Privacy Policy

Merriday Inc.

Effective Date: July 10, 2026 | Last Updated: July 10, 2026

Merriday Inc. ("Merriday," "we," "our," or "us") operates a subletting marketplace connecting. Hosts and Renters in New York City. This Privacy Policy describes how we collect, use, disclose, and protect information about you when you access or use our website, applications, and services (collectively, the "Platform"). By using the Platform, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Platform. Merriday is not a real estate broker, property manager, or landlord. We provide a marketplace platform that connects Hosts and Renters; we do not own, manage, or control any listing.

1.1 Information You Provide Directly

When you create an account, create a listing, book a listing, or communicate through the Platform, we collect:

• Account registration data: full name, email address, password, and phone number.
• Identity verification data: government-issued ID, date of birth, and profile photograph, as required for certain verification levels.
• Listing information (Hosts): listing address, description, photographs, pricing, availability, utilities, and house rules.
• Lease creation information (Hosts): information entered in the Platform's lease creation tools, including ownership or leaseholder status, prime lease dates, landlord consent attestations, rent regulation eligibility answers, building disclosures (such as flood history, bedbug history, building age, and repair contact details), and related details used to assemble lease documents.
• Booking and transaction data: lease start and end dates, rent, service fees, booking fee, reservation payment, and security deposit amounts.
• Agreement and signature records: electronic signatures, checkbox assents, acceptance records, and associated timestamps collected within the Platform when you accept the Terms of Service, execute the Reservation Payment Agreement, sign a lease, or take other actions requiring documented consent.
• Move-in and move-out documentation: condition notes, photographs, access confirmations, move-in reports, and security deposit deduction claims or responses submitted through the Platform.
• Payment information: billing name, bank account details (ACH), and card information. Payment data is processed by Stripe, Inc. and is not stored on Merriday's servers. See Section 4.
• Communications: messages sent through our in-platform messaging system, support requests, and feedback.

1.2 Information Collected Automatically

When you use the Platform, we automatically collect certain technical and usage information:

• Device and browser data: IP address, browser type and version, operating system, device identifiers, and time zone.
• Log data: pages visited, features used, links clicked, referring URLs, and session duration.
• Cookies: we use cookies for session management and authentication. See Section 8 for details.

1.3 Information from Third Parties

We may receive information about you from third-party service providers that support our operations, including:

• Payment processors (Stripe Connect): transaction status, payment method type, and fraud signals.
• Identity verification services: results of identity or document verification checks, where applicable.
• Analytics providers: aggregated or pseudonymized usage data to help us improve the Platform.

1.4 Information About Others

Some information Hosts provide relates to people who are not Platform users, such as a prime landlord's name and contact details or a building repair contact. We use this information only to assemble lease documents, administer transactions, and meet legal requirements. If you provide information about another person, you are responsible for having the right to do so.

2.1 Providing and Operating the Platform

• Creating and maintaining your account.
• Facilitating listings, booking transactions, lease creation and signing, the Reservation Payment Agreement, and move-in processes.
• Processing payments, security deposits, booking fees, and service fees via Stripe Connect.
• Holding reservation payments and security deposits in dedicated, FDIC-insured accounts maintained separately from Merriday's operating funds, as required by New York law.
• Maintaining records of executed agreements, signatures, and timestamps as required by applicable law and our Terms of Service.
• Collecting amounts owed under our Terms of Service, including platform integrity fines, using payment methods on file as authorized in the Terms of Service.

2.2 Safety, Trust, and Compliance

• Verifying user identity and eligibility (users must be 18 years of age or older).
• Detecting and preventing fraud, abuse, and unauthorized access, including reviewing Platform communications for fraud detection, dispute resolution, and trust and safety enforcement, as described in our Terms of Service.
• Resolving disputes between Hosts and Renters, including administering platform integrity fines where applicable.
• Complying with legal obligations, court orders, and requests from law enforcement or regulatory authorities.

2.3 Communications

• Sending transactional messages by email, SMS/text, or in-app notification: booking confirmations, lease signing requests, payment receipts, deposit return notices, and late payment notifications.
• Sending service announcements and important updates about your account or the Platform.
• Responding to customer support inquiries.
• Sending promotional communications consistent with the consent described in our Terms of Service. You may opt out of promotional communications at any time.

2.4 Platform Improvement

• Analyzing usage patterns to improve features, functionality, and user experience.
• Conducting internal research and analytics in aggregated or de-identified form.

Where applicable privacy law requires us to identify a legal basis for processing your personal information, we rely on the following:

• Contract performance: processing necessary to provide the services you have requested or to enter into a binding agreement with you.
• Legal obligation: processing required to comply with applicable laws, including New York tenancy and security deposit laws.
• Legitimate interests: processing that supports our fraud prevention, platform security, and service improvement efforts, where such interests are not overridden by your rights.
• Consent: where we have obtained your consent, such as for promotional communications or optional data uses. You may withdraw consent at any time.

We do not sell your personal information. We share information only as described below.

4.1 Between Users

To facilitate a transaction, certain information is shared between Hosts and Renters:

• Before booking, Hosts can view a Renter's first name, profile photo, and booking request details, and Renters can view a Host's listing information, first name, and profile photo.
• At lease creation and signing, the parties' full legal names appear on the lease documents and the Reservation Payment Agreement, and the listing's full address is stated in the lease.
• Move-in coordination and access details are released on the schedule shown in the Platform.
• Platform records relating to your transaction, including messages, move-in documentation, and payment records, may be provided to the other party to that transaction for dispute resolution or legal proceedings, as described in our Terms of Service.

4.2 Service Providers

We share information with trusted third-party vendors who assist in operating the Platform:

• Stripe, Inc.: payment processing, ACH transfers, card transactions, Apple Pay, and Google Pay. Stripe's privacy practices are governed by Stripe's own Privacy Policy.
• Depository institution (deposit funds): reservation payment and security deposit funds are held in dedicated, ring-fenced, FDIC-insured accounts at a third-party depository institution. That institution does not use depositor information for independent marketing purposes.
• Infrastructure and hosting providers: cloud services used to host, store, and transmit Platform data.
• Analytics and monitoring tools: services used to monitor Platform performance and detect errors, operating on aggregated or pseudonymized data where possible.

All service providers are contractually bound to use your information only as directed by Merriday and consistent with applicable privacy law.

4.3 Legal and Safety Disclosures

We may disclose your information if we believe disclosure is necessary to:

• Comply with a legal obligation, court order, subpoena, or valid governmental request.
• Protect the rights, property, or safety of Merriday, our users, or the public.
• Detect, prevent, or address fraud, security, or technical issues.

4.4 Business Transfers

If Merriday is involved in a merger, acquisition, financing, restructuring, or sale of assets, your information may be transferred as part of that transaction. We will notify affected users via the Platform or by email before any such transfer results in a material change to your privacy rights.

We retain your personal information for as long as necessary to provide you with the services you have requested, comply with legal obligations, resolve disputes, and enforce our agreements.

Transaction records, executed lease agreements and other executed agreements, signature logs, communications relating to a tenancy, and deposit records are retained for a minimum of six (6) years following the conclusion of the relevant transaction, consistent with applicable statutes of limitations.

You may request deletion of your account and personal data subject to the exceptions described in Section 7.

We implement appropriate technical and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including encryption of data in transit and at rest, access controls limiting personnel access on a need-to-know basis, and ring-fenced deposit accounts maintained separately from operating funds.

No method of transmission over the internet or electronic storage is completely secure. In the event of a data breach affecting your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law, including New York's data security and breach notification requirements.

7.1 Access and Portability

You may request a copy of the personal information we hold about you. Where technically feasible, we will provide this in a structured, machine-readable format.

7.2 Correction

You may update or correct inaccurate information in your account settings at any time. For information you cannot update directly, contact us at the address in Section 11.

7.3 Deletion

You may request deletion of your account and personal information. We will honor such requests subject to our legal obligations to retain certain records, including executed lease agreements and financial transaction records as described in Section 5.

7.4 Opt-Out of Marketing Communications

You may opt out of promotional communications by using the unsubscribe link in any such message or by updating your notification preferences in your account settings. You cannot opt out of transactional messages necessary to complete or manage active bookings.

7.5 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information. Merriday does not sell or share personal information for cross-context behavioral advertising. To exercise your California rights, contact us at the address in Section 11.

7.6 How to Exercise Your Rights

To exercise any of the rights described above, please contact us at support@merriday.co. We will respond to verifiable requests within the timeframes required by applicable law. We may need to verify your identity before processing certain requests.

We use cookies for session management and authentication ("strictly necessary cookies") and to analyze how users interact with the Platform ("analytics cookies"). We do not use third-party advertising cookies or enable interest-based advertising on the Platform.

Most browsers allow you to refuse or delete cookies through their settings. Blocking strictly necessary cookies may impair your ability to use the Platform.

The Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us at support@merriday.co and we will take steps to delete that information.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this Policy, post a notice on the Platform, and send a notification to the email address associated with your account where required by law.

Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: support@merriday.co.