Privacy Policy

1. Scope of This Policy

This Privacy Policy explains how Visit Tudor City (“we,” “us,” or “our”) handles information in connection with the website at visittudorcity.org (the “Site”) and the interactive experience published on it, The Hour Between Floors.

The Site is a promotional and storytelling property. It is informational and interactive only. It does not take reservations, process payments, or maintain guest accounts. When you choose to book a stay, you leave this Site and are handed off to the reservation system operated by Westgate Resorts — and from that point forward, Westgate Resorts's privacy policy governs, not this one. See Section 8, Booking a Stay.

This policy does not apply to any third-party website you reach from the Site, even where we have linked to it.

2. The Data We Collect

We have deliberately built this Site to collect as little as possible. There are no account registrations, no contact forms, no newsletter sign-ups, and no payment fields anywhere on the Site. In ordinary use of the Site, we do not ask you for and you do not give us your name, postal address, telephone number, date of birth, government identification number, or payment card details.

The categories of information that may nonetheless be involved are:

• Technical and device data — IP address, browser type and version, operating system, screen and viewport size, referring page, and the pages you view. This is generated automatically by your browser whenever it requests any page on the internet.
• Usage and interaction data — which pages you visit, how long you stay, which parts of the interactive experience you open or complete, and how you arrived at the Site.
• Approximate location — inferred at the city or region level from your IP address. We do not request or use precise GPS location, and the Site contains no code that asks your device for it.
• Information you volunteer — if you contact us directly by email at the address in Section 23, we will have whatever you put in that email.

We do not collect biometric information, we do not operate cameras or recording equipment through the Site, and we do not knowingly collect sensitive personal information as that term is defined under United States state privacy laws.

3. The Online Data We Collect

Like nearly all websites, our hosting provider and content delivery network automatically log requests made to the Site. These logs may include IP address, timestamp, requested URL, response status, and user-agent string. They exist for security, abuse prevention, and operational troubleshooting.

The Site is a static website. There is no server-side application logic, no database of visitors, and no user profile stored on our infrastructure.

Web fonts. The Site loads typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Making that request discloses your IP address and user-agent to Google. If this concerns you, most browsers and privacy extensions can block third-party font requests; the Site remains fully readable without them.

4. Cookies and Similar Technologies

Cookies are small text files placed on your device by a website. The Site itself does not set advertising or profiling cookies. The technologies that may be present are limited to:

• Strictly necessary — set by our hosting and content delivery provider to route traffic, balance load, and mitigate malicious activity. These cannot be switched off without breaking the Site.
• Analytics — if and when web analytics are enabled on the Site, a first-party analytics cookie or identifier may be used to distinguish one visit from another and to measure aggregate traffic. We use analytics to understand which pages and which parts of the story people actually reach. We do not use it to build advertising profiles.

Do Not Track. There is no common industry standard for how websites should respond to browser “Do Not Track” signals. Like Westgate Resorts, we do not currently respond to them. We do honor the Global Privacy Control (GPC) signal as a valid opt-out of sale and sharing where applicable law requires it.

You can block or delete cookies through your browser settings. Doing so will not prevent you from using the Site.

5. Local Storage and Your Progress Through the Experience

The interactive experience remembers what you have found — which doors you have opened, which puzzles you have solved, and how far you have progressed. It does this using your browser's local storage, a small store of data that belongs to your browser on your own device.

This progress data never leaves your device. It is not transmitted to us, it is not associated with your identity, and we cannot read it. It contains no personal information — only flags recording which parts of the story you have unlocked.

You can erase it at any time by clearing site data for visittudorcity.org in your browser settings. Doing so resets the experience to the beginning. Using a private or incognito window means your progress is discarded when you close the window.

6. How and When We Collect Information

We obtain information in these ways and no others:

1. Automatically, from your browser, when you request a page on the Site.
2. Automatically, through server and content delivery network logs.
3. Through web analytics, where enabled, in aggregate form.
4. Directly from you, if you choose to email us.

We do not purchase personal information about you from data brokers, we do not append or enrich visitor records with data from third-party sources, and we do not scrape social media to build profiles of our visitors.

7. Why We Collect Information

We use the limited information described above only to:

• deliver, secure, and operate the Site;
• diagnose technical problems and keep the experience working across devices;
• understand aggregate traffic patterns and which parts of the experience resonate;
• protect against fraud, abuse, automated attack, and unauthorized access;
• comply with legal obligations and enforce our Terms and Conditions; and
• respond to you, if you have written to us.

8. Booking a Stay

This is the most important section of this policy, so we will be plain about it.

Every “book,” “reserve,” or “check availability” control on this Site is a link that takes you off this Site to a reservation system operated by Westgate Resorts. We do not display a booking form, we never see your dates, your guest details, or your payment card, and no reservation is created on our infrastructure.

The link may carry non-personal parameters — such as the property identifier and, if you chose them, your arrival and departure dates — so that the reservation system opens on the right property and the right dates. It carries no identifier for you.

Once you arrive on the reservation system, Westgate Resorts's privacy policy and terms govern everything that follows, including how your reservation, guest, and payment information is collected, used, disclosed, and retained. Please read Westgate Resorts's Privacy Policy before completing a booking. Questions about a reservation, a stay, a cancellation, or a charge must be directed to Westgate Resorts, not to us — we have no access to reservation records.

9. Sale and Sharing of Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended and comparable state privacy laws. We have not done so in the preceding twelve months.

We do not knowingly sell or share the personal information of consumers under sixteen years of age.

Because we do not sell or share personal information, there is no “Do Not Sell or Share My Personal Information” mechanism to offer you. If that ever changes, this policy will be updated before the practice begins and a mechanism will be provided here.

10. Disclosure to Third Parties

The limited information we hold may be disclosed only in these circumstances:

• Service providers. Our website host and content delivery network, and our analytics provider where enabled, process technical data on our behalf under contractual restrictions limiting them to that purpose.
• Affiliates. With Westgate Resorts and its affiliated entities in connection with the promotion of the property featured on this Site.
• Legal process and safety. Where we believe in good faith that disclosure is required by law, subpoena, court order, or governmental request, or is necessary to protect the rights, property, or safety of any person, or to investigate fraud or a security incident.
• Corporate transactions. As described in Section 13.

We do not disclose information to third parties for their own independent marketing purposes.

11. Advertising Choices

The Site does not display third-party advertising and does not host advertising trackers, retargeting pixels, or cross-device advertising identifiers.

If we ever run advertising campaigns that lead visitors to this Site, those campaigns are measured by the advertising platform on its own properties under its own policy. You can exercise general industry opt-outs at the Network Advertising Initiative, YourAdChoices, and Google's privacy controls.

12. Non-Personal Information

We may aggregate or de-identify information so that it can no longer reasonably be associated with any individual, and may use and disclose that aggregated information for any lawful purpose, including analysis and reporting. We will maintain and use such information in de-identified form and will not attempt to re-identify it.

13. Merger or Acquisition

If we are involved in a reorganization, merger, acquisition, financing, or sale or transfer of assets, information covered by this policy may be transferred as part of that transaction. Any successor will remain bound by the commitments made in this policy with respect to information transferred, unless and until you are notified of a change.

14. Security of Information

The Site is served exclusively over encrypted HTTPS connections. We apply security response headers, and our hosting provider maintains network-level protections against attack. Because the Site holds no accounts, no payment data, and no database of visitors, the amount of information that could be exposed by a compromise of the Site is minimal by design.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe the Site's security has been compromised, please write to us immediately at the address in Section 23.

15. Data Retention

Server and content delivery logs are retained for a short operational period, generally not more than thirty days, and then discarded or overwritten in the ordinary course. Aggregate analytics data is retained for as long as it remains useful for measuring traffic trends. Email correspondence is retained for as long as needed to address the matter you raised and to keep a record of it.

Progress data stored in your browser's local storage is retained on your device until you clear it. See Section 5.

16. Your Choices and Rights

Depending on where you live, you may have the right to request that we: confirm whether we process personal information about you and give you access to it; correct inaccurate personal information; delete personal information; provide a portable copy; opt out of sale, sharing, or targeted advertising; opt out of profiling that produces legal or similarly significant effects; and limit the use of sensitive personal information.

We will honor these rights regardless of your state of residence. You will not be discriminated against for exercising them, and we do not offer financial incentives in exchange for personal information.

How to make a request. Email privacy@visittudorcity.org with the subject line “Privacy Request” and tell us what you would like us to do. We will acknowledge within ten business days and respond substantively within forty-five days, which we may extend once by a further forty-five days where reasonably necessary, with notice to you.

A candid note about verification. Because we do not maintain accounts or visitor profiles, we usually hold no information that identifies you, which means there may genuinely be nothing for us to access, correct, or delete. Where that is the case we will tell you so plainly rather than ask you to send us identity documents we do not need. We will not request more personal information from you in order to process a privacy request than is necessary to verify it.

If we decline a request, you may appeal by replying to our response with the word “Appeal.” We will review and respond within forty-five days. If we deny your appeal, you may contact your state Attorney General.

17. Authorized Agents

You may use an authorized agent to submit a request on your behalf where state law permits. The agent must provide written authorization signed by you, and we may contact you directly to confirm that you granted the authority. Our response will be sent to the email address you confirm.

18. State-Specific Rights

California

California residents have the rights described in Section 16 under the California Consumer Privacy Act as amended by the California Privacy Rights Act. We do not sell or share personal information, and we do not collect sensitive personal information for purposes requiring a limitation right. California's “Shine the Light” law permits residents to request information about disclosures to third parties for those third parties' direct marketing purposes; we make no such disclosures.

Nevada

Nevada residents may submit a verified request directing us not to sell covered personal information. We do not sell personal information as defined by Nevada Senate Bill 220, but you may submit such a request to privacy@visittudorcity.org. The Nevada Attorney General may be contacted at the Bureau of Consumer Protection, 100 North Carson Street, Carson City, NV 89701.

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states

Residents of states with comprehensive consumer privacy laws have the rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and certain profiling, together with a right to appeal a denied request. All are described in Section 16 and are available to you through the same email address.

Washington and Nevada health data

We do not collect, use, or share consumer health data as defined by the Washington My Health My Data Act or Nevada Revised Statutes Chapter 603A.

19. Notice to European and United Kingdom Residents

The Site is directed to visitors in the United States. If you access it from the European Economic Area, the United Kingdom, or Switzerland, the technical information described in this policy will be processed in the United States.

Where the General Data Protection Regulation or the UK GDPR applies, our lawful basis for processing technical and usage data is our legitimate interest in operating, securing, and improving the Site, and, for analytics and non-essential cookies, your consent where consent is required. You have the rights of access, rectification, erasure, restriction, objection, and portability, the right to withdraw consent at any time without affecting prior processing, and the right to lodge a complaint with your national supervisory authority.

Be aware that the Google Fonts request described in Section 3 transmits your IP address to Google. You can prevent it by blocking third-party font requests in your browser.

20. Children's Privacy

The Site is not directed to children and is not intended for anyone under sixteen years of age. We do not knowingly solicit or collect personal information from children. Consistent with the Children's Online Privacy Protection Act, if we learn that we have received personal information from a child under thirteen, we will delete it promptly.

A parent or guardian who believes a child has provided personal information to us should write to privacy@visittudorcity.org and we will act to remove it.

Note that the interactive experience contains atmospheric horror imagery and themes. See our Terms and Conditions for a description of the content.

21. Website Links and Social Media

The Site links to third-party websites, including the reservation system operated by Westgate Resorts and historical and reference sources. We do not control those sites and are not responsible for their content, their cookies, or their privacy practices. This policy applies only to visittudorcity.org.

If you share a page from the Site to a social media platform, that platform's privacy policy governs what it collects from you. We recommend against posting personal information publicly.

22. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be highlighted on this page. Your continued use of the Site after a change takes effect constitutes acceptance of the revised policy.

23. Contact Us

Questions, requests, and complaints about privacy may be sent to:

For anything concerning a reservation, a stay, a cancellation, a charge, or guest information, please contact Westgate Resorts directly — we have no access to those records.