Privacy policy.

Overview

This policy explains what information Cardinal House — operated by Mountain Lake Property Group, LLC, 8735 Dunwoody Place, Ste N, Atlanta, GA 30350, USA (referred to here as "we," "us," and "our") — collects when you visit visitcardinalhouse.com or interact with our forms and emails, how we use that information, and the choices you have. The cabin is a privately owned short-term rental in Blue Ridge, Georgia.

Information you give us

We collect what you voluntarily provide through forms on this site — primarily the Cardinal Club signup:

• First and last name
• Email address
• ZIP or postal code (where you are traveling from)
• Whether you have stayed at the cabin before
• Anything you write in a message, feedback, or accessibility report you send us

We do not collect payment information on this site. All reservations and payments are handled by the booking channel you choose (Casago, VRBO, or Airbnb) on their own platforms under their own privacy policies.

Using Aria, our AI concierge

When you use Aria, your messages and recent conversation history are processed through Lovable’s AI service using a Google AI model to generate a reply. You do not need to provide your name or email to ask a question. Please avoid entering payment details, passwords, identity documents, medical information, or other sensitive information about yourself or anyone else.

We store your questions and Aria’s answers with a conversation identifier, timestamps, and browser information. We also store answer-quality checks and conversation activity, such as topics and use of follow-up features, to diagnose problems and improve the service. Abuse-prevention records may include an identifier derived from an IP address and a sample of a flagged message. These conversation records may identify you if you include personal details; they are separate from the general interaction analytics described below.

Authorized owner tools can display conversations and related requests for help. If you ask the owner to follow up, the name, email address, question, and recent conversation context you submit are stored and sent to the owner through our email service. If you request an emailed recap, your email address and optional first name are linked to that conversation, and the recap is sent through our email service. Delivery, opens, and link clicks may be recorded for these recap emails.

Aria’s browser storage

Aria stores a conversation identifier in your browser to support returning visits for up to 30 days. It also keeps up to 40 recent displayed messages in browser storage; this local message cache expires after one day, with expiration checked when it is loaded. Clearing your browser’s site data removes that browser’s stored information. It does not delete conversation records already stored on our servers or held by service providers.

Information collected automatically

To keep the site working well we record a limited amount of technical data:

• Interaction analytics — anonymous events such as which outbound links, filters, and map controls are used, so we can improve the experience. These records do not include your name, email, or IP address.
• Performance metrics — page load timings and Core Web Vitals (LCP, CLS, INP) sampled from real visits, used to catch slow pages.
• Server request logs — our hosting provider keeps short-lived request logs (IP address, user agent, timestamp) for security, abuse prevention, and troubleshooting.
• Place hours — when you open a place's hours, we set a session cookie holding a random visitor identifier for up to one hour. Our server keeps request-limiting counters keyed to that identifier and to a hashed form of your IP address, to stop repeated requests.

We do not set advertising cookies or share data with ad networks. Your accessibility preferences (text size, contrast, motion) are stored only in your own browser via localStorage and never sent to us.

How we use it

• Send Cardinal Club members their discount code and marketing emails about the cabin — open dates, seasonal timing, offers, and local events. Every one includes a one-click unsubscribe.
• Respond to questions, feedback, and support requests.
• Understand which pages, links, and features are actually helpful, so we can improve them.
• Keep the site secure and diagnose bugs and performance issues.
• Comply with legal obligations when required.

Third-party services we use

We rely on a small number of vendors to run the site. Each one handles data under its own privacy policy:

• Lovable Cloud — hosts the site, database, and serverless functions where your Cardinal Club signup is stored.
• Google Maps & Places — powers the Area Guide map. Google may set its own cookies and collect device and location signals when the map loads. See Google's privacy policy.
• Email delivery — welcome emails and route update notifications are sent through a transactional email provider on our behalf.
• Booking channels — Casago, VRBO, and Airbnb host the actual reservation and payment. When you click "Check availability" you leave our site and their policies apply.
• AI processing: Lovable’s AI gateway and the configured Google AI model process conversation information to generate Aria’s replies. Lovable’s hosting and database services also support storage and operation of the concierge. Provider handling and retention are separate from the browser-storage periods above.

We do not sell, rent, or trade your personal information, and we do not share it with third parties for their marketing.

How long we keep it

Cardinal Club information is kept for as long as you want to stay on the list. Analytics and performance records are retained in aggregate for up to 24 months. You can ask us to delete your information at any time (see "Your rights" below), and we will remove it except where we are required to keep records for legal or tax reasons.

The browser-storage periods described above apply only to information stored in your browser. They do not establish a deletion deadline for server-side Aria conversations, related support requests, quality checks, or service-provider records. The analytics and performance retention period stated above is not a retention promise for Aria conversations. For questions about stored conversations, or to exercise the rights described below, contact hello@visitcardinalhouse.com. We may need details to locate and verify the relevant records.

Your rights

Depending on where you live you may have the right to:

• Access the information we hold about you.
• Correct information that is wrong or out of date.
• Delete your information.
• Opt out of marketing emails at any time — every email includes an unsubscribe link, you can manage your choices on our email preferences page, and you can also reply and ask us to remove you.
• Ask us not to "sell" or "share" your information for cross-context advertising. We do not do either of these; the right is preserved for California, Virginia, Colorado, Connecticut, Utah, and other US state residents who ask.

To exercise any of these rights, email hello@visitcardinalhouse.com. We aim to respond within 30 days.

Text messages (SMS)

If you text us, or give us your mobile number and agree to be texted, we use it for conversational, stay-related messages — answering your question, confirming arrival details, or sharing property information for a booked stay. If you separately opt in to promotional texts, we may also send occasional offers, open dates, and Cardinal Club news. Consenting to texts is never a condition of booking. Message frequency varies, and message and data rates may apply. Reply STOP to opt out at any time, or HELP for assistance.

Mobile phone numbers and SMS consent are never sold, rented, or shared with third parties or affiliates for their own marketing purposes. A number is shared only with the messaging provider that delivers the message on our behalf. Full program details are on our text message terms page.

Children's privacy

This site is intended for adults planning travel. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact us and we will delete it.

Security

Data is stored in our managed backend with transport encryption (HTTPS) and access controls (row-level security, least-privilege service roles). No online service can be 100% secure, but we work continuously to protect the information you share.

Changes to this policy

We may update this policy from time to time as the site or our practices change. The "Last updated" date at the top of this page will always reflect the most recent revision. Material changes will be highlighted here for a reasonable period after they take effect.

Contact

Questions about this policy or how your information is handled? Reach us at hello@visitcardinalhouse.com.

Mountain Lake Property Group, LLC · 8735 Dunwoody Place, Ste N, Atlanta, GA 30350, USA