What we actually collect
Here is what we hold. Some of it you fill in; some is recorded automatically when you use the site or Aria.
- Cardinal Club signup — your name, email, ZIP code, and whether you have stayed before.
- Questions and inquiry forms — your name, email, dates you are considering, and whatever you write to us.
- Saved weekend plans — the stops you picked and the email address the link is sent to.
- Chats with Aria, our on-site guide — your questions and Aria's answers, stored with a conversation identifier, timestamps and browser information. Messages are processed by an AI service to write replies. Don't include sensitive personal details in a chat; you don't need to identify yourself to use it.
- Recorded automatically — technical and activity records such as anonymous usage events, page-speed measurements, short-lived hosting request logs (including IP address), abuse-prevention records that use a hashed IP address, and a one-hour place-hours cookie with a random visitor identifier. Details are in our Privacy Policy.
We do not ask for payment card numbers, government IDs, or Social Security numbers on this site. Please do not include them in forms or chats.
How it is protected
- Encrypted in transit. The site is HTTPS-only, with strict transport security so browsers won't fall back to an insecure connection.
- Locked-down storage. Guest submissions live in a managed database where every table denies access by default. Reading them requires an owner-authenticated session; the public website key cannot retrieve them.
- Owner-only tools. The behind-the-scenes pages that show inquiries and subscribers are gated by sign-in, and the checks run on the server — not just hidden in the page.
- Unguessable links. Share links for saved plans and chat sessions use cryptographically random identifiers, so someone can't guess their way into another guest's plan.
- Spam and abuse controls. Forms are rate-limited and use a challenge whose answer stays encrypted on the server, so automated submissions can't flood us with junk.
- Routine checking. An automated review runs weekly across site security headers, data-access rules, and software dependencies, and alerts us to anything new.
No website can promise perfect security, and we won't pretend otherwise. What we can say is that we keep the collected data minimal, closed by default, and reviewed on a schedule.
Who else touches your information
A short list of vendors runs parts of the site — hosting and the database, email delivery for confirmations and Cardinal Club notes, and Google Maps for the Area Guide. Reservations and payments are handled entirely by the booking channel youused for your reservation under its own policies. New bookings are through Vrbo. The full list is in our privacy policy.
Found a problem? Tell us.
If you notice something that looks like a security or privacy issue, email hello@visitcardinalhouse.com with what you saw and how to reproduce it. We read every message and will confirm that we received yours. Please don't test in ways that could disrupt the site or reach other guests' information.
For anything else, the contact page is the fastest way to reach us, and the privacy policy has the formal detail behind this summary.
This page is maintained by the owners of Cardinal House to answer common security and privacy questions. It describes our own practices and is not a certification, audit result, or independent verification by any third party.
Owned by The Joanne M Kearns Living Trust · Legal correspondence (mailing only): 3903 Northdale Blvd., Suite 100E, Tampa, FL 33624, USA
