Mystic River Inn® Privacy Policy

Effective Date: January 1, 2026

Governing Entities: Mystic River Inn LLC & iUgo Vacation Rentals LLC

Premises Location: 3 Gravel St, Mystic, CT 06355 At Mystic River Inn®, accessible at www.mysticriverinn.com and booking.mysticriverinn.com, your privacy is a top priority. Mystic River Inn® is a registered trademark of Mystic River Inn LLC, operating in partnership with iUgo Vacation Rentals LLC ("Host," "we," "us," or "our"). This Privacy Policy outlines the types of personal information we collect, how we use and share it across our hospitality technology partners (including Hostaway, Stripe, SafelyStay, and Google Analytics), and the rights available to you under the Connecticut Data Privacy Act (CTDPA), the Connecticut Data Protection Act (Conn. Gen. Stat. § 42-471), the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and Payment Card Industry Data Security Standards (PCI DSS). By using our website or booking a stay with us, you consent to the practices described in this policy. Summary of Data Categories, Processors & Retention Booking, Contact & Smart-Lock Access Logs: Processed via Hostaway for reservation management, guest communications, check-in verification, and proof of stay; retained for up to 7 years for tax, accounting, and contract compliance. Payment & Billing Tokenization: Processed via Stripe (PCI DSS Level 1) for the $1.00 validation hold, reservation billing, security deposit soft holds, and post-stay damage mandates; retained for 90 days post-departure for active mandates and 7 years for tax invoices. Government ID & Biometric Selfie Comparison: Processed via Stripe Identity & SafelyStay, Inc. for automated identity matching and fraud prevention prior to check-in; never stored on Host local servers and purged per partner security schedules. Background Check & Risk Score ("Safely Score"): Processed via SafelyStay, Inc. ("Safely") for watchlist/criminal screening, booking eligibility, and property damage reporting; managed under SafelyStay's certified retention schedule. Technical & Browsing Analytics: Processed via Hostaway & Google Analytics for session state maintenance, booking calendar functionality, and site analytics; retained for up to 26 months or until browser cookies are cleared. 1. Information We Collect

We collect personal, verification, and technical information necessary to provide, secure, and manage our boutique lodging services: A. Personal & Reservation Information (via Hostaway) Booking & Contact Details: Full name, email address, telephone number, physical mailing address, and names/headcounts of accompanying guests. Reservation & Stay Data: Travel dates, unit assigned, accommodation preferences, special requests, guest portal interactions, and time-stamped electronic smart-lock access logs used to verify check-in/check-out and property security. Communications: Emails, SMS/text messages, third-party platform messages (e.g., Airbnb/VRBO relays), attachments, and customer support inquiries managed through Hostaway. B. Payment & Financial Information (via Stripe) Payment Data: Credit or debit card details, billing addresses, and transaction histories. All payment card data is tokenized and processed directly by our PCI DSS Level 1 certified processor, Stripe. We do not store your full credit card numbers on our local servers. Please note that transactions processed for your reservation will appear on your credit card or bank statement under the billing descriptor "MYSTIC RIVER INN" or "IUGO CO". C. Identity Verification, Biometric & Screening Data (via Stripe Identity & SafelyStay, Inc.) Government ID & Biometric Facial Matching: To prevent fraud and protect guest safety, guests are required to submit an image of a government-issued photo ID and a real-time facial selfie scan. Our certified verification partners (Stripe Identity and/or SafelyStay, Inc.) use automated facial geometry comparison technology (biometric data) solely to verify identity. Explicit affirmative consent for biometric processing is obtained via a dedicated opt-in prompt prior to image submission, in full compliance with CTDPA, GDPR, and CCPA standards. Background Screening & Risk Scores: SafelyStay, Inc. ("Safely") processes your name, address, date of birth, and contact details to check public criminal/watchlist databases and generate an automated risk assessment ("Safely Score") to determine booking eligibility. Storage Limitation: Encrypted government ID images and biometric selfie comparisons are processed exclusively by Stripe Identity and SafelyStay; they are never stored on Mystic River Inn LLC or iUgo Vacation Rentals LLC local servers, nor are they sold or retained indefinitely by our partners. D. Technical & Website Information Device & Browsing Data: IP address, browser type, operating system, referring URLs, pages visited, booking paths, and interaction data collected via cookies and analytics tools. 2. How We Use Your Information

We use the information collected strictly for legitimate hospitality and business operations: Reservation & Property Management: To process bookings, synchronize calendars, send automated pre-arrival instructions/door codes, and manage guest communications through Hostaway. Payment & Post-Stay Processing: To validate payment methods ($1.00 hold), process scheduled reservation balances, manage security deposit soft holds, and process authorized post-stay charges or dispute evidence via Stripe. Trust, Safety & Fraud Prevention: To verify guest identity, conduct background screenings, prevent fraudulent bookings or chargebacks, and enforce our Short-Term Rental Agreement and Terms and Conditions via Stripe Identity and SafelyStay. Legal & Tax Compliance: To calculate, collect, and remit Connecticut Room Occupancy Taxes and comply with municipal, state, and federal laws. Marketing (Opt-In Only): To send promotional offers or newsletters only where you have explicitly opted in (with the ability to unsubscribe at any time). 3. Data Sharing and Disclosure

We do not sell your personal information for monetary consideration. We share your personal data only in the following operational and legal circumstances: Hostaway: Our central property management system (PMS) that hosts reservation records, guest portal links, and communication workflows. Stripe & Stripe Identity: For PCI-compliant payment tokenization, billing, chargeback resolution, and automated government ID/selfie identity verification. SafelyStay, Inc. ("Safely"): For pre-stay background screening, watchlist checks, risk scoring ("Safely Score"), and post-stay incident reporting. If a guest causes verified property damage, violates core safety rules, or initiates an invalid dispute during their stay, relevant incident data may be reported back to Safely, which may affect the guest's eligibility to book other properties utilizing Safely's network. Financial Institutions (Dispute Resolution): If you initiate a credit card chargeback or payment dispute, we share your signed Short-Term Rental Agreement, itemized invoices, communications, photographic evidence, and time-stamped smart-lock entry logs with Stripe and your issuing bank to prove service delivery. Legal & Tax Authorities: To comply with valid subpoenas, law enforcement requests, court orders, or tax audits from the Connecticut Department of Revenue Services or municipal authorities. Business Transfers: In connection with any merger, financing, acquisition, or sale of assets involving Mystic River Inn LLC or iUgo Vacation Rentals LLC. 4. Cookies and Tracking Technologies

We use essential, functional, and analytical cookies, pixels, and web beacons on our website and booking engine. You can manage cookie preferences at any time via our Cookie Preference Banner or browser settings: Maintain your session state and remember your selected check-in/check-out dates in the Hostaway booking engine. Analyze website performance and visitor traffic via Google Analytics. Deliver relevant advertising and measure marketing effectiveness.

You can adjust your browser settings to refuse cookies or recognize Global Privacy Control (GPC) opt-out signals where applicable, though disabling functional cookies may prevent the booking engine from operating properly. 5. Data Retention

We retain your personal information only as long as reasonably necessary to fulfill the purposes outlined in this Privacy Policy: Financial & Tax Records: Reservation invoices, tax records, and executed Short-Term Rental Agreements are retained for up to seven (7) years to comply with Connecticut Department of Revenue Services and IRS audit requirements. Post-Stay Charge Authorization Window: Tokenized payment mandates via Stripe are retained for at least ninety (90) days post-departure (and through the conclusion of any active chargeback window) in accordance with the Short-Term Rental Agreement. Identity Verification Data: Government ID images and selfie verification data processed by Stripe Identity or Safely are retained and purged according to their respective certified security schedules and are never downloaded onto our local systems. 6. Data Security & Connecticut Safeguarding Compliance

In compliance with Connecticut's Data Protection Act (Conn. Gen. Stat. § 42-471), Mystic River Inn LLC and iUgo Vacation Rentals LLC maintain robust technical, administrative, and physical safeguards. These measures include TLS 1.3 encryption in transit, AES-256 encryption at rest, PCI DSS Level 1 tokenization via Stripe, strict role-based access control, and routine vulnerability assessments. In the event of a confirmed data breach involving personal information (under Conn. Gen. Stat. § 36a-701b, GDPR Article 33, or CCPA), affected individuals and regulatory authorities (including the Connecticut Attorney General) will be notified without unreasonable delay and within 72 hours where required by applicable law. 7. Your Privacy Rights

Depending on your jurisdiction of residence, you have specific statutory rights regarding your personal information: A. Connecticut Residents (Connecticut Data Privacy Act — CTDPA)

Under the CTDPA (Conn. Gen. Stat. § 42-515 et seq.), to the extent applicable, Connecticut residents have the right to: Access & Confirm: Confirm whether we are processing your personal data and access such data. Correction: Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of processing. Deletion: Request deletion of personal data provided by or obtained about you (subject to statutory exceptions, such as maintaining tax records, completing a transaction you requested, or defending legal/chargeback claims). Data Portability: Obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format. Opt-Out Rights (Targeted Advertising, Sales, & Profiling): Opt out of the processing of personal data for purposes of: (a) targeted advertising, (b) the sale of personal data, or (c) automated profiling in furtherance of solely automated decisions that produce legal or similarly significant effects (such as automated guest screening via Safely). Note: If you opt out of mandatory identity verification or fraud screening prior to check-in, we may be unable to complete your reservation unless manual verification is approved by management. Consent for Sensitive Data: Under the CTDPA, precise geolocation, biometric data (such as facial mapping for ID verification), and government-issued ID numbers are considered "Sensitive Data" and are only processed with your explicit affirmative consent provided at the time of booking/verification. CTDPA Response & Appeal Process: We will respond to verifiable consumer requests within 45 days of receipt. If we decline to take action regarding your request, we will inform you of our justification within 45 days. You may appeal our decision by emailing info@mysticriverinn.com with the subject line "CTDPA Privacy Appeal." Within 60 days of receiving an appeal, we will inform you in writing of any action taken or not taken. If your appeal is denied, you have the right to contact the Connecticut Office of the Attorney General (https://portal.ct.gov/AG) to submit a complaint. B. California Consumers (CCPA/CPRA) & Other U.S. State Privacy Laws

Residents of California and other states with comprehensive privacy laws may request disclosures regarding the categories of personal information collected, request deletion or correction, and opt out of data sales or cross-context behavioral advertising without discrimination. C. European Economic Area & UK Residents (GDPR)

If you visit our website or book from the EEA or UK, you have the right to access, rectify, erase, restrict processing, object to processing, and request portability of your personal data. We respond to GDPR requests within 30 days. How to Exercise Your Rights:

To submit a privacy request, please email us at info@mysticriverinn.com or call (860) 365-1120. To protect your privacy and security, we will take reasonable steps to verify your identity (such as matching your email address, phone number, and reservation confirmation number) before fulfilling your request. 8. Children's Privacy

Our website and hospitality booking services are strictly intended for adults aged 18 and older. We do not knowingly collect personal information from children under the age of 18 (or under 13 as governed by COPPA) without parental consent. If you believe a minor has submitted personal data to us without authorization, please contact us immediately at info@mysticriverinn.com so we may purge the data. 9. Third-Party Service Providers

Our booking flow relies on trusted third-party technology platforms that maintain their own independent privacy policies and compliance frameworks. We encourage you to review the official privacy policies of our core service providers: Hostaway (Property Management & Booking Engine): https://www.hostaway.com/privacy-policy/ Stripe (Payment Processing & Stripe Identity): https://stripe.com/privacy SafelyStay, Inc. (Guest Screening & Identity Verification): https://www.safely.com/privacy-policy/ Google Analytics (Website Traffic Analysis): https://policies.google.com/privacy 10. International Data Transfers

Mystic River Inn® operates exclusively within the State of Connecticut, United States. If you access our website from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your home jurisdiction. 11. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our hospitality software, operational practices, or Connecticut/federal legal requirements. If we make material changes, we will update the "Effective Date" at the top of this page and post the revised policy on our website and booking portal. 12. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us at: Entities: Mystic River Inn LLC & iUgo Vacation Rentals LLC Email: info@mysticriverinn.com Phone: (860) 365-1120 Property Location: 3 Gravel St, Mystic, CT 06355 Mailing Address: iUgo Vacation Rentals LLC, 26 New London Rd, Salem, CT 06420