Lotustay Exchange · Membership
Privacy Policy (Membership)
Effective Date: September 16, 2026
Operator: Lotustay Inc. · Contact: tommymai@tmaifinancial.com
Effective upon Member acceptance (click-wrap)
Not legal advice. These terms bind when a Member accepts membership; waitlist soft-launch alone does not create membership.
The live waitlist Privacy Policy (Privacy_Policy_Lotustay_Exchange_PUBLISH.md) remains the public waitlist document for non-member waitlist visitors. This Membership Privacy Policy is a separate document for membership-stage features and applies to Members upon acceptance.
Operator: Lotustay Inc.
Club / Platform: Lotustay Exchange (lotustayexchange.com / lotustay.exchange) (the “Site” / “Club”)
Related brand: Lotustay.com (vacation-home lodging brand; Exchange Rules do not control Lotustay.com product terms except where Operator expressly enables Lotus$ application)
Effective Date: September 16, 2026
Last updated: September 16, 2026
Contact: tommymai@tmaifinancial.com
EFFECTIVE UPON MEMBERSHIP ACCEPTANCE
Preamble. Membership opens on a referral / invitation basis. This Privacy Policy (Membership) describes how Lotustay Inc. (“Operator,” “we,” “us,” or “our”) collects, uses, and shares personal information in connection with Lotustay Exchange membership—including accounts, listings, Member-to-Member trades, Lotus$ ledger activity, identity verification (KYC), club-sponsored meditation verification, referrals/invitations, and related club communications. It binds when a prospective Member accepts it by click-wrap (or other affirmative acceptance) together with the Member / Club Rules and Ledger Terms.
Waitlist ≠ membership. Joining the public waitlist does not create membership. Waitlist visitors remain under the live waitlist Privacy Policy until they become Members through referral acceptance and membership onboarding.
Feature gates. Feature gates (including Lotustay.com Lotus$ lodging application, Operator hubs, and Lotus Path numeric perks) activate only when Operator publishes enablement schedules; related processing described herein applies when those features are enabled.
1. Scope
1.1 This Policy covers personal information processed for membership and trading-era features of Lotustay Exchange.
1.2 Formspree / waitlist carryover. If you joined via the waitlist (including through Formspree or similar form tools), Operator may carry forward your name, email, and related waitlist records into membership onboarding so you need not re-enter basic contact details—subject to this Policy and membership acceptance. Waitlist data already collected remains governed by the waitlist Privacy Policy until merged into a membership account or deleted as requested/required.
1.3 This Policy does not replace Lotustay.com’s own privacy practices for Lotustay.com product activity, except where Operator processes Exchange-related data for Lotus$ lodging application when that program is enabled.
1.4 Member-facing docs do not list owner/manager names or EIN.
2. Information We Collect
2.1 Account and profile
| Category | Examples |
|---|---|
| Identifiers / contact | Name, email, phone (if provided), username/handle |
| Account credentials | Password hashes or auth tokens (as implemented); login metadata |
| Profile | Bio, city/region, photo, Lotus Path level display, referral/invitation codes |
| Preferences | Notification settings, category interests |
2.2 Listings, trades, and Lotus$ ledger
| Category | Examples |
|---|---|
| Listings | Offer text, photos, categories, Lotus$ amounts, local/hub/shipping preferences |
| Trades | Counterparty identifiers, status, timestamps, trade-related messages, Settled flags |
| Ledger | Lotus$ balances, earn/spend entries, adjustments, holds, dormancy/closure events |
| Meditation / Path | Attendance verification status; Path progression inputs Operator records |
2.3 KYC / identity verification
Operator default until changed: Operator may require identity verification before the Member’s first Settled trade, before Lotus$ application toward Lotustay.com lodging (when enabled), or at volume or category thresholds Operator publishes. This Policy does not invent specific numeric thresholds.
| Category | Examples |
|---|---|
| Identity | Government ID image or data, date of birth, address proof, selfie/liveness (if a vendor is used) |
| Screening | Verification or sanctions-screening status codes from vendors |
2.4 Meditation / Zoom verification
For club-sponsored meditation earn (Members only):
- Qualifying attendance is verified through live Zoom video while Members meditate together.
- Operator default until changed: Operator prefers live verification without retaining Zoom recordings, unless Operator later expressly authorizes recorded proof.
- Camera and/or microphone may be required on during live verification.
- Operator may retain attendance status, session identifiers, timestamps, and credit-grant records—not continuous video—unless recorded proof is expressly authorized.
2.5 Communications and support
Emails, in-app or form messages, support tickets, and appeal or dispute-related correspondence.
2.6 Automatically collected
IP address, device/browser type, approximate location from IP, pages/features used, cookies or similar technologies if used, referral URLs, and security logs.
2.7 We do not intentionally seek (unless required)
Payment-card data for cash purchase of Lotus$ from Operator (not offered at launch), continuous precise geolocation for ordinary browsing, or sensitive personal information beyond what KYC or safety requires. Please do not send unnecessary sensitive data in free-text fields.
3. How We Use Information
We use personal information to:
- Create and administer Member accounts and referral/invitation flows
- Operate listings, trades, messaging tools, and the Lotus$ ledger
- Verify attendance for meditation earn and administer Lotus Path recognition (incentive-only; not equity)
- Perform KYC / fraud / abuse / safety screening
- Enable Lotus$ application toward designated Lotustay.com lodging when that program is enabled
- Communicate club notices, security alerts, and (where permitted) product updates
- Enforce Member / Club Rules, Ledger Terms, Host / Lodging Addendum, and Hub / Drop-off Intake Addendum (when in effect)
- Comply with law, respond to legal process, and protect rights and safety
- Improve Site reliability and Member experience
We do not sell your personal information by default.
We do not “share” personal information for cross-context behavioral advertising as those terms are commonly used under the California Consumer Privacy Act (CCPA/CPRA), by default. If that changes, we will update this Policy and provide required opt-out mechanisms.
4. Notice at Collection (CCPA-Style Summary)
| What we collect | Why | Sold / Shared for advertising? | Retention (criteria) |
|---|---|---|---|
| Account / profile | Membership operation; referral gate | No (default) | Account life + reasonable archive for legal/ops/disputes |
| Listings / trade / ledger metadata | Run club trades and Lotus$ books | No (default) | Trade/ledger life + archive for disputes, fraud, tax/legal |
| KYC / ID verification | Risk, compliance, eligibility gates | No (default) | As needed for verification, compliance, and legal retention |
| Meditation verification status | Earn credits; program integrity | No (default) | Program records; no retained Zoom recordings unless authorized |
| Waitlist carryover (name/email via Formspree or similar) | Onboard referred Members | No (default) | Merged into membership retention or deleted on request where allowed |
| Technical / cookies (if used) | Security, operation, basic analytics | No sale; processors under contract | Session / tool config + reasonable logs |
Service providers / processors may include: hosting, email delivery, Formspree or successor form tools, analytics if used, Zoom or similar video for live meditation verification, and KYC / identity vendors. They process data for our purposes under contract.
We do not use membership data to train public AI models or for unrelated marketing lists without a lawful basis and, where required, consent or an opt-out opportunity.
5. Your Privacy Rights (California and Good-Faith Access)
Depending on where you live and whether Operator meets applicable “business” thresholds under California law, you may have rights to:
- Know / access the personal information we hold about you
- Delete personal information (subject to legal exceptions, including ledger/dispute records where retention is required)
- Correct inaccurate personal information
- Opt out of sale or sharing (we state we do not sell/share by default)
- Limit use of sensitive personal information (KYC data is used for verification/compliance purposes described here)
- Non-discrimination for exercising privacy rights
How to exercise: Email tommymai@tmaifinancial.com with the subject line “Privacy Request” and tell us what you want (access, delete, correct, etc.). We may need to verify your identity (e.g., confirming control of the membership email, or additional checks for KYC-level data).
Note: Full CCPA/CPRA “business” obligations may or may not apply depending on Operator size and revenue thresholds. Even so, Operator intends to honor reasonable access, correction, and deletion requests for membership data in good faith, subject to legal exceptions.
Authorized agents (where the law allows) may submit requests; we may require proof of authorization and direct verification with you.
6. Cookies and Analytics (Optional / If Used)
If we use cookies, local storage, or third-party analytics:
- Essential: Needed for security and basic Site / membership function
- Analytics (if enabled): Help us understand aggregate usage
You can control cookies through your browser settings. Blocking some cookies may affect features. We will update this section if we deploy named analytics or advertising technologies.
7. Children
Membership is intended for individuals 18 years of age or older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 provided information, contact tommymai@tmaifinancial.com and we will delete it.
8. Retention
We retain membership, ledger, trade, and verification records:
- For as long as needed to operate the club, enforce Rules, resolve disputes, detect fraud, and meet legal/tax needs; and
- Thereafter for a reasonable archive period, then delete or de-identify.
Zoom recordings: Operator default until changed — not retained for meditation verification unless Operator expressly authorizes recorded proof.
Dormancy / closure: ledger effects follow the Ledger Terms (including Operator defaults for dormancy and voluntary-closure wind-down).
Waitlist-only records not converted to membership follow the waitlist Privacy Policy retention rules.
9. Security
We use reasonable administrative, technical, and organizational measures appropriate to a membership club and ledger. No method of transmission or storage is 100% secure. Members must safeguard credentials and notify Operator promptly of suspected unauthorized access at tommymai@tmaifinancial.com.
10. Third-Party Sites and Lotustay.com
The Site may link to third-party sites (including Lotustay.com). Their privacy practices are their own. When Lotus$ lodging application is enabled, Exchange may share limited booking/eligibility data with Lotustay.com operators or systems as needed to complete an authorized application—without converting Lotus$ into cash or creating a USD claim against Operator.
11. International Visitors
The Club is operated with a California / United States focus. If you access it from elsewhere, you understand your information may be processed in the United States.
12. Changes
We may update this Policy from time to time. We will post the revised version and update the Effective Date. Material changes affecting Members may also be highlighted by email or require renewed acceptance where appropriate.
13. Contact
Contact: tommymai@tmaifinancial.com
Operator: Lotustay Inc.
Governing law reference: State of California, USA (see also Member / Club Rules and Website Terms)
Effective Date: September 16, 2026. Last updated: September 16, 2026. Effective upon Member acceptance (click-wrap). Waitlist soft-launch does not create membership until referral acceptance. Do not replace the live waitlist Privacy Policy for non-member waitlist visitors. No owner/manager names or EIN on this member-facing document. No cash purchase of Lotus$ from Operator at launch. Not legal advice.