Privacy

Last updated 14 October 2026

Holdfast Holdings LLC, trading as Holdfast Stays, runs this website. We are based in Fort Lauderdale, Florida. This page explains what happens to information you give us here, in plain terms.

What this covers, and what it does not

This policy covers this website, including booking and paying for a stay on it. It does not cover a stay you book on Airbnb, Vrbo, Booking.com or another platform, or on Guesty's own booking site; each of those handles your information under its own policy. It also does not cover the separate agreement you would sign if we came to manage your property.

What we collect

Three things: what you type into the inquiry form or the revenue estimator, what you give us when you book a stay, and anonymous visitor counts, all described below. From the form, depending on which option you choose, that is your name, email address, phone number if you give one, and either the address of a property you want managed or the house you want to book, plus anything you write in the notes field.

From the revenue estimator, it is your first name, email address and phone number if you give one, together with the town, location and bedroom count you picked and the estimate shown for them. It also notes the page, the campaign tags in the web address you arrived on (the utm_ part, if there is one) and the website that linked you there, if any, and keeps a copy of the follow-up sentence shown under the form, with a version number. We use it so Pierce can follow up about your home.

Three things travel with it that you do not type. The form notes which page you sent it from, and it keeps a copy of the consent sentence shown above the Send button, with a version number, so there is a record of exactly what you agreed to. When the submission arrives, Netlify records the time along with technical details such as the IP address and browser it came from. The form also carries a hidden field that people never see and never fill in; it exists only to catch automated spam.

When you book a stay. The booking page asks for your first and last name, email address and phone number, and it already knows the house, dates and number of guests you picked. We pass these to Guesty, our property management system, which creates and holds your reservation. We also record that you ticked the box agreeing to the terms, and when.

Your card details never reach us. The card number, expiry date, security code, name on the card and billing address are typed into secure fields run by GuestyPay, Guesty's payment service, not by this site. GuestyPay and its card processing partner handle them, and your bank may ask you to confirm the payment. What comes back to us is a reference to the payment and whether it went through.

To stop automated card fraud, the booking page runs a check from Cloudflare before you can pay, and our server counts payment attempts from each IP address so it can refuse a burst of them. Those counts are deleted within a day. If your bank asks you to confirm a payment, we keep a reference to the booking and the payment for up to six hours, only so that dates you did not finish paying for can be released.

This site has no accounts and no login. We set no cookies and run no advertising trackers. The card fields and the Cloudflare check on the booking page run inside frames supplied by GuestyPay and Cloudflare, and those may use their own cookies or similar storage for security and fraud prevention. They are not used to advertise to you.

Visitor counts. Since 28 September 2026 we use Cloudflare Web Analytics to count visits: which pages are viewed, roughly where visitors come from, what kind of device and browser they use, and how quickly pages load. It sets no cookies, stores nothing in your browser, and does not build a profile of you or follow you to other sites. We see totals, not individuals. We turned it on so we can tell whether the site is doing its job, and for nothing else.

One thing is stored in your browser rather than sent to us: the Guesty search box saves its own settings in your browser's local storage so it does not have to fetch them again. It holds no personal information, it never reaches us, and clearing your browser data removes it.

What we do with it

We use it to answer you, and to carry on that conversation if it turns into a booking or a management agreement. When you book, we use your details to take payment, run your reservation, contact you about your stay, give refunds, keep the records tax law requires, and deal with fraud or a dispute about the payment. That is the whole purpose.

We do not sell your information, we do not rent it, and we do not hand it to anyone for advertising.

Who else touches it

These are the outside companies involved in running this site. We would rather name them than describe them vaguely:

• Netlify hosts the site and receives your inquiry. Form submissions are stored in our Netlify account. Netlify screens every submission for spam, and its spam filter is run by Akismet, so the contents of the form pass through Akismet as part of that check. Netlify also keeps ordinary server logs, which include visitor IP addresses.
• Google Fonts serves the typefaces the site is set in. Loading a font means your browser contacts Google, which receives your IP address in the process. It sets no cookies.
• Guesty is our property management system. When you book on this site, your name, email address, phone number and stay details go to Guesty, which holds the reservation. The photographs of the houses load from Guesty's servers, the search box on the home page is a Guesty widget whose code is served from Amazon Web Services on Guesty's behalf, and for a few houses the booking button hands you over to Guesty's booking site entirely. Loading any of these means your browser contacts Guesty or Amazon, which receive your IP address in the process.
• GuestyPay, Guesty's payment service, and its card processing partner take the payment. Your card details and billing address go to them directly from secure fields on the booking page, and they handle them under their own security and privacy rules.
• Travel insurance. If you add travel insurance when you book, the details needed to issue the plan, such as your name, contact details, stay dates and trip cost, go through Guesty to the insurer, Travel Guardian, and its partner InsureStays, which handle them under their own privacy rules.
• Resend sends the automatic email that confirms we received your inquiry, so your name, email address and a short recap of what you sent pass through it.
• Google Workspace carries our email. When we reply to you, the reply goes through Google, and it is the backup route for the automatic confirmation if Resend is unavailable.
• Cloudflare answers the domain lookups for holdfastfl.com, and provides the visitor counts described above. A small script on each page reports the visit to Cloudflare, which receives your IP address in the process but does not use it to identify you or keep it with the counts. On the booking page, Cloudflare also runs the check that tells people from automated scripts, which looks at signals from your browser and receives your IP address. Your visit to the site itself does not pass through Cloudflare, and it never sees what you type into the inquiry form or the booking form.

Our use of AI

We use AI tools in the business, and it is fairer to say so than to leave you to guess. What that means for this page is narrow and worth stating plainly: nothing you submit through the inquiry form or the booking form on this site is fed to an AI system to make a decision about you, and no AI decides anything about your property or your booking on its own.

How long we keep it

We keep inquiries for as long as it takes to answer them. If nothing comes of it, we clear them out within about two years, because there is no reason for us to hold onto them. Where the conversation turns into a booking or a management agreement, the records that go with that relationship are kept for as long as tax and business record rules require, which in Florida runs to several years after the relationship ends. A booking made on this site is such a record, and so is the payment reference that goes with it. You can ask us to delete anything at any point, and we will delete whatever the law does not require us to keep.

Asking us to show you or delete what we hold

Email info@holdfastfl.com and ask. You can ask us to:

• tell you what we hold about you, where it came from and who we have shared it with, and send you a copy in a form you can take elsewhere;
• correct anything that is wrong or out of date;
• delete it, apart from records the law requires us to keep, such as those that go with a paid booking;
• stop using it for anything beyond running a booking you have made, or stop contacting you.

You do not need to cite a law or live in a particular state; we will simply do it, usually within thirty days, and we may ask you to confirm who you are first so we do not hand your details to someone else. We do not sell or share your information for advertising, so there is nothing to opt out of there. Asking will never change the price you pay or how we treat you. If your state or country gives you a formal right here, this is how you exercise it.

Children

This site is meant for adults arranging a stay or a management relationship, and you must be 18 or over to book a stay on it. We do not knowingly collect information from children under 18. If you think a child has sent us something, tell us and we will delete it.

Security

The site is served over HTTPS and submissions sit in an access controlled Netlify account. Card details are entered into GuestyPay's secure fields and never pass through or stay on our systems. We will not pretend that is a guarantee: no site can promise perfect security, and you should not send anything sensitive through a web form. Send us documents by email or another route we agree with you.

Changes

If we change this, we change the date at the top. If the change is material, we will make that plain rather than quietly editing a line. The most recent material change: on 14 October 2026 we added booking and paying for a stay on this site, with GuestyPay and the Cloudflare check described above. Before that, on 28 September 2026, we added Cloudflare Web Analytics.

Contact

Holdfast Holdings LLC, Fort Lauderdale, Florida. info@holdfastfl.com