PDDK", "we", "us", "our"). PDDK LLC is responsible for (the "controller" of) the personal information described in this policy.
- Email for privacy questions and requests: resi@pddkllc.com (subject line: "Privacy request")
- Mail: PDDK LLC / Stay at Mare, 59 Calle Taft, San Juan, PR 00911
2. Information we collect
a. Booking information
Reservations on our Site are made through a secure booking engine operated by SiteMinder (Little Hotelier) at direct-book.com. When you book, you provide information such as your name, email, phone number, address, arrival and departure dates, number of guests, room preferences, special requests and payment card details. Payment card details are entered into and processed by the booking engine and its payment processors; we do not see or store full card numbers on our Site. SiteMinder shares your reservation details with us so we can manage your stay. We may also receive reservation information from online travel agencies (OTAs) such as Booking.com, Expedia or Airbnb if you book through them.
At check-in and during your stay, we may collect additional information required to operate the hotel or by law, such as identification details, vehicle information, guest registration information and records of charges.
b. Chats with Mari, our AI assistant
Mari is an artificial-intelligence (AI) assistant, not a person. When you use the chat we collect: - the messages you type and Mari's replies; - a random session ID (stored in your browser's session storage, not tied to your name), message times and the language you are using; - basic usage events, such as whether you clicked a booking, email or restaurant link from the chat.
To prevent abuse, our server briefly uses a hashed (scrambled) version of your IP address to rate-limit messages; that value is kept for no more than 24 hours and is not saved with your chat. If you type something that looks like a payment card number, our system automatically removes it before it is saved or processed. Please do not share sensitive information in the chat (card numbers, passwords, ID or passport numbers, health details).
c. Inquiry / lead form
If you ask Mari or the Site to have our team follow up, we collect what you choose to provide: your email address, check-in and check-out dates, number of adults and children, notes or questions, and your preferred language.
d. Newsletter ("La Carta")
If you subscribe to La Carta, we collect your email address and use it to send roughly one email per month. You can unsubscribe at any time using the link in any email or by writing to us.
e. Communications
When you email, call, text or message us (including through Instagram or WhatsApp), we keep the content of your message, your contact details and our reply.
f. Cookies, analytics and advertising technologies
When you visit the Site, we and our partners may automatically collect information such as your IP address, browser and device type, pages viewed, referring site, approximate location (city/country level), and interactions such as clicking "Book". We use cookies and similar technologies, including Google Analytics 4, the Google Ads tag and the Meta Pixel. Non-essential cookies are used only in line with your choices in our cookie banner. See Section 11.
3. How we use information, and our legal bases
We use personal information to:
| Purpose | Examples | Legal basis (for EU/UK visitors) |
|---|---|---|
| Provide and manage your stay | Confirm bookings, prepare your room, check-in, billing, guest services | Performance of a contract |
| Answer your questions | Mari's replies, responding to emails and inquiry forms | Contract (pre-booking steps) / legitimate interests |
| Improve our service | Reviewing chat transcripts and site analytics to fix problems and improve answers | Legitimate interests; consent for analytics cookies |
| Marketing | La Carta newsletter; measuring and showing ads on Google and Meta | Consent (newsletter, ad cookies) |
| Safety and security | Preventing fraud, abuse and misuse of the chat and Site | Legitimate interests |
| Legal and tax obligations | Keeping financial and guest records, responding to lawful requests | Legal obligation |
We do not use chat conversations for advertising, and we do not allow our AI provider to use them to train its models. We do not make decisions that have legal or similarly significant effects about you based solely on automated processing.
4. How Mari uses AI
Mari's replies are generated by a large language model supplied by Anthropic, PBC (United States). Your messages are sent to Anthropic to produce each reply. Under Anthropic's commercial terms, data sent through its API is not used to train its models by default; Anthropic may keep data for a limited period for trust-and-safety and legal purposes. Mari can make mistakes. Please confirm important details, such as rates, availability and policies, with our team or on the booking page. Mari cannot see, make or change reservations, and the chat is not monitored live. In an emergency, call 911.
5. How we share information
We do not sell your personal information, and we do not knowingly "share" it for cross-context behavioral advertising except through Google and Meta advertising cookies when you have allowed them (you can opt out at any time; see Sections 9 and 11). We share information with:
- SiteMinder / Little Hotelier — booking engine, channel manager and property management system.
- Payment processors used by the booking engine, to process and secure your payments.
- Online travel agencies (OTAs) — if you book through them, they share your reservation with us, and we send them availability and rates.
- Netlify, Inc. (United States) — hosts the Site, runs the chat service, stores chat logs for 30 days and receives inquiry forms.
- Anthropic, PBC (United States) — AI model provider for Mari.
- Google LLC — Google Analytics 4 and Google Ads measurement and advertising.
- Meta Platforms, Inc. — Meta Pixel for advertising measurement and audiences.
- Email and productivity providers (for example Google Workspace) that we use to run our business.
- Professional advisers (accountants, lawyers, insurers) as needed.
- Authorities, when required by law, subpoena or court order, or to protect the rights, safety and property of our guests, staff or others.
- A buyer or successor, if our business or the hotel is sold, merged or reorganized.
Service providers process information only on our instructions, except Google, Meta and OTAs, which also use information under their own privacy policies.
6. How long we keep information
| Information | Retention |
|---|---|
| Mari chat conversations | Deleted automatically after 30 days |
| Hashed IP used for rate-limiting | No more than 24 hours |
| Inquiry / lead form submissions | As long as needed to respond and assist with your stay, then deleted 12 months |
| Booking, billing and guest registration records | As long as required for tax, accounting and legal purposes up to 7 years |
| Newsletter email | Until you unsubscribe, plus a short suppression record so we don't email you again |
| General correspondence | Up to 3 years |
| Analytics data | GA4 retention setting 14 months |
| Advertising cookies | See cookie table (typically 90 days to 2 years) |
7. Security
We use reasonable administrative, technical and physical safeguards, including encrypted (HTTPS) connections, restricted access, automatic deletion of chat logs and automatic removal of card-like numbers from chats. Payments are handled by the booking engine and its PCI-compliant processors. No system is completely secure. If a security breach affects your personal information, we will notify you and the authorities as required by law, including Puerto Rico law.
8. Children
Our Site and chat are intended for adults planning travel and are not directed to children under 13 (or under 16 in the EU/UK). We do not knowingly collect personal information from children online. Children may stay at the hotel with a parent or guardian, who provides any information we need about them. If you believe a child has given us personal information, contact resi@pddkllc.com and we will delete it.
9. Your rights and choices
Everyone can: - Ask what we hold about you and get a copy; - Ask us to correct or delete it (subject to records we must keep by law); - Unsubscribe from La Carta at any time; - Manage cookies through "Cookie settings" on the Site or in your browser; - Use the Site without the chat.
EU, EEA and UK visitors also have the right to restrict or object to processing (including direct marketing), to data portability, to withdraw consent at any time (without affecting earlier processing), and to complain to your local data protection authority.
California residents (and residents of other U.S. states with similar laws) may have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising; to limit use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell personal information for money. To opt out of advertising cookies, click "Reject non-essential" in our banner or use "Cookie settings"; we also honor Global Privacy Control (GPC) browser signals as an opt-out. You may use an authorized agent.
How to make a request: email resi@pddkllc.com with the subject "Privacy request". Tell us what you want and give us enough detail to find your information (for chats, include the Session ID shown under "Chat details", or the approximate date and something you wrote; for bookings, the reservation number). We may need to verify your identity before acting. We aim to respond within 30 days (and in any case within the time the law allows, e.g. 45 days under California law). If we decline a request, we will explain why and how you can appeal by replying to our response.
10. International transfers
We are based in Puerto Rico (United States), and our service providers are mainly in the United States. If you are visiting from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK Addendum, or a provider's certification under the EU-U.S. Data Privacy Framework.
11. Cookies and similar technologies
Cookies are small files stored in your browser. We use these categories:
- Strictly necessary — required for the Site, chat and booking engine to work and to remember your cookie choices. Always on.
- Analytics — Google Analytics 4 helps us understand how visitors use the Site (pages viewed, clicks on "Book"). Only with your consent where required.
- Advertising — Google Ads and the Meta Pixel measure the results of our ads and let us show ads to people who visited the Site. Only with your consent where required.
We use Google Consent Mode so that Google tags respect your choices.
How to opt out: - Click "Cookie settings" in the Site footer at any time to change your choices. - Block or delete cookies in your browser settings. - Enable Global Privacy Control in your browser. - Google: adssettings.google.com and the Google Analytics opt-out add-on (tools.google.com/dlpage/gaoptout). - Meta: your Facebook/Instagram "Ad preferences". - Industry tools: optout.aboutads.info and youronlinechoices.eu.
The Mari chat uses your browser's session storage (not a cookie) to hold a random session ID and the current conversation while your tab is open; it is cleared when you close the tab or start a new chat.
The cookie table below lists names and durations.
Cookie table
| Name / pattern | Provider | Category | Purpose | Duration | Status |
|---|---|---|---|---|---|
mare_consent (name TBD) |
Stay at Mare | Strictly necessary | Stores your cookie choices | 6–12 months | Guess (to be created by the banner) |
mari.sid, mari.conv |
Stay at Mare (Mari chat) | Strictly necessary | Random chat session ID and current conversation. Session storage, not a cookie | Until tab closes / new chat | Confirmed in site JS |
nf_* / Netlify edge cookies |
Netlify | Strictly necessary | Hosting, security, load balancing | Session | Likely (may not be set at all) |
Booking-engine cookies (e.g. session, __cf_bm, currency/language) |
SiteMinder / direct-book.com | Strictly necessary | Run the booking and payment flow on direct-book.com (set on their domain, not ours) | Session to 1 year | Likely |
_ga |
Google Analytics 4 | Analytics | Distinguishes users | 2 years | Likely |
_ga_<container-id> |
Google Analytics 4 | Analytics | Maintains session state | 2 years | Likely |
_gcl_au |
Google Ads | Advertising | Ad conversion measurement (conversion linker) | 90 days | Likely |
_gcl_aw, _gcl_dc, _gcl_gb |
Google Ads | Advertising | Stores ad-click information for conversions | 90 days | Likely |
IDE, test_cookie, NID |
Google (doubleclick.net / google.com) | Advertising | Ad serving and remarketing (third-party) | Up to 13 months | Likely |
_fbp |
Meta | Advertising | Identifies browsers for ad delivery and measurement | 90 days | Likely |
_fbc |
Meta | Advertising | Stores the last Facebook ad click ID (fbclid) | 90 days | Likely |
fr |
Meta (facebook.com) | Advertising | Ad delivery and measurement (third-party) | 90 days | Likely |
Names marked "Likely" are standard for these tools and will be confirmed once installed.
12. Links to other sites
Our Site links to sites we don't control, including the booking engine at direct-book.com, Instagram, Google Maps and our restaurant partners. Their privacy practices are governed by their own policies.
13. Changes to this policy
We may update this policy from time to time. We will post the new version here and change the "Last updated" date. If changes are significant, we will give more prominent notice (for example, a banner on the Site or an email to subscribers).
14. Contact
PDDK LLC / Stay at Mare 59 Calle Taft, San Juan, Puerto Rico 00911 Privacy requests and questions: resi@pddkllc.com