Hilton Head 4 Less — Privacy Policy

Learn how inquiry information, optional SMS consent and visitor tools are handled and how to make a privacy request.

Last updated: October 8, 2026. These documents are drafted legal templates, not legal advice or a certification of compliance. Company and qualified attorney review are recommended.

1. Who we are and scope

Hilton Head For Less LLC, operating as Hilton Head 4 Less, provides vacation-promotion information, activity referrals, dining information and planning tools. This policy describes information handled through our website, inquiries, AI assistance and authorized staff tools. Independent resorts, activity operators, restaurants and booking platforms have their own privacy policies for information you provide to them.

2. Information you provide

We collect the information you choose to submit, such as your name, email, phone, message, travel dates, party size, promotion selection, zip code, income range, relationship/party information, timeshare or vacation-club ownership, previous-tour answers, presentation acknowledgment and contact/messaging permissions, including WhatsApp where chosen. We do not need your exact income, payment-card number or government identification number in the public inquiry form.

Approved staff may add business notes, follow-ups, status changes, complaint details, booking context and records of permission changes. Staff accounts also use authentication identifiers and owner-controlled role information. These private records are not public visitor content.

3. How information is used

Information supports reviewing qualifications, responding to your request, arranging and confirming eligible services, managing follow-ups, recording permissions, resolving complaints, securing the service and meeting legal obligations. Marketing use must follow the permission you provided and applicable opt-out requirements. Historical contact information does not establish consent, eligibility, a payment or a confirmed booking by itself.

4. Sarah AI and staff AI

Messages you type in Sarah’s public concierge chat are sent to a third-party AI service to generate a reply. The application does not persist public Sarah chat messages in its server database. The AI provider and hosting provider may process requests under their own terms; this is not a promise that third parties retain nothing. AI-usage and budget accounting may retain operational usage information without treating it as a booking record.

Do not enter names, phone numbers, email addresses, payment information, account passwords or other sensitive details into Sarah chat; use the secure inquiry form or contact the team. Authorized staff-agent conversations can be stored in the CRM and may include the minimum relevant business context sent to the configured AI provider. Public visitors cannot use Sarah to access staff tools or private customer records.

5. Trip plans and browser storage

The trip planner saves drafts on the device/browser when you choose to save. Notes, dates and preferences may be included in a plan you export, print, import or share. Removing browser storage, changing devices or using a shared device can affect access to those drafts. Delete local plans and exported files when you no longer need them. Generating a plan does not book or contact a provider.

For up to 24 hours in your browser session, campaign attribution can retain source, medium and campaign labels, a public landing-page path and an external referrer hostname. Those labels accompany a submitted inquiry. This feature does not store full query strings, advertising click IDs, contact details or qualification answers in browser attribution storage.

6. Cookies, analytics and operational logs

Authentication, security and chosen tools can use cookies or similar browser storage. Embedded booking services and other third-party content may use their own technologies. Browser settings can limit cookies and storage, but some selected features may no longer work. This policy does not itself activate advertising pixels, analytics vendors or recording tools.

When site analytics is enabled, custom interaction events can record the selected offer, request status and activity-checkout interactions. Those custom events do not include names, email addresses, phone numbers, financial answers, chat messages or lead identifiers. A checkout interaction is not proof of purchase. Hosting and service providers may separately process technical data such as IP address, browser/device information and security or access logs.

Where nonessential tracking requires consent or additional choices under applicable law, it must not be enabled without those controls. We do not claim that a cookie notice, a privacy page alone or an AI-generated document makes tracking legally compliant.

7. Providers, referrals and disclosures

Relevant service providers include Replit for hosting and managed services; Clerk for staff authentication; the configured managed AI provider, including OpenAI where enabled; Resend for business email; Google/Gmail when an owner connects a mailbox; Stripe for applicable payments; FareHarbor for independent activity checkout; and Telnyx or another expressly configured communications provider where a service is enabled. Which provider processes a particular request depends on the feature you choose and the active configuration.

We may disclose necessary information to an independent provider to fulfill a service you request, with authorized business staff, or where required for lawful legal process, fraud prevention or protecting rights and safety. We do not sell submitted inquiry information or SMS consent to third parties for their independent marketing. A vendor listing or affiliate commission does not authorize unrelated disclosure of your personal information.

Mobile information, messaging opt-in data and consent will not be shared with third parties or affiliates for their marketing or promotional purposes. Communications service providers may process the minimum information needed to deliver messages you authorized, including relevant offers when your permission covers them. Your consent is not provided to resorts, activity vendors or other businesses for their own messaging.

WhatsApp messages, incoming calls and consent records

Where enabled, WhatsApp Business is our CRM text channel. WhatsApp/Meta and Telnyx process your phone number, message content and delivery or call information to provide that service under their own terms and privacy policies. WhatsApp is distinct from carrier SMS; consent or account approval does not itself activate carrier SMS. You need access to WhatsApp to receive WhatsApp messages. See WhatsApp’s Privacy Policy and Telnyx’s Privacy Policy.

Our private CRM stores message text, phone numbers, recorded consent and its provenance, opt-outs, scheduling information, delivery status and incoming call-event metadata. The WhatsApp inbox does not store media attachments or record incoming-call audio. This is not a promise that WhatsApp, Meta or Telnyx retain no service data. Incoming WhatsApp calls may be forwarded to an authorized team member when routing is configured. This program does not initiate outbound customer WhatsApp calls. Any future call recording or transcription requires a separate appropriate notice and permission where required.

Requested-contact replies and appointments may be handled automatically or by staff. Relevant vacation offers and re-engagement messages are sent only within the scope of your recorded permission. Outside WhatsApp’s customer-opened 24-hour reply window, business-initiated messages require the appropriate provider-approved template; approval and delivery are not guaranteed. Provider rules or review can delay or prevent messages.

We preserve existing consent records and later withdrawals when migrating data. An owner’s confirmation of historical signed consent is identified as owner-attested when an original acceptance record is not available; it is not represented as a recovered original signature. New website checkbox records can include the selected permissions, notice text/version and server receipt time. Posting new policies does not expand old permissions or replace their original scope. We do not publish individual consent records or signatures on these public policy pages.

8. Payments and third-party booking

The public inquiry form does not collect payment. When a payment service is used, the named processor handles card information under its own terms. Our application may retain transaction identifiers, payment status and booking records, but does not store full payment-card numbers. Information entered into an independent provider’s checkout is handled by that provider and its processor. Review their terms and privacy policy before completing checkout.

9. Contact, email, WhatsApp and SMS choices

Contact consent is required to submit the current inquiry form so the team can respond. Messaging consent is a separate optional, initially unchecked choice and is not a condition of making an inquiry or purchasing a service. The displayed notice covers staff-sent or automated WhatsApp messages and SMS only where separately enabled: request follow-ups, appointment updates and relevant vacation offers when selected. Frequency varies; data charges and, for SMS, carrier message charges may apply. Permission is specific to Hilton Head For Less LLC and does not authorize independent providers to market to you.

Withdraw marketing permission using an available message preference link or contact Support@hiltonhead4less.com or (843) 295-0069. Preference links may require a confirmation click so that mail-security scanners do not unsubscribe you accidentally. If a message provides STOP or HELP reply instructions, you can use them; direct contact remains available. Request handling must honor applicable legal deadlines. We do not represent that an unconnected messaging service, automatic reminder or carrier opt-out worker is already running.

Reply STOP in our WhatsApp conversation to stop WhatsApp messages, or HELP for assistance. After a WhatsApp STOP, only your START message restores that channel through the automated inbox. A STOP in an SMS conversation applies to that SMS program. To withdraw permission across all marketing channels or request correction of a consent record, contact Support@hiltonhead4less.com or (843) 295-0069; staff must honor that request across the relevant systems. Non-marketing responses needed for an active transaction or a legal duty remain subject to applicable law.

10. Access controls and connected business accounts

Only owner-approved staff can access inquiries, according to their authorized roles. The connected Gmail CRM view remains owner-only and uses a local business-mail watchdog to screen tour inquiries, lead correspondence and promotion scheduling or rescheduling. Personal, unrelated, bulk and uncertain messages are hidden from CRM results, including within mixed conversations and searches. Quoted history is omitted; attachment access requires an approved message and a clear business-document name. Saved CRM drafts are also screened. Screening is conservative, not a guarantee of perfect classification; owners should review missing or original correspondence privately in Gmail and use a dedicated business account where possible. Mailbox content is not sent to an AI provider for this screening. The watchdog does not delete, archive or mark Gmail messages read. Sending still requires an explicit owner action; connecting an account does not authorize customer campaigns automatically.

11. Retention, security and international processing

Retention depends on the purpose of a record, an active booking or inquiry, consent history, applicable financial/legal requirements and handling of disputes or security incidents. Requests for deletion are assessed against those needs; technical backups and legally required records may not be removed immediately. We do not promise that every record is automatically deleted on a fixed schedule.

We use HTTPS where served securely, owner/staff access controls and operational safeguards. No online system can guarantee absolute security. Hosting, authentication and other processors may process information outside your state or country, including in the United States, under their applicable terms and legal obligations.

12. Rights and privacy requests

Depending on applicable law, you may request access, correction, deletion or a portable copy of information, withdraw marketing consent, or exercise other statutory privacy rights. Email Support@hiltonhead4less.com with “Privacy request” or contact (843) 295-0069. Describe your request without sending passwords, payment-card information or government identification numbers. We may need proportionate identity verification and will explain any lawful limitation or additional information needed to process the request.

We do not require you to purchase a service to make a privacy request, and will not retaliate for exercising applicable rights. If you believe a request was handled incorrectly, contact us for review; applicable rights to complain to a regulator or pursue another lawful remedy remain unaffected.

13. Children and shared devices

The inquiry and staff-account services are intended for adults. Family planning may include the number of children in a party, but children should not submit accounts or sensitive information themselves. If you believe a child’s information was submitted improperly, contact us so we can investigate and address it. On shared devices, sign out of staff accounts and remove saved trip drafts or exported files containing personal notes.

14. Changes and contact

We will post updates with a revised date and provide additional notice or obtain permission where required for a material change in data use. See the Terms of Service for the scope of offers and tools.

Hilton Head For Less LLC
33 Office Park Rd, Suite 218
Hilton Head Island, SC 29928
Privacy contact: Support@hiltonhead4less.com
Phone: (843) 295-0069