Privacy Policy

1.1 Information You Provide Directly

When you create an account, list a property, book a sublet, or communicate through the Platform, we collect:

• Account registration data: full name, email address, password, and phone number.
• Identity verification data: government-issued ID, date of birth, and profile photograph, as required for certain verifications.
• Listing information (hosts): property address, description, photographs, pricing, and availability.
• Move-in and move-out guide content (hosts and renters): property condition notes, access instructions, photographs, and any other documentation submitted through the Move-In Guide feature in connection with a booking.
• Booking and transaction data: check-in/check-out dates, rental price, service fees, booking fee, and security deposit amounts.
• Payment information: billing name, bank account details (ACH), and card information. Payment data is processed by Stripe, Inc. and is not stored on Merriday's servers. See Section 4.
• Signature and timestamp data: electronic signatures and associated timestamps collected within the Platform at lease execution and at other points requiring documented consent.
• Communications: messages sent through our in-platform messaging system, support requests, and feedback.

1.2 Information Collected Automatically

When you use the Platform, we automatically collect certain technical and usage information:

• Device and browser data: IP address, browser type and version, operating system, device identifiers, and time zone.
• Log data: pages visited, features used, links clicked, referring URLs, and session duration.
• Cookies: we use cookies for session management and authentication. See Section 8 for details.

1.3 Information from Third Parties

We may receive information about you from third-party service providers that support our operations, including:

• Payment processors (Stripe Connect): transaction status, payment method type, and fraud signals.
• Identity verification services: results of identity or document verification checks, where applicable.
• Analytics providers: aggregated or pseudonymized usage data to help us improve the Platform.

2.1 Providing and Operating the Platform

• Creating and maintaining your account.
• Facilitating sublet listings, booking transactions, lease signing, and move-in processes.
• Processing payments, security deposits, booking fees, and service fees via Stripe Connect.
• Holding security deposits in a ring-fenced, FDIC-insured savings account maintained separately from Merriday's operating funds, pursuant to New York General Obligations Law Section 7-108.
• Maintaining records of executed leases, signatures, and timestamps as required by applicable law and our Terms of Service.

2.2 Safety, Trust, and Compliance

• Verifying user identity and eligibility (users must be 18 years of age or older).
• Detecting and preventing fraud, abuse, and unauthorized access.
• Resolving disputes between hosts and renters, including administering platform integrity penalties where applicable.
• Complying with legal obligations, court orders, and requests from law enforcement or regulatory authorities.

2.3 Communications

• Sending transactional messages: booking confirmations, lease signing requests, payment receipts, deposit return notices, and late payment notifications.
• Sending service announcements and important updates about your account or the Platform.
• Responding to customer support inquiries.
• Sending promotional communications where you have opted in. You may opt out at any time.

2.4 Platform Improvement

• Analyzing usage patterns to improve features, functionality, and user experience.
• Conducting internal research and analytics in aggregated or de-identified form.

Where applicable privacy law requires us to identify a legal basis for processing your personal information, we rely on the following:

• Contract performance: processing necessary to provide the services you have requested or to enter into a binding agreement with you.
• Legal obligation: processing required to comply with applicable laws, including New York tenancy and escrow laws.
• Legitimate interests: processing that supports our fraud prevention, platform security, and service improvement efforts, where such interests are not overridden by your rights.
• Consent: where we have obtained your consent, such as for promotional communications or optional data uses. You may withdraw consent at any time.

We do not sell your personal information. We share information only as described below.

4.1 Between Users

To facilitate a subletting transaction, certain information is shared between hosts and renters:

• Hosts can view a renter's first name, profile photo, and booking details upon a confirmed booking request.
• Renters can view a host's listing information, first name, and profile photo.
• Full contact and address details are shared only as necessary to complete a confirmed transaction.

4.2 Service Providers

We share information with trusted third-party vendors who assist in operating the Platform:

• Stripe, Inc.: payment processing, ACH transfers, card transactions, Apple Pay, and Google Pay. Stripe's privacy practices are governed by Stripe's own Privacy Policy.
• Depository institution (security deposits): security deposit funds are held in a dedicated, ring-fenced FDIC-insured savings account at a third-party depository institution. That institution does not use depositor information for independent marketing purposes.
• Depository institution (operating funds): Merriday's operating funds are maintained in a separate bank account, entirely distinct from security deposit escrow funds.
• Infrastructure and hosting providers: cloud services used to host, store, and transmit Platform data.
• Analytics and monitoring tools: services used to monitor Platform performance and detect errors, operating on aggregated or pseudonymized data where possible.

All service providers are contractually bound to use your information only as directed by Merriday and consistent with applicable privacy law.

4.3 Legal and Safety Disclosures

We may disclose your information if we believe disclosure is necessary to:

• Comply with a legal obligation, court order, subpoena, or valid governmental request.
• Protect the rights, property, or safety of Merriday, our users, or the public.
• Detect, prevent, or address fraud, security, or technical issues.

4.4 Business Transfers

If Merriday is involved in a merger, acquisition, financing, restructuring, or sale of assets, your information may be transferred as part of that transaction. We will notify affected users via the Platform or by email before any such transfer results in a material change to your privacy rights.

We retain your personal information for as long as necessary to provide you with the services you have requested, comply with legal obligations, resolve disputes, and enforce our agreements.

Transaction records, executed lease agreements, signature logs, and security deposit records are retained for a minimum of six (6) years following the conclusion of the relevant transaction, consistent with New York statutes of limitations.

You may request deletion of your account and personal data subject to the exceptions described in Section 7.

We implement appropriate technical and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including encryption of data in transit and at rest, access controls limiting personnel access on a need-to-know basis, and ring-fenced security deposit accounts maintained separately from operating funds.

No method of transmission over the internet or electronic storage is completely secure. In the event of a data breach affecting your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law, including New York's SHIELD Act.

7.1 Access and Portability

You may request a copy of the personal information we hold about you. Where technically feasible, we will provide this in a structured, machine-readable format.

7.2 Correction

You may update or correct inaccurate information in your account settings at any time. For information you cannot update directly, contact us at the address in Section 11.

7.3 Deletion

You may request deletion of your account and personal information. We will honor such requests subject to our legal obligations to retain certain records, including executed lease agreements and financial transaction records as described in Section 5.

7.4 Opt-Out of Marketing Communications

You may opt out of promotional emails by clicking the unsubscribe link in any such message or by updating your notification preferences in your account settings. You cannot opt out of transactional messages necessary to complete or manage active bookings.

7.5 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information.

Merriday does not sell or share personal information for cross-context behavioral advertising. To exercise your California rights, contact us at the address in Section 11.

7.6 How to Exercise Your Rights

To exercise any of the rights described above, please contact us at privacy@merriday.co. We will respond to verifiable requests within the timeframes required by applicable law. We may need to verify your identity before processing certain requests.

We use cookies for session management and authentication ("strictly necessary cookies") and to analyze how users interact with the Platform ("analytics cookies").

We do not use third-party advertising cookies or enable interest-based advertising on the Platform.

Most browsers allow you to refuse or delete cookies through their settings. Blocking strictly necessary cookies may impair your ability to use the Platform.

The Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under the age of 18.

If you believe we have inadvertently collected information from a minor, please contact us at privacy@merriday.co and we will take steps to delete that information.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this Policy, post a notice on the Platform, and send a notification to the email address associated with your account where required by law.

Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

support@merriday.co.