VeriStay helps local governments (cities, towns and counties, which we call jurisdictions) find short-term rentals that operate without the registration or license they require. This policy explains what information we handle, why, and who we share it with.

Two kinds of information

  • Information we handle for jurisdictions. Rental listings, registration and property records, identified addresses, evidence and compliance letters. We handle this on behalf of the jurisdiction we work for, under its instructions and its contract with us. The jurisdiction decides how it's used for enforcement.
  • Information about people who use VeriStay. Account details, messages, support requests, security logs, and anything sent through our website. For this, VeriStay decides how it's used, as described below.

What we collect

From public rental listings

For each jurisdiction we work with, we collect publicly available listings from rental sites such as Airbnb and Vacasa: the listing page, title, description, photos, approximate map location, price and availability, the host's display name and profile ID, and guest reviews (the reviewer's first name, the date and the review text). We keep dated copies of listing pages as evidence of what was advertised.

From jurisdictions

Registration or license records, county property and parcel records (which can include owner names and mailing addresses), and jurisdiction boundary files.

What we produce

The address and parcel we identify for each listing, the evidence behind it (such as screenshots matching listing photos to a property), whether the rental appears registered, and compliance letters the jurisdiction sends to owners or operators, which include the name and mailing address they're sent to.

From people with a VeriStay account

Your name, email address and username; your password, which we store only in a hashed (scrambled) form; anything you add to your profile, such as a phone number, address or photo; and the messages, support requests, attachments and notes you create in VeriStay.

Security logs

When someone signs in, fails to sign in, signs out or requests an API key, we record the time, the username entered, the IP address and the browser's description of itself (its user agent). We use these to protect accounts and investigate misuse.

From our website

  • Contact form: your name, email address and message, which are emailed to our team.
  • Complaint form (where a jurisdiction uses it): the rental's address or listing link, when the problem happened, a description, an optional photo, and your name, email and phone number. Complaints go to the jurisdiction concerned.
  • Online evidence links: when someone opens a report through the link and access code printed on it, we count the views and record when it was last opened. Too many wrong access codes lock the link for a while.

Cookies

We use only the cookies the site needs to work: one that keeps you signed in, and one that protects forms from being submitted by other websites. We don't use advertising or analytics cookies, and we don't track you across other sites. Our forms use Cloudflare Turnstile to block automated spam, which may set its own cookie for that purpose.

How we use it

  • To provide our service to jurisdictions: identifying rentals, checking them against registration records and preparing evidence and letters.
  • To run accounts, answer support requests and contact messages, and send notices about the service.
  • To keep VeriStay secure and to find and fix problems.

We don't sell personal information, and we don't use it for advertising.

Who we share it with

  • The jurisdiction the information belongs to, and the people it authorizes. That includes anyone it gives a report's online evidence link and access code to, such as the recipient of a compliance letter.
  • Service providers that run parts of VeriStay for us, only as needed:
    • DigitalOcean: hosting, database and file storage, in the United States
    • Google: email delivery, and maps and address lookups
    • Cloudflare: spam protection on our forms
    • Oxylabs: network services used to collect public listing pages
    • Map providers (Esri, OpenFreeMap and OpenStreetMap): your browser loads map images from them, so they see your IP address
  • When the law requires it, or to protect the rights and safety of VeriStay, our users or the public.

Where it's kept, and for how long

Information is stored in the United States. We keep a jurisdiction's information for as long as we provide our service to it. When that ends, the jurisdiction can ask us to return or delete it. Account information is kept while the account is open. We keep security logs for as long as they're useful for protecting accounts.

Your choices

  • If you own or operate a rental and have questions about a listing, a letter or a record, contact the jurisdiction that sent it: the records are theirs, and they decide on enforcement. You can also write to us and we'll pass your request to them.
  • If you have a VeriStay account, you can update your profile at any time, and ask us to delete your account.
  • Depending on where you live, you may have the right to ask for a copy of your information, or to have it corrected or deleted. Email us and we'll respond, or refer you to the jurisdiction if the information is theirs.

Security

We protect information with encrypted connections, access limited by role and jurisdiction, private file storage and logging of sign-in activity. See Security for details.

Children

VeriStay is a service for local governments and isn't meant for children. We don't knowingly collect information from children.

Changes

If we change this policy, we'll update the date at the top of this page, and tell account holders about significant changes.

Contact

Questions about privacy: [email protected] or (513) 202-6331.