The reservation request file at the Towson office, in long form

A short vocabulary used through the notice

Personal information in this page means anything that names a particular reader, describes one, or can reasonably be matched to one. The California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (together the CCPA) uses that same reading, and so do the privacy laws of Virginia, Colorado, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee and Minnesota.

The term inn stands for any hotel, lodge or bed-and-breakfast house named in a written quote. Each inn runs its own front desk and keeps its own notice; the office arranges only the reservation and never takes a payment at this website.

The eight fields the reservation form actually asks for

Only the fields below land at the office when the send button is pressed. The form asks for nothing else, and the office does not add more to the file later without saying so.

A phone number is optional and only used when a reader has asked for a phone reply; every other item helps the office ask the inn the correct question about a room.

• a table size, chosen from a short list
• an inn name, or a request for a suggestion
• a window of dates
• a number of rooms
• the reader's name
• an email address
• a phone number, optional
• the way a reply is wanted, by email or by phone

A free note sits under the eight fields, in case a reader wants to add a line about children, pets or quiet mornings. Nothing in the form is prefilled from a cookie or from a prior visit.

Where this information reaches the office from

The office learns personal information in three ways: directly from a reader through the request form or a later email, directly from the reader over the phone on a weekday morning, and from the inn once a quote is accepted when the inn writes back with a confirmation number. Nothing in the file is bought from a data vendor or scraped from a public list.

How the office puts each field to work

Every field is used for one reason only: to write the quote the reader is asking for, and to carry the message between the reader and the inn. The office uses an email address and name to send the quote; it uses dates and room counts to ask the inn whether the nights are open; it uses a phone number only if a phone reply has been chosen; and it uses the note to flag anything the inn should know before it answers.

No field is used to build a profile, to target an advertisement, or to measure response to a mailing, since no mailing list sits at the office and no advertising network has been invited onto the site at this time.

Which CCPA and CPRA categories the eight fields fall under

The fields fit two CCPA categories from Civil Code 1798.140(v)(1): identifiers, since name, email and phone can identify a reader; and commercial information, since the dates and inn choice describe a reservation inquiry. The written note is treated as the same category as whatever a reader puts there, so an inn, a date and a room count count as commercial information, and nothing more sensitive is asked for.

No category marked as sensitive under Civil Code 1798.140(ae) is collected: no government identifier, no account login, no precise geolocation, no race or health or union data.

From the reservation form to an office mailbox

After the send button is pressed, the eight fields travel to the office over the open web by way of an outside relay that turns form posts into email and holds no account of its own at that relay. The relay keeps a short delivery log for its own records, under its own notice, and nothing in the message is published anywhere on the way.

The office stores the email in the regular work inbox at the Towson desk, in a folder for reservation requests. The folder is reviewed every weekday morning, and a quote is written before the office closes the next phone day.

Who at the office reads each request and when the inn is told

The only people who read an unopened request are the two principals of the office, who together answer every quote. No freelancer, no outside agency and no family member has access to the folder.

An inn learns a reader's name, dates and room count only after the office quotes the stay and the reader accepts the quote in writing. At that point the office asks the inn to hold the room, and the inn writes back a confirmation under its own house notice.

Cookies and the small file the browser never keeps

The site sets no cookies of its own. No tracking pixel, no analytics tag, no measurement script sits on any page, and no advertising network has been invited onto the site at the date this notice is signed. The browser is asked to store exactly one short item, a yes-or-no choice about an on-page banner, and even that item is written into the browser's local storage, not into a cookie, and never leaves the reader's own machine.

If an outside measurement tool or a trip-search widget is ever added later, the notice will be edited to say so, name its purpose, and point to the tool's own policy before the tool is turned on.

Your Privacy Choices and the Global Privacy Control

Personal information is never sold for money or anything else of value, and the office keeps no arrangement that trades it for consideration. It is not shared for cross-context behavioral advertising either, both as those terms are read in Civil Code 1798.140. Because nothing is sold and nothing is shared for that purpose, there is no opt-out control to publish; the Your Privacy Choices label that some sites print is not needed on this one, and a reader who wants the statement in writing can ask for it by email.

The office honors a Global Privacy Control signal from a browser as a valid opt-out of selling and of cross-context advertising, under Civil Code 1798.135(b). If a later version of the site turns on an advertising network, the signal will continue to be honored on every page the site serves.

State privacy rights, in thirteen states that give them

A reader in a state with a modern privacy statute has the rights below over the file at the office, and the office answers a verified request within forty-five calendar days, with one forty-five-day extension when the facts truly call for it, under Civil Code 1798.130(a)(2).

The rights are read as the matching statute in each state describes them; where a right is not in a given statute, the office provides the closest match without charge.

• California: access, correction, deletion, portability, knowledge of categories collected and categories disclosed, opt-out of selling and sharing, limit on use of sensitive information, non-discrimination (Civil Code 1798.100 to 1798.199.100)
• Virginia: access, correction, deletion, portability, opt-out of selling and of targeted advertising (Code of Virginia 59.1-575 to 59.1-585)
• Colorado: access, correction, deletion, portability, opt-out of selling, targeted advertising and profiling that produces a legal effect (Colorado Privacy Act 6-1-1301 and following)
• Utah: access, deletion, portability, opt-out of selling and of targeted advertising (Utah Consumer Privacy Act 13-61-101 and following)
• Texas: access, correction, deletion, portability, opt-out of selling, targeted advertising and profiling (Texas Data Privacy and Security Act, Business and Commerce Code chapter 541)
• Oregon: access with a list of third-party recipients, correction, deletion, portability, opt-out of selling, targeted advertising and profiling (Oregon Consumer Privacy Act, SB 619 of 2023)
• Montana: access, correction, deletion, portability, opt-out of selling, targeted advertising and profiling (Montana Consumer Data Privacy Act, SB 384 of 2023)
• Delaware: access, correction, deletion, portability, opt-out of selling, targeted advertising and profiling (Delaware Personal Data Privacy Act)
• Iowa: access, deletion, portability, opt-out of selling and of targeted advertising (Iowa Consumer Data Protection Act)
• New Hampshire: access, correction, deletion, portability, opt-out of selling, targeted advertising and profiling (New Hampshire SB 255)
• New Jersey: access, correction, deletion, portability, opt-out of selling, targeted advertising and profiling (New Jersey SB 332)
• Tennessee: access, correction, deletion, portability, opt-out of selling and of targeted advertising (Tennessee Information Protection Act, Public Chapter 408)
• Minnesota: access, correction, deletion, portability, opt-out of selling, targeted advertising and profiling (Minnesota Consumer Data Privacy Act, Chapter 228 of 2024)

The office is not alone in naming thirteen jurisdictions; readers in other states may rely on the general rights in this notice, including access, correction, deletion and portability on request.

A reader may authorize an agent to send a request on the reader's behalf. The office asks for a written permission from the reader and asks the reader to confirm that permission, as Civil Code 1798.185(a)(7) permits, before acting on the agent's request.

Sending a rights request and how it is answered

A verified rights request is accepted at yourdetails@bridgeportbedandbreakfast.com or by phone on a weekday morning. The office matches the request to a reader's own file using the name and email already on the file, and if those do not match the office asks for one more piece that the reader supplied earlier, such as the date range of a quote.

A valid request is answered within forty-five calendar days, in writing, with one forty-five-day extension when the facts truly call for it. The office handles no charge for the work, and a reader who chooses to use a right is not treated any differently by the office for doing so.

Address and web server logs the pages leave behind

Readers of these pages leave the usual short log on the edge: a request time, a URL, a response code, and a shortened record of an IP address. Those entries are the sort every web server keeps and are used to spot a broken link or an abusive flood, nothing more. They are discarded after thirty calendar days.

The office does not stitch those edge logs together with the reservation file; a reader's IP address is never joined to a name or an email in any folder the office keeps.

15 months of keeping, then quiet erasure

A reservation request and the quote written from it are kept for 15 months after the last message between the reader and the office. After that window the request, the quote and the email thread are deleted from the inbox and from the office's own backups within a further thirty calendar days.

The office keeps a separate, impersonal commission record for as long as Maryland tax law requires, since the inn pays the office for the reservation. That record carries only a dollar amount and the inn's name and does not hold a reader's details.

Minors, the request form and the under sixteen rule

The site is written for adults planning a stay, and the office does not direct the pages at anyone under 13. No information is collected online from a known child under 13; if the office learns that a message in the inbox came from a child under 13, the message is deleted the same business day, under the Children's Online Privacy Protection Act, 15 U.S.C. 6501 and following.

Under California's Civil Code 1798.120(c), personal information of a reader known to be under 16 is never sold or shared, and in fact no reader's personal information is ever sold or shared. No reader under 18 is placed into any remarketing audience at this time, and no profile is built on a minor. The office follows the Children's Advertising Review Unit guidance when a reader is known to be under 13.

Keeping the inbox and the records out of other hands

The inbox used for reservation requests sits behind a long password and a two-step code, and the laptop that the office works on is encrypted at rest. The folder of quotes is backed up to an encrypted drive sitting in the Towson office that never leaves the building.

No security promise can be made absolute, and a reader is told here plainly that no transmission over the open web is unbreakable. The office relies on ordinary and reasonable measures and will tell a reader in writing if a file is ever exposed, by the deadlines Maryland sets in Commercial Law 14-3501 through 14-3508 of the Personal Information Protection Act.

Readers who write in from outside the United States

The office keeps every file on hardware inside the United States. A reader writing from the European Union, the United Kingdom or Switzerland is telling the office to carry the message across a border; the office relies on the Standard Contractual Clauses adopted by the European Commission in 2021 and on the equivalent clauses adopted by the United Kingdom and Switzerland, since no local presence overseas has been set up.

A reader in those jurisdictions keeps the same rights the notice already lists, together with the rights the General Data Protection Regulation grants: object, restrict, withdraw a consent given earlier, and lodge a complaint with a local supervisory authority.

If the office is ever transferred, merged or dissolved

If the office is later transferred to another party, if the two principals are bought out, or if the company is folded into another one, a reservation file that is still open may change hands with the rest of the office's records. The receiving party would be held to the same terms this notice already lists, and a notice on the home page would say so before the change takes effect.

If the office is dissolved and no receiving party picks up the open files, the files are erased in the way the 15 month rule describes, and the dissolution is announced on the home page for thirty days before the site is taken down.

Maryland law and Baltimore County as the chosen forum

This notice is read under the laws of the State of Maryland, without regard to its rules on choice of law, and under the federal privacy and consumer protection statutes it refers to by name. A disagreement that cannot be settled by email with the Towson office belongs in the courts sitting in Baltimore County, Maryland, with jurisdiction and venue agreed by both sides in advance.

If a reader is a consumer under a different state's statute, that statute's rights still apply and are enforced in the way its own text describes; the choice of Maryland law does not strip a reader of a right that state law otherwise gives.

Edits to this notice and the version record

A change that materially alters what the office collects, what it does with the file, or who else sees a reader's details is made by raising the version number at the top of this page and by refreshing the effective date. Earlier wording is kept in a written record, and the office can send the earlier text to a reader who asks which version was in force on a given day.

A smaller change, such as a typographical fix or a new office hour, is recorded in the same version log and does not bump the headline version. Version 1 was signed on November 4, 2026.

Reaching the office about any question in this notice

A privacy question goes to yourdetails@bridgeportbedandbreakfast.com, or by post to Bridgeport Bed and Breakfast LLC, 600 Washington Avenue, Suite 205, Towson, Maryland 21204, or by phone on (410) 821-4736 between Tuesday and Saturday morning.

A reader who still does not feel the question has been answered may write to the Office of the Maryland Attorney General, Consumer Protection Division, 200 Saint Paul Place, Baltimore, Maryland 21202, or to the California Privacy Protection Agency at 2101 Arena Boulevard, Sacramento, California 95834, or to the authority of the reader's own state.