FreshSun Privacy Policy

Who we are and what this policy covers

Merendon Cloud, LLC (“we”, “us”, “FreshSun”) is the data controller for FreshSun. We operate the Sites at freshsun.co and freshsun.app. This Privacy Policy explains how we collect, use, store, share, and retain personal data when you visit or use FreshSun. Read it with the Terms of Service.

The product and this Policy are worldwide. Anyone may visit, subject to local law. Our first operating pilot is in Central America — Guatemala, El Salvador, Belize, Honduras, Nicaragua, Costa Rica, and Panama. We expect to serve visitors in the European Union and other regions; this Policy is written for that coverage now.

The Sites are operated from the United States (1111B S Governors Ave, Suite 54122, Dover, DE 19904, United States). We have not appointed a separate Data Protection Officer. We have not appointed an EU or UK Article 27 representative. Privacy questions go to privacy@freshsun.co or contact@freshsun.co.

Information we collect

What we store depends on how you use FreshSun. Browsing a public stay does not require an account. Hosts who list a stay create one.

• Newsletter subscriptions — if you separately request FreshSun updates, we store your email address, language, the version of the newsletter consent wording, confirmation and unsubscribe status and times, and request and delivery records. We also use signed confirmation and unsubscribe links. You do not need a host account to subscribe.
• Email address — required to request a sign-in code and to receive host mail (review notes, teammate invites, and material policy-change notices).
• Hashed one-time password (OTP) — we store a hash of the six-digit code, not the code in the clear. Codes expire in about 10 minutes.
• Session cookie better-auth.session_token — set by Better Auth when you sign in, so we know it is you on later requests.
• Session IP address and user agent — Better Auth stores these on the session record.
• Host, listing, and media data — host display name, listing copy, location fields, booking URLs, photos, view and click counts, plan label, team membership, and whether you later opt in to promotional AI.
• Policy acknowledgment records — which Terms and Privacy versions you were shown and acknowledged, the time, hashes of those texts, and the account or host action that recorded it. That record is evidence of notice and contractual assent, not GDPR consent to optional processing.
• Locale cookie freshsun-locale — remembers whether you last used English or Spanish so a bare link can send you back to that language. The URL, not the cookie, decides what a page renders.
• Teammate email — if a host admin invites someone who already has a FreshSun account.
• Reports you send us — for example a message about a listing or alleged infringement.

Vercel, as our host, also receives ordinary request data (IP address, user agent, URL, approximate location derived by the platform) in server logs. We do not ask guests for a name, payment card, or government ID today. If paid host products launch, a payment processor will handle card data; we would receive limited billing metadata and update this Policy.

Cookies and similar technologies

We prefer a short cookie list. Today we use cookies only where they are needed for the Sites to work or to remember a language choice:

• better-auth.session_token — strictly necessary for a signed-in host session. It lasts about 7 days under Better Auth’s default (we do not override session length) and is refreshed while you keep using the Sites. It is a first-party cookie. The matching session record may store IP address and user-agent so we can secure the account. Signing out clears that session.
• freshsun-locale — functional; remembers English or Spanish for 365 days. You can still switch language from the header. It does not give us extra device access beyond that preference.

Vercel Analytics and Vercel Speed Insights run across the Sites, with newsletter confirmation and unsubscribe pages excluded from analytics and speed reports. They are first-party, cookieless performance and traffic tools (no advertising cookie, no third-party pixel). We also send a few named events (for example a stay view or a click toward a booking site) through that analytics library.

Vercel BotID (basic check) inspects OTP send and verify requests and newsletter subscription requests to reduce automated abuse. It is not a persistent cookie and not an advertising pixel. For newsletter request limits, we store a keyed hash derived from the requesting IP address and the day, with a request count and expiry; we do not store the raw IP address in that newsletter rate-limit record.

We do not load Meta (Facebook), X (Twitter), Google Ads, TikTok, or similar advertising pixels on FreshSun today. If we later add non-essential cookies, we will describe them here and obtain consent where required.

How we use information

• Send a newsletter confirmation email and, only after you confirm your subscription, FreshSun updates you requested. We also record your unsubscribe preference and limit repeated subscription requests.
• Operate the Sites: sign-in codes, sessions, host dashboards, listing review, and public discovery pages.
• Show a stay in English and Spanish and write search titles and descriptions (see AI processing below).
• Send transactional email (codes, review notes, teammate invites, and material policy-change notices).
• Understand how the Sites are used (Vercel Analytics and Speed Insights) so we can fix and improve them.
• Promote a public listing on FreshSun’s own social accounts, under the license in the Terms — not by posting as the host.
• Detect abuse of the OTP endpoints (BotID).
• Record which policy versions you accepted and when.
• Comply with law and protect the Sites, hosts, and visitors.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising today.

Legal bases (GDPR and similar laws)

Agreeing to the Terms records contractual assent; acknowledging this Policy records that you have been informed about our handling of personal information. It is not GDPR consent and it is not consent to optional processing. Mandatory reacceptance of a new version does not turn on promotional AI, marketing email, or extra cookies.

Where the GDPR, UK GDPR, or similar laws apply, we rely on these legal bases:

• Contract — to create and run your account, listings, sign-in, review, and the bilingual Service you asked for, including translation and search copy needed to show a listing in English and Spanish.
• Legitimate interests — security, abuse prevention, product improvement, first-party cookieless analytics, and keeping a record that you were shown and acknowledged a specific policy version (evidence of assent), balanced against your rights.
• Consent — only for optional processing we ask separately: promotional AI on a listing, the newsletter when you separately subscribe and confirm, and cookies that are not strictly necessary if we add them. Those stay off until you opt in. You can unsubscribe through the link in the email or contact us to withdraw consent. Agreeing to the Terms and acknowledging this Policy does not subscribe you to the newsletter.
• Legal obligation — tax, accounting, lawful requests, and records we must keep.

You may withdraw consent where processing is based on consent, without affecting prior lawful processing. Turning off promotional AI does not by itself delete your account or listings, and refusing a new policy version does not force optional processing.

We do not make decisions that produce legal or similarly significant effects based solely on automated processing.

AI processing of listing copy

Listing titles and descriptions may be sent to language-model providers so we can detect the language you wrote in, fix mechanical mistakes, translate between English and Spanish, and generate search titles and descriptions. Place-page introductions may be generated the same way. That translation and search work is part of operating a bilingual site. It can happen whether or not you turn on promotional AI. We do not scrape or copy listings from other sites for this.

Promotional AI is a separate, optional opt-in on the listing. If you turn it on, FreshSun may later create AI-augmented creatives from what you supplied and publish them on FreshSun’s own social accounts or as country- or interest-based campaigns, with a link to the listing page or to FreshSun’s home page. That is not posting as you.

Providers may process the text we send them under their terms. Do not put secrets or special-category data in listing copy. We do not use your listing media to train a FreshSun foundation model.

Our AI Gateway requests use the team-wide Zero Data Retention (ZDR) setting. Vercel restricts those requests to eligible providers under its ZDR arrangements. This does not erase the listing text, translations, or operational metadata FreshSun stores to run the Service.

Who we share information with

We use service providers who process data for us. We do not sell your data to them:

• Neon — database hosting for accounts, sessions, hosts, listings, translations, media records, policy-acceptance records, newsletter subscriptions and newsletter request-limit records.
• Vercel — application hosting, Vercel Blob (listing photos as publicly addressable files), Vercel Analytics, Speed Insights, and BotID.
• Vercel AI Gateway — routes translation and search-copy requests to model providers. We use OpenAI models through Gateway, with inference providers such as Microsoft Azure. Routing may change among eligible providers.
• Resend — sends sign-in codes, host transactional mail, policy-change notices, and newsletter confirmation mail. It receives the recipient email address and the email content, including confirmation and unsubscribe links where relevant.

Those providers may process data in the United States and other countries. Host photos stored for the Sites are typically reachable at public URLs once uploaded. Do not upload a photo you are not willing to display.

When a guest continues to a booking site the host named (Airbnb, Booking.com, Vrbo, or another outbound link), that company is an independent controller of whatever it collects on its pages. FreshSun is not the merchant of record for the stay.

Public recipients: anyone on the internet can see a published listing page, the host display name, and media URLs. That is the point of a discovery directory.

Social recipients: if a listing is mentioned from FreshSun’s own handles, the audience is a country- or interest-based public on that platform, not a named individual. The social network (for example Instagram, Facebook, X, or TikTok) is an independent controller of what it collects when a post is published there.

We may share information if required by law, to protect rights and safety, or in a merger, acquisition, or asset sale of Merendon Cloud, LLC, subject to this Policy or a successor notice.

How long we keep information

We keep personal information only as long as needed for the purposes in this Policy. We use these criteria: whether an account or listing is active; whether we must keep a record to provide the Service or resolve a dispute; legal, tax, and accounting requirements; security and abuse-prevention needs; and the statute of limitations for claims related to the Service.

• OTP hashes expire in about 10 minutes.
• Sessions last until they expire or you sign out.
• Host, listing, and media records last while the listing or account is active, and for a commercially reasonable period after unpublish or deletion so we can restore mistakes or investigate abuse.
• Policy-acceptance evidence — policy version, displayed version, content hashes, time, action, locale, and a hashed account identifier, not your email — is kept for the life of the account. After the account is deleted we keep that minimized hashed evidence for 24 months, then purge it. The live user id is detached on deletion.
• If you ask us to delete your personal data, we aim to complete that request in live systems within 30 days, except the minimized assent evidence above and records we must keep for law, security, or a dispute.
• Encrypted backups held by our processors rotate on those providers’ schedules. We cannot purge every backup the moment you ask; residual copies drop as those backups rotate.

Deleting a listing or a sole-member host account stops new FreshSun uses of that content. Within 30 days we remove or unlabel FreshSun-controlled posts on our own social accounts. Independent copies we do not control (shares, screenshots, platform caches) may remain. If you delete a personal login and other members still run the host, the listings stay with that host.

Newsletter confirmation links expire after 24 hours. Unconfirmed subscription records inactive for more than 30 days and expired newsletter request-limit records are removed when a later subscription request runs cleanup. Confirmed subscription records are kept while you subscribe; after you unsubscribe, we retain your address and unsubscribe record to honor that preference. These subscription and unsubscribe records do not have an automatic expiry today. You may contact privacy@freshsun.co to request erasure, subject to the exceptions described in this Policy. Newsletter preferences are separate from a host account; deleting a host account does not automatically unsubscribe that address.

Your rights

Depending on where you live, you may have the right to access, rectify, erase, restrict, or port your personal information; to object to processing based on legitimate interests; to withdraw consent; and to lodge a complaint with a supervisory authority (for example an EU/EEA data protection authority, the UK ICO, or another competent regulator).

To exercise rights, write to privacy@freshsun.co or contact@freshsun.co from the address on your account when possible. We may need to verify you. We will not charge a fee for routine requests.

You can switch language at any time. You can decline to create an account and still browse public stays. You can delete a listing or a photo from the host dashboard. You can leave promotional AI off.

If you are in a U.S. state with a comprehensive privacy law, we honor applicable rights to know, delete, and correct, and we do not sell or share personal information for cross-context behavioral advertising. We will not discriminate against you for exercising those rights.

Delaware residents: if we deny a privacy request, you may appeal by writing to privacy@freshsun.co and saying it is an appeal. We will respond to an appeal within 60 days. If we deny the appeal, we will tell you how to contact the Delaware Department of Justice. Residents of other U.S. states with an appeal right may use the same path.

Children

FreshSun is not directed to children under 13. You must be at least 18 (or older if local law requires) to create an account or list a stay. If you believe we have collected personal data from a child under 13, write to privacy@freshsun.co and we will delete it.

International transfers and safeguards

FreshSun is U.S.-operated. Merendon Cloud, LLC is organized in Delaware, United States (1111B S Governors Ave, Suite 54122, Dover, DE 19904, United States). If you access the Sites from the EU/EEA, UK, or another region, your information is transferred to the United States and may be processed in other countries where our providers operate. Those countries may not provide the same legal protections as your home country.

Our Vercel Pro service is within the scope of Vercel’s Data Processing Addendum, incorporated by its service terms. The DPA includes Standard Contractual Clauses and UK transfer provisions where applicable. Gateway also operates under Vercel’s AI Product Terms, which refer to upstream provider terms. These Vercel provisions do not describe every provider’s arrangements.

For information about the safeguards applicable to a transfer of your data, including how to obtain a copy, contact privacy@freshsun.co or contact@freshsun.co.

Changes to this policy

We may change this Privacy Policy. We will post the update on this page and change the date and version at the top.

If a change is material (for example a new category of personal information, a new purpose that is not reasonably expected, a new category of recipients, or a change to your rights), we will email the address on your account and require a fresh acceptance — agreement to the current Terms and acknowledgment of this Policy — before you continue host actions. Email notice plus that fresh acceptance are both required — continued use alone is not enough. Until you acknowledge, some host features may be blocked. That gate does not enroll you in optional promotional AI, marketing, or extra cookies.

Non-material edits (clarifications, contact details, formatting) may be posted on this page and apply when posted.

Contact