Privacy Policy
Effective August 8, 2026 · Version privacy-2026-10-04-draft-2
The proposed data controller is Courtesy of Culture, at 1732 Pryor Rd, Atlanta, GA 30315. This draft must not be published until that identity is confirmed.
Information collected
Depending on how you use the site, we process account identifiers and profile details supplied by the authentication provider; waitlist contact, school, interest, location, referral, and consent information; membership status and billing dates; Stripe customer, subscription, Checkout Session, Price, invoice, charge, refund, and event identifiers; support communications; delivery status and suppression events; and housing-page or booking-handoff context.
Payments
Stripe processes full payment-card details. The application does not intentionally store full card numbers or security codes. It stores payment-related identifiers and subscription state needed to fulfill and manage membership. Review Stripe’s privacy notice.
Waitlist and marketing
Waitlist marketing is sent only after affirmative consent. Consent is separate from required contract acceptance. Promotional messages include an unsubscribe mechanism. Unsubscribing stops promotional updates but does not block essential security, account, billing, or membership-fulfillment messages.
Providers and disclosures
The service uses ChatGPT/Sites authentication and hosting, Cloudflare-hosted storage, Stripe for membership billing, and Resend for transactional email. Student & Intern Housing pages may later hand off to an identified reservation operator using Lodgify. Lodgify’s role is booking software; the housing reservation company must be identified as [HOUSING RESERVATION COMPANY — OWNER TO CONFIRM] before a reservation handoff is enabled. Review Lodgify’s privacy notice. No production analytics provider is currently connected; local browser events do not establish a live analytics service.
Purposes
We use information to authenticate accounts, operate the waitlist, process and fulfill membership, determine access, prevent duplicate fulfillment, provide billing controls, send requested or essential messages, keep delivery and consent records, secure the service, respond to support requests, and meet legal obligations.
Housing information
Pop Up Dorms does not currently process a housing reservation in this application. Information entered after an external handoff is governed by the identified operator’s and Lodgify’s notices. Demonstration inquiry forms do not send requests. [DATA-SHARING DETAILS REQUIRE OPERATOR CONFIRMATION.]
Member connections and messaging
We store connection status, conversation participants, text messages, read or unread state, block records, safety reports, limited report evidence, moderation actions, and in-app notifications to operate approved-connection messaging and enforce safety controls. Private email addresses, phone numbers, payment identifiers, and internal staff notes are not displayed in member conversations. Messages use account and participant access controls, but we do not claim that they are end-to-end encrypted.
Messaging choices and safety records
Archiving or hiding changes your inbox view and does not delete the other participant’s copy or the underlying service record. Blocking stops future messaging but does not automatically erase prior messages. Reports are private from normal members, and the product does not disclose the reporter’s identity to the reported member. Authorized reviewers may access only the report and relevant interaction evidence needed for safety, support, legal, or operational work.
Retention and security
We use access controls, signature verification, deduplication, and server-only credentials, but no system can be guaranteed secure. Ordinary messages remain in the service while the conversation and account records are needed to operate messaging, resolve disputes, protect the service, or meet legal obligations. A final automatic deletion schedule has not yet been approved. Archiving or hiding a conversation removes it from your default view. It does not delete the message record for the other participant or from Pop Up Dorms systems. Messages attached to a safety report may be preserved separately from ordinary conversation visibility while the report is unresolved and afterward when reasonably needed for safety, appeals, disputes, fraud prevention, or legal obligations. A deletion request may not remove records that must be retained for an unresolved safety report, security, fraud prevention, a legal hold, or another legal obligation. Other category-specific retention periods and deletion automation still require owner and attorney approval.
Cookies and local technology
Authentication and third-party checkout may use cookies or similar technology. The current application uses browser storage for device-local demonstration preferences and does not treat it as authoritative account data. [A COOKIE INVENTORY AND JURISDICTION REVIEW ARE REQUIRED BEFORE ADDING ANALYTICS OR ADVERTISING.]
Optional conversion analytics
After optional consent, the application may store a random anonymous visitor ID, landing path, referrer host, campaign source, medium, campaign, page type, stable housing property ID, and a limited conversion-event history in first-party storage. When you authenticate, that anonymous journey may be linked to the opaque internal user ID. We do not use raw email, name, phone, full address, card data, credentials, support-message contents, or housing documents as analytics identifiers or properties. Optional browser events are suppressed when consent is declined and when supported Do Not Track or Global Privacy Control signals are present. No session replay or advertising pixel is enabled. Recommended optional-event retention is 13 months; production deletion automation must be configured before analytics launch.
Your choices
Use the email unsubscribe link for marketing. To request access, correction, deletion, or information about your data, contact support@popupdorm.com. Rights vary by location; no state-specific or international rights are promised until customer jurisdictions are confirmed.
Changes
Material changes should receive an updated effective date and version and, where required, notice or renewed consent.