Sojourn API Privacy Policy.

Last updated and effective: May 1, 2026

This Privacy Policy explains how Sojourn API, LLC (“Sojourn,” “we,” “us,” or “our”) collects, uses, and protects information submitted through sojournapi.com (the “Site”). The Site is our marketing and partner-information website. It is not our booking platform. Bookings and the associated handling of guest, supplier, and payment information are governed by a separate privacy policy at portal.sojournapi.com — please refer to that policy if you are a guest, supplier, or agent participating in a booking.

Data Controller. For the purposes of the EU/UK General Data Protection Regulation and other applicable data-protection laws, Sojourn API, LLC, with its principal place of business at 500 East 77th Street, Suite 225, New York, NY 10075, is the Data Controller responsible for the processing described in this Policy. Sojourn has not appointed an EU representative under Article 27 or a Data Protection Officer; data-subject inquiries should be directed to the contact in Section 12.

If you have questions about this policy, contact us at support@sojournapi.com or by mail at the address above.

1. Scope

This policy applies to information you provide or that we collect when you visit sojournapi.com or one of its subpaths. It covers:

• The General contact form on /contact.html and embedded on other pages.
• The Property-manager onboarding form at /onboard.html, used by prospective property managers to apply to join Sojourn’s distribution channel.
• Server-side request logs captured automatically when you access the Site.

It does not apply to: bookings, payments, or any activity on portal.sojournapi.com; emails you send us directly (other than to acknowledge that we retain them per Section 6); or interactions with our partners’ own websites.

2. Information we collect

2.1 Contact form

When you submit the general contact form on the Site, we collect:

• The inquiry type you selected (general, partnerships, support, etc.).
• Your name.
• Your company name and role, if provided.
• Your email address.
• Your phone number, if provided.
• The message you typed.

We also automatically record the IP address the submission was sent from and the submission timestamp.

2.2 Property-manager onboarding form

If you apply to become a Sojourn property-manager partner through /onboard.html, you provide a substantially larger set of information needed to evaluate and onboard your business. Specifically:

• Company and contact details: legal company name, primary URL, channel-manager identifier, and the names, titles, emails, and phone numbers of your accounting, reservations, business-relations, and after-hours emergency contacts.
• Commercial terms you propose for the relationship: rate structure (commission or net), payment terms, cancellation policy, deposit/insurance requirements, marketing-consent preference, and any geographic or inventory exclusions.
• Operational scope: the primary geographic markets where you have properties, an approximate count of units you manage, and an attestation that those properties comply with applicable short-term-rental registration, licensing, zoning, occupancy-tax, and consumer-protection laws.
• Banking details for payments from Sojourn: vendor and bank name, address, account and routing or IBAN/SWIFT numbers, and an ACH or wire authorization. We treat these as the most sensitive class of data; see Section 5.
• A U.S. IRS W-9 form (for U.S.-based companies) or a W-8 BEN / BEN-E (for non-U.S.-based companies), uploaded as a PDF. We treat these as tax records; see Section 5.
• Signer information evidencing your acceptance of Sojourn’s Listing Agreement: your typed name, title, an affirmation that you have authority to bind your entity, the agreement version you accepted, the timestamp, and your IP address at signature.
• An acknowledgment that you have read and agree to this Privacy Policy and the Sojourn Website Terms of Use.

We do not require, and do not knowingly collect, government-issued ID documents, dates of birth, or background-check information through the Site. (Those may be required separately if you become an active partner via the booking portal.)

2.3 Server-side request logs

When you submit a form on the Site, our infrastructure records standard request metadata for operational, debugging, and security-monitoring purposes. We capture only the following.

For every form-submission request:

• The IP address the request was sent from.
• The timestamp of the request.
• The request path and HTTP method (e.g. POST /onboard/submit).
• The HTTP response status code returned.
• Response latency.
• A request identifier generated by our API gateway for internal correlation, and for admin-area requests, the result of the Cognito authentication check.

Additionally, while processing a form submission, our Lambda functions record a small set of operational fields:

• A submission identifier (a randomly-generated UUID).
• The submission status (one of: awaiting upload, awaiting scan, submitted, quarantined).
• The type of tax form you selected (W-9 or W-8).
• The name of the channel manager you identified.
• The name of the operation being performed (e.g., submit_received, scan_clean, finalize_submitted).
• For errors, an error class and code.

We do not include any other submitted form-field values in these logs. Every log line is filtered through a strict allow-list of the fields above before it is written; we audited the entire log corpus on May 21, 2026 and confirmed no other submitted data appears anywhere.

Static-asset requests to the Site (loading pages, images, CSS, JavaScript) are not logged on the server side; we do not operate a content-delivery access-log.

2.4 What we do not collect on the Site

• No third-party analytics. The Site does not use Google Analytics, Google Tag Manager, Facebook Pixel, Hotjar, Mixpanel, Segment, or any similar product. The only JavaScript loaded by the Site is its own first-party code, used to operate the navigation menu and submit forms.
• No cookies set by the Site. We do not set tracking cookies, advertising cookies, or persistent identifiers in your browser. Your browser may still set its own cookies for unrelated reasons; that is outside Sojourn’s control.
• No social-media pixels or remarketing tags.
• No location services. We do not request your device location.
• No payment instruments. The Site does not process credit cards, debit cards, or other payment-instrument numbers. (For property-manager partners, the bank account / routing or IBAN/SWIFT information you submit through the onboarding form is for receiving payments from Sojourn, not for charging you.)

3. How we use the information

We use the information you provide for the limited purposes described below. We do not sell, rent, or trade your personal information.

We do not use Site-submitted information to send unsolicited marketing or to target advertising to you. If we add an opt-in email subscription in the future, we will obtain your explicit consent before doing so.

4. Who sees the information

Information you submit through the Site is visible to:

• A small number of authorized Sojourn employees and contractors (“operators”) whose role requires access to PM applications, contact-form messages, or operational systems. Operators are organized across two access tiers, each authenticated with multi-factor authentication and a per-action audit log.
• Our subprocessors, who provide infrastructure on our behalf and have no independent right to use your data:
  • Amazon Web Services, Inc. (“AWS”), or equivalent — hosting, storage, encryption, and supporting infrastructure, located in the United States. AWS is bound by its standard data-processing addendum and EU Standard Contractual Clauses where applicable.
  • SocketLabs, Inc., or equivalent — outbound email delivery (notifications when a PM submission is received). SocketLabs sees the email subject line, recipient address, and sender domain; it does not see the PM’s submitted form content.
• Recipients you specifically authorize. For example, if you submit your tax form, we may share it with U.S. tax authorities if required by law.
• Law-enforcement authorities or courts, only when required by valid legal process — for example, a properly issued subpoena — and only the specific information the process requires.

Sojourn may from time to time add, replace, or remove subprocessors. We will keep the list above current, or provide an equivalent disclosure of subprocessor identities.

We do not share Site-submitted information with any third party for marketing, advertising, profiling, or any purpose other than those listed above.

5. How we protect the information

All Site traffic is encrypted in transit using HTTPS (TLS 1.2 or higher). The Site’s TLS configuration enforces secure ciphers; non-HTTPS access is rejected at the load balancer.

For data at rest, our protections vary by sensitivity tier:

• Contact-form submissions are stored with AWS-managed server-side encryption (SSE-S3) and access-restricted to authorized operators.
• PM onboarding-form fields other than banking and tax are stored in Amazon DynamoDB with server-side encryption using an AWS-managed KMS customer-managed key.
• Banking details are subject to additional envelope encryption: each PM’s banking record is encrypted with a per-submission AES-256-GCM data key, which is itself encrypted with our KMS customer-managed key. The data key is cryptographically bound to the submission identifier so that decrypting one PM’s banking record does not allow access to any other PM’s. Decryption requires a privileged operator action that is recorded in an immutable audit log.
• Tax forms (W-9 / W-8 PDFs) are stored in Amazon S3 with SSE-KMS encryption using the same customer-managed key, and require a privileged operator action to retrieve.

All access by our operators is gated behind MFA-protected sign-in, restricted by role-based access tiers, and recorded in an audit log retained for seven years.

Sojourn may from time to time change the providers, services, or technologies used to secure your information. Any such change will use equivalent or stronger protections than those described above.

Despite these protections, no method of internet transmission or electronic storage is 100% secure. If we become aware of a security incident affecting your information, we will notify you in accordance with applicable law.

6. How long we keep the information

Our retention windows are set to the minimum period needed for the relevant purpose:

• Contact-form submissions: retained for up to 3 years from the date of submission, or shorter on request.
• PM onboarding-form fields (identity, commercial terms, contacts): 7 years following the end of any commercial relationship, to support tax, audit, and dispute-resolution obligations.
• Banking details (encrypted): retained for 1 year following the last settlement with you, then permanently deleted.
• Tax forms (W-9 / W-8): retained for 4 years per IRS Publication 583, then permanently deleted.
• Audit logs and access records: 7 years, kept immutable.
• Server-side request logs: rolling 90-day window, then permanently deleted.

If you ask us to delete your information (see Section 7), we will honor your request promptly except for records we are required by law to retain (most commonly the tax form, which IRS rules require us to keep for the 4-year window above).

7. Your rights

You may, by contacting us at the address in Section 12:

• Access — request a copy of the information we hold about you.
• Correct — ask us to fix information that is inaccurate or incomplete.
• Delete — ask us to delete information about you, subject to the legal-retention exceptions in Section 6.
• Withdraw consent — where we are relying on your consent to process your information, you may withdraw it at any time. (Most of our Site processing relies on the performance of a contract or compliance with a legal obligation rather than consent, so this right applies primarily to any optional marketing-email subscription you opt in to — withdrawing consent will stop those emails but will not unwind processing on those other bases.)
• Object — object to our processing of your information that is based on our legitimate interest. We will stop unless we can demonstrate compelling legitimate grounds that override your objection. (For Sojourn, the principal legitimate-interest processing is our server-side request logging used for security monitoring and fraud detection under Section 2.3 — that is the activity this right applies to.)
• Restrict — ask us to limit how we use your information in specified circumstances.
• Portability — request a copy of the information you provided to us in a structured, machine-readable format, where technically feasible.
• Lodge a complaint with a data-protection authority in your jurisdiction. In the U.S., the California Privacy Protection Agency has jurisdiction over California residents.

We will respond to verifiable requests within 30 days (or such shorter period as applicable law requires). We may ask you to confirm your identity before acting on a request.

8. US State Privacy Rights

Residents of U.S. states with applicable consumer-privacy laws — including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), Tennessee (TIPA), Utah (UCPA), and others — have the rights described in Section 7. The applicability of any particular state’s law depends on Sojourn’s data-processing volume and revenue thresholds in that state, but the rights we extend in Section 7 are available to all U.S. residents regardless.

• We do not sell or share your personal information for cross-context behavioral advertising. We have no advertising on the Site.
• We do not discriminate against you for exercising any right described in this Policy.
• The categories of personal information we collect, the categories of sources, the business purposes, and the categories of third parties with whom we share are described in Sections 2, 3, and 4 respectively.

California residents may additionally exercise the right to request the categories of personal information we have collected, sold (we do not), or disclosed about them in the prior 12 months. We do not collect or use “sensitive personal information” as defined by the CPRA in a manner that would trigger the “limit use” right.

9. International transfers

Sojourn operates the Site from infrastructure located in the United States. If you submit information from outside the United States, that information is transferred to and stored in the United States. We rely on Amazon Web Services’ EU Standard Contractual Clauses and other appropriate safeguards under applicable data-protection law for transfers from the European Economic Area, the United Kingdom, and Switzerland.

If you would like additional information about the safeguards in place, contact us at the address in Section 12.

10. Children

The Site is not directed to children, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with information through the Site, please contact us; we will delete the information.

11. Changes to this Policy

We may update this Policy from time to time. If the update materially changes how we use your information, we will provide notice on the Site and, if appropriate, by email. Any such notice — whether posted on the Site or sent by email — constitutes an amendment to this Policy and takes effect on the date the updated Policy is published, without requiring any further confirmation from us. The “Last updated” date at the top of this Policy always reflects the current version. Continued use of the Site after the effective date of an update constitutes your acceptance of the changes.

Revision history

The current version of the Policy is the one published above. This log records the dates of prior revisions and a summary of what changed in each. The complete text of any prior version is available on request — contact us at the address in Section 12.

12. Contact

Questions about this Policy, requests to exercise any right under it, or any other privacy-related inquiry:

• Email: support@sojournapi.com
• Mail: Sojourn API, LLC, 500 East 77th Street, Suite 225, New York, NY 10075

For privacy questions related to the booking portal, please use the contact information in the privacy policy at portal.sojournapi.com.