Privacy Policy — Villa Copa

Effective date: September 15, 2026
Last updated: September 4, 2026

---

1. Who we are

Vi Vacation Rental LLC operates villacopa.com, a luxury villa rental in St. John, US Virgin Islands. In this policy "we", "us" and "our" mean Vi Vacation Rental LLC.

This policy explains what personal information we collect when you use the site, why, who receives it, how long we keep it, and what rights you have. It covers this website and our email marketing and booking correspondence. It does not cover other websites we link to.

Address: 150 Davenport Road, Big Flats, New York 14814, United States
Privacy contact: hello@villacopa.com

2. How consent works on this site

We do not treat every visitor the same way, because the law does not.

• In California and Quebec, we ask before switching on analytics, advertising or session recording. Nothing in those categories runs until you choose. Change your mind at any time using Cookie preferences in the footer.
• Elsewhere in the United States and Canada, analytics and advertising run by default and you can switch them off at any time using Do Not Sell or Share My Personal Information .
• Everywhere, we honour the Global Privacy Control (GPC) signal automatically. If your browser sends GPC, we treat it as an instruction to stop selling and sharing your personal information. You need do nothing else.

Strictly necessary technologies — the ones that make the site and checkout work — always run. They do not track you across other websites.

3. What we collect (notice at collection)

Category	Examples	Why	Sold or shared?	Kept for
Identifiers	Name, email, phone, postal address, IP address, device and cookie IDs	Responding to enquiries, managing bookings, marketing, fraud prevention	Shared for cross-context behavioural advertising	Bookings: 7 years. Enquiries that do not become bookings: 24 months.
Booking and stay information	Travel dates, number and names of guests, special requests you send us, payment method type and last four digits	Arranging and servicing your stay, accounting	No	7 years from the stay
Internet or network activity	Pages viewed, referrer, clicks, time on page, device and browser, approximate location from IP	Site performance, analytics, ad measurement	Shared for cross-context behavioural advertising	14 months
Session recordings	A replay of movement, scrolling, clicks and typing during your visit	Finding usability problems and errors in the enquiry and booking flow	No	90 days
Geolocation	Approximate city, region and country from your IP address. We do not collect precise GPS location.	Fraud prevention and applying the right privacy settings for your region	No	14 months
Inferences	Travel preferences and audience segments drawn from the above	Personalising our marketing	Shared for cross-context behavioural advertising	24 months

Where it comes from. Directly from you when you send an enquiry, make a booking, subscribe or contact us; automatically from your device through the technologies in Section 4; and sometimes from our advertising and analytics partners.

Sensitive personal information. We do not collect sensitive personal information to infer characteristics about you. Payment details and login credentials are handled by our payment processor and platform only to complete your transaction and secure your account — permitted business purposes under California law. Because we do not use sensitive personal information beyond those purposes, we do not offer a "Limit the Use of My Sensitive Personal Information" option and are not required to.

Age. We do not knowingly collect personal information from anyone under 16. See Section 8.

4. Cookies, pixels and other technologies

The tables below name every third party that receives data from your visit. We update them whenever we add or remove a vendor.

Always on — strictly necessary

Vendor / technology	What it does	Data it receives	Category	How to turn it off
Shopify (platform)	Runs the site: sessions, cart, checkout, fraud prevention, load balancing.	IP address, device and browser data, pages viewed, cart and order contents.	Strictly necessary	Cannot be disabled — the site does not function without it.
Google reCAPTCHA	Protects our enquiry forms from automated abuse.	IP address, browser and device signals, and how you interact with the form.	Strictly necessary	Cannot be disabled — it protects the forms from spam.

Session recording — Microsoft Clarity

We use Microsoft Clarity to record how visitors use the site — mouse movement, scrolling, clicks and typing in form fields. This produces a replay of your visit that we use to find usability problems and errors. Microsoft acts as an independent controller of this data; its practices are at https://privacy.microsoft.com/privacystatement.

We ask permission before this starts in California and Quebec, and it does not run there unless you agree. Elsewhere it runs by default and you can switch it off through Cookie preferences or the Do Not Sell or Share link.

In every location: all text you type is masked before it leaves your browser, and checkout and account pages are excluded from recording entirely.

Because this site's forms collect enquiry and booking details, we have configured recording to mask every field in those forms.

Vendor / technology	What it does	Data it receives	Category	How to turn it off
Microsoft Clarity	Records a replay of your visit — movement, scrolling, clicks, typing (text masked).	Pages viewed, interaction events, masked form input, IP address, device and browser.	Session recording	Cookie preferences, or the Do Not Sell or Share link.

Analytics

Vendor / technology	What it does	Data it receives	Category	How to turn it off
Google Analytics (via Google Tag Manager)	Measures traffic and how people move through the site.	Pages viewed, referrer, approximate location from IP, device and browser, a random analytics ID.	Analytics	Cookie preferences, or Google's own opt-out add-on.

Advertising and marketing

These involve sharing personal information for cross-context behavioural advertising. Section 2 explains how to switch them off.

Vendor / technology	What it does	Data it receives	Category	How to turn it off
Google Ads (via Google Tag Manager)	Conversion measurement and remarketing.	Pages and products viewed, conversion values, device and browser data.	Advertising — sharing	Do Not Sell or Share link, or Google's ad settings.

What we do not use

This site does not run a Meta or TikTok pixel, an SMS marketing platform, a live chat widget, or any visitor-identification or email-deanonymisation service. If we add any of these we will update this policy and the consent controls before switching them on.

Shopify's own cookies. The platform sets cookies including _ab, _secure_session_id, cart, checkout_token, _shopify_s and _shopify_y to keep your session working and to produce aggregate statistics. Shopify's practices are at https://www.shopify.com/legal/privacy.

5. Selling and sharing

We would rather be blunt here than vague.

We share personal information for cross-context behavioural advertising. The advertising technologies in Section 4 receive identifiers and information about what you viewed and did, and use it to show you our ads elsewhere and measure whether they worked. Under California and several other state privacy laws this counts as "sharing", and some of it may count as a "sale" — even though no money changes hands for your data.

We do not sell personal information for money. We do not hand your name, email address, postal address or phone number to third parties for their own marketing.

We have not sold or shared the personal information of anyone we know to be under 16.

To stop it: Do Not Sell or Share My Personal Information, send GPC from your browser, or — in California and Quebec — decline advertising when we ask.

6. Your rights

Anyone, anywhere

• Switch off advertising and data sharing — the Do Not Sell or Share or Cookie preferences links in the footer.
• Stop marketing email — the unsubscribe link in any email.
• Stop marketing SMS — reply STOP to any message.
• Access, correct, or delete what we hold — email hello@villacopa.com.

United States

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia have some or all of these rights:

• Know / access what we hold, where we got it, why, and who we disclosed it to
• Delete personal information we hold about you
• Correct anything inaccurate
• Portability — a copy in a portable, machine-readable format
• Opt out of sale, sharing, targeted advertising, and profiling with legal or similarly significant effects
• Non-discrimination — exercising a right will never cost you a worse price or service
• Appeal — if we say no, you may appeal; we respond within the period your state allows and tell you how to complain to your Attorney General

Rights vary between states. We apply the broadest set we reasonably can to everyone.

California. You also have the right to know the categories collected, the sources, the business purposes and the categories of third parties — Sections 3, 4 and 5 set all of that out. You may use an authorised agent; we will ask for proof of authority and may ask you to verify your identity directly.

Canada

You may ask for access to your personal information and ask us to correct it, and withdraw consent to marketing at any time. Our commercial electronic messages comply with Canada's Anti-Spam Legislation (CASL): we send them only with consent and every message identifies us and carries a working unsubscribe.

Quebec. Technologies that identify, locate or profile you are off by default here. We ask before enabling them and you can change your answer at any time through Cookie preferences. You also have the right to request we stop disseminating your personal information, and the right to data portability.

Making a request

Email hello@villacopa.com with "Privacy Request" in the subject line, or use the contact form at villacopa.com/pages/contact. We acknowledge within 10 business days and respond within 45 days, extending once by a further 45 days if the request is complex — we will tell you if that happens. We verify identity by matching the email address or booking reference you give us against our records.

7. Who else receives information

Beyond the vendors in Section 4:

• Service providers working for us under contract — our platform, payment processors, booking and property management services, email and SMS providers, support tools and hosting. They may only use the information to provide their service to us.
• Professional advisers — accountants, auditors, lawyers, where needed.
• Authorities — where legally required, or to establish or defend legal claims, or to protect people or property.
• A buyer or successor — if the business is sold, merged or reorganised, personal information may transfer with it.

8. Children and teenagers

This site is for adults. We do not knowingly collect personal information from children under 13, we do not knowingly sell or share the personal information of anyone under 16, and we do not target advertising at anyone we know or reasonably should know is under 18.

If you believe a child has given us personal information, email hello@villacopa.com and we will delete it.

9. How long we keep things

Information	Kept for
Booking and stay records	7 years from the stay, for tax and accounting
Enquiries that do not become bookings	24 months
Marketing email and SMS lists	Until you unsubscribe, then 12 months, so we can honour the opt-out
Session recordings	90 days
Guest correspondence	3 years from the last message
Analytics and advertising identifiers	14 months
Server and security logs	90 days
Records of privacy requests	2 years, as the law requires

Where a legal obligation or an open dispute requires us to keep something longer, we keep only what that purpose needs.

10. Security

The site runs on Shopify, which holds PCI DSS Level 1 certification for payment handling. Traffic is encrypted in transit using TLS. Access to personal information is limited to people who need it for their work. No system is perfectly secure and we will not pretend otherwise, but if a breach affects your personal information we will notify you and the relevant regulators as the law requires.

11. Changes

We update this policy when our practices change, including whenever we add or remove a vendor from Section 4. The "last updated" date shows when it last changed. If we make a material change to how we use personal information, we will give notice on the site before it takes effect.

12. Contact

Vi Vacation Rental LLC
150 Davenport Road, Big Flats, New York 14814, United States
Email: hello@villacopa.com Contact form: villacopa.com/pages/contact Website: villacopa.com

Unhappy with our response? You may complain to your state Attorney General. In Canada, to the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec if you are in Quebec.

---

Configuration this policy assumes

For the Bower/client team — delete this section before pasting into Shopify.

1. The current policy claims something the site does not do — fix this first. The live policy states: "Our website also recognizes the Global Privacy Control (GPC) signal…we will treat such signal as a valid request to opt out of sharing / targeted advertising." Checked live: Shopify reports saleOfDataRegion: false for a US visitor, meaning no sale-of-data opt-out region is configured and GPC is not being honoured. The "Your Privacy Choices" page the policy points to returns 404 at every standard path. This is not an omission like the other stores — it is an affirmative statement of compliance that is not true, which invites a deceptive-practices theory on top of the privacy claim. Either switch on the opt-out page and regions today, or pull the sentence until you do. Switching it on is the better answer and takes minutes.
2. The Customer Privacy API is not even loaded on this store — unlike the other six, it had to be requested manually. Whatever consent work happens here starts from zero.
3. Clarity is consent-gated, masking set to mask all form fields, and the tag removed from any booking or payment step. This matters more here than on the retail stores: enquiry forms carry names, travel dates, guest counts and free-text requests, and a replay of someone typing those is the strongest version of the §631 "contents" allegation across this whole portfolio.
4. Cookie banner enabled for California and Quebec only.
5. Data sale/sharing opt-out page live for the full US state list, link in the footer, plus a Cookie preferences link.
6. Email deanonymisation / visitor identification tools: do not add one here. These resolve anonymous visitors to real email addresses and are among the most heavily litigated categories in this wave — adding one to a site that already has an unfixed GPC misstatement would be the worst-case combination. Section 4 currently states that no such service is in use; keep that true, and if the client insists on evaluating one, do it only with counsel and behind prior opt-in.
7. CASL. Marketing to Canadian recipients needs express or valid implied consent, sender identification and a working unsubscribe. Section 6 states we comply — confirm the email platform is actually configured that way.
8. Guest data beyond the website. This policy covers the website. If bookings are also taken through Airbnb, VRBO or a property manager, confirm whether guest data flows from those channels need covering here or in a separate notice.