Privacy Policy

How we handle the small amount of information this site collects.

1. What we collect

Name, phone number, and email when you call, email, or fill out a form.
Dates, preferred property, and room style when you join the waitlist.
Identification at check-in (driver's license, state ID, or passport) per Idaho innkeeper statute §55-701.
Payment-card details at check-in, processed by our card terminal and retained only as required by PCI-DSS.
Basic web-server logs — IP address, timestamp, page requested, browser user-agent.
Two settings kept in your browser, not cookies: your light or dark mode choice and a copy of the office hours. And the analytics described in section 6 (Google Analytics and Microsoft Clarity), which are not loaded at all when your browser sends Global Privacy Control or Do Not Track.

2. Why we collect it

Book your stay, process payment, and communicate about reservations.
Comply with Idaho innkeeper record-keeping requirements.
Improve the website by seeing which pages and sections get used.
Respond to inquiries sent through forms or by email.

3. Who we share it with

We do not sell your personal information. We share data only with:

Payment processors (Visa / Mastercard / American Express / Discover networks and our merchant bank) for card authorization.
Netlify (hosting and forms), which serves this site, keeps ordinary server logs and receives what you send through the maintenance-report and waitlist forms.
Google (Google Tag Manager and Google Analytics 4) and Microsoft (Clarity), which receive how the site is used, as set out in section 6. They are used to understand the site, not to build advertising profiles, and they are not loaded when your browser sends Global Privacy Control or Do Not Track.
Law enforcement when compelled by a lawful subpoena, warrant, or court order.

4. Your California rights (CCPA / CPRA)

California residents may request:

Email newleafmotels@gmail.com or call (208) 733-2010 with "Privacy Request" in the subject or opener.

To know what personal information we have collected in the past 12 months.
To delete personal information we have collected.
To correct inaccurate personal information.
To opt out of "sale" or "sharing" of personal information (we do not sell or share for cross-context behavioral advertising).

5. Your European rights (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland you may request access, rectification, erasure, restriction, objection, and portability. Contact us using the details in section 4.

6. Cookies

This site sets no cookies of its own. It loads Google Analytics 4, through Google Tag Manager, and Microsoft Clarity, and those two set the cookies below:

If your browser sends a Global Privacy Control or Do Not Track signal, neither Google Tag Manager, Google Analytics nor Clarity is requested at all, none of these cookies is set, and nothing about your visit reaches Google or Microsoft. You can also block or delete cookies in your browser settings; site navigation and phone-call functions work without cookies.

Browser storage, not cookies: your light or dark mode choice (tfr-theme) and a copy of the office hours (tfr-office-v1). The Cookie Policy page lists each one.
_ga and _ga_* (Google Analytics, up to two years): count visits and the pages viewed, plus taps on phone numbers, map links and links to leave a review, noting which link and nothing else.
_clck (one year) and _clsk (one day) (Microsoft Clarity): session replays and heatmaps of how visitors move through a page, with strict masking, so all text and anything you type is replaced by placeholders before it leaves your browser.
The Meta (Facebook) Pixel does not run on this site.

7. Data retention

Guest registration records: seven years, per Idaho state requirements.
Payment records: seven years, per IRS requirements.
Website analytics: Google Analytics keeps event and user-level data for 14 months; Microsoft Clarity keeps session recordings for 30 days and its other data for up to 13 months. Aggregated reports may be kept longer.
Email correspondence: indefinitely unless you request deletion.

8. Security

The website is served over HTTPS with TLS 1.3. Card payments are processed through our PCI-DSS compliant merchant terminal, not stored on the website. Guest identification documents are secured at the office and disposed of per state retention rules.

9. Children

This site is not directed at children under 13 and we do not knowingly collect personal information from children. Guests under 18 must be accompanied by a parent or legal guardian at check-in.

10. Changes

Material changes to this policy will be posted here with the "Last updated" date revised. Continued use of the site or rental of a room after a material change constitutes acceptance.

11. Contact

Informational summary of our privacy practices, not legal advice. For a binding determination of your rights, consult an attorney licensed in your jurisdiction.