Privacy Policy

1. Scope and Controller

This Privacy Policy ("Policy") describes how Keytostay LLC ("Keytostay," "we," "us," or "our"), a Virginia limited liability company, collects, uses, shares, and protects personal information ("Personal Information") through (i) the website at keytostay.com and any subdomains, (ii) any tools, calculators, forms, or interactive features made available through the website, (iii) our phone, email, and SMS communications with you, and (iv) our short-term rental ("STR") property-management services performed under an Owner Services Agreement (collectively, the "Services").

Keytostay is the controller of the Personal Information we collect through the Services, except where we process Personal Information on behalf of a property owner under an Owner Services Agreement, in which case the owner is the controller and Keytostay is the processor with respect to that data.

2. Categories of Personal Information We Collect

2.1 Identifiers and contact details. Name, email address, postal address, telephone number, and other contact information you provide when you submit a form, request a quote, call us, or sign up as an active owner.

2.2 Property information. Property address, location data (city, state, ZIP), bedroom count, property type, current management situation, current revenue (if you choose to share it), photos, listing credentials (for active owners), and similar details necessary to project revenue or operate your property.

2.3 Financial information (active owners only). Owner banking and ACH details for payout processing, tax-identification information (e.g., W-9 information) required for 1099 reporting, payout records, and platform-account credentials needed to operate your listings. We do not collect or store credit-card data; payments to vendors are processed by our payment processor (Stripe) directly.

2.4 Communications. The content of emails, phone calls, text messages, voicemails, and chat sessions between you and our team or our AI phone agent, including recordings or transcripts of those calls where lawful. Recordings are stored solely for service-delivery, quality-assurance, and training purposes.

2.5 Usage data. Aggregate information about how visitors interact with the website (pages viewed, links clicked, device type, approximate location derived from IP). We use Plausible Analytics, which is cookieless and does not track individuals across sites.

2.6 Inferences. Inferences we draw from the categories above (for example, that a particular caller is likely a good fit for our service based on the property type and location they describe).

2.7 Sensitive Personal Information. We do not knowingly collect sensitive Personal Information (such as government-issued ID, biometric data, precise geolocation, or health information) except where required for operational compliance (e.g., a property owner's tax-identification number for IRS reporting).

3. Sources of Personal Information

We collect Personal Information from the following sources:

• Directly from you, when you submit a form, call us, email us, or sign an agreement.
• Automatically, when you interact with the Services (page-view data via Plausible; basic server-side request metadata).
• From third parties, including booking platforms (Airbnb, Vrbo, Booking.com) that share guest reservation data necessary to operate your property; vendors we engage on your behalf; and (for active owners) public property records and tax authorities where required.

4. How We Use Personal Information

We use Personal Information for the following purposes:

• To provide the Services — respond to inquiries, prepare revenue projections, prepare and execute Owner Services Agreements, manage listings, communicate with guests on your behalf, dispatch cleaning and maintenance, process payouts, and prepare tax documents.
• To communicate with you — send transactional messages (confirmations, statements, callback scheduling), service-related notices, and (with your consent or as otherwise permitted) marketing.
• To improve the Services — analyze aggregate usage, troubleshoot, test, develop new features, and train customer-service agents (human and AI).
• To comply with law — including tax reporting, anti-money-laundering screening, court orders, subpoenas, and lawful requests by public authorities.
• To protect rights and prevent fraud — including investigating misuse of the Services, enforcing our Terms, and protecting the rights, property, or safety of Keytostay, our users, or others.

5. Legal Bases for Processing (where applicable)

Where the GDPR or similar laws apply, we rely on the following legal bases: (i) performance of a contract with you (for active owners under an Owner Services Agreement); (ii) legitimate interests, such as responding to inquiries, improving the Services, and securing the Services, balanced against your interests; (iii) consent, where required (for example, for marketing emails or SMS); and (iv) legal obligation, where processing is required by law (e.g., tax reporting).

6. How and With Whom We Share Personal Information

We do not sell your Personal Information for money. We share Personal Information only in the following circumstances:

6.1 Service providers (sub-processors). We share Personal Information with the following categories of vendors that process it on our behalf, under written contracts that restrict their use of the data:

6.2 Booking platforms. For active owners, we share listing content, calendar availability, and pricing with Airbnb, Vrbo, Booking.com, Google Vacation Rentals, and our direct-book site so guests can book your property. Guest contact details flow back to us from those platforms for purposes of guest communication.

6.3 Legal and safety. We may disclose Personal Information if we believe in good faith that disclosure is necessary to (a) comply with applicable law, regulation, legal process, or governmental request; (b) enforce these terms or our agreements with you; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of Keytostay, our users, or the public.

6.4 Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, Personal Information may be transferred to the surviving entity, subject to this Policy or a comparable policy at the acquirer.

6.5 With your consent. We share Personal Information for any other purpose disclosed to you at the time we collect the information or with your consent.

7. "Sale" or "Sharing" Under State Law

Keytostay does not sell Personal Information for money. In the broader senses defined by the California Consumer Privacy Act ("CCPA") and similar state laws, we likewise do not "sell" or "share" Personal Information for cross-context behavioral advertising. We do not use third-party advertising cookies. We have not sold or shared Personal Information of any individual under sixteen (16) in the preceding twelve months.

8. International Data Transfers

Keytostay is based in the United States. If you access the Services from outside the United States, your Personal Information may be transferred to, stored in, and processed in the United States or other countries where our service providers operate. Where required, we use Standard Contractual Clauses or comparable safeguards in our contracts with international processors.

9. Data Retention

We retain Personal Information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Typical retention periods:

• Lead inquiries (no agreement signed): up to 24 months from last interaction, then deleted or anonymized.
• Active-owner records: for the duration of the Owner Services Agreement plus seven (7) years after termination, to satisfy tax and accounting obligations.
• Call recordings and transcripts: up to 13 months from the date of the call, unless retained longer for a specific dispute or legal hold.
• Aggregate analytics: indefinitely, in a form that cannot identify any individual.

10. Security

We implement administrative, technical, and physical safeguards reasonably designed to protect Personal Information against unauthorized access, alteration, disclosure, or destruction. These include TLS encryption in transit, encrypted-at-rest storage for sensitive data, access controls based on least privilege, multi-factor authentication for administrative accounts, and continuous monitoring. No system is perfectly secure; we cannot guarantee absolute security and you provide Personal Information to us at your own risk.

11. Your Rights

Depending on where you live and where the data is processed, you may have any or all of the following rights with respect to Personal Information about you:

• Right to know / access — to obtain a copy of the Personal Information we hold about you and information about how we process it.
• Right to correct — to require us to correct inaccurate or incomplete Personal Information.
• Right to delete — to require us to delete Personal Information about you, subject to exceptions (such as our obligation to keep tax records).
• Right to opt out of sale or sharing — to opt out of any "sale" or "sharing" of Personal Information as defined by applicable state law. Keytostay does not engage in either practice.
• Right to limit use of sensitive Personal Information — to direct us to limit our use to what is necessary to provide the Services.
• Right to data portability — to receive Personal Information you provided to us in a structured, commonly used, machine-readable format.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.
• Right to appeal — if we deny a rights request, you may appeal by contacting support@keytostay.com.

To exercise any of these rights, email support@keytostay.com with the subject line "Privacy Request." We will verify your identity (typically by confirming the email address associated with our records and asking targeted verification questions) and respond within the time limits required by applicable law (generally 45 days, extendable once by 45 days). You may also designate an authorized agent to make a request on your behalf; we will request written authorization from you before honoring such a request.

12. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), provides you with the specific rights listed in Section 11 above. We have collected the following categories of Personal Information in the last twelve (12) months: identifiers (name, email, phone); commercial information (services purchased or considered); internet/network activity (usage data); geolocation (approximate, from IP); audio data (call recordings, when applicable); professional/employment-related information (property-management situation); inferences. We have not sold or shared (for cross-context behavioral advertising) any Personal Information.

"Shine the Light." California residents may also request, once per calendar year, information regarding our disclosure of Personal Information to third parties for their direct-marketing purposes. We do not make any such disclosures.

13. Virginia, Colorado, Connecticut, Utah, and Similar States

If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), or another U.S. state with comparable comprehensive privacy legislation, the rights listed in Section 11 apply to you to the extent provided by your state's law. To exercise a right, follow the procedure in Section 11. We will not discriminate against you for exercising any right under these laws.

14. Children's Privacy

The Services are not directed to children. We do not knowingly collect Personal Information from anyone under the age of sixteen (16) and we do not knowingly sell or share Personal Information of minors under 16. If you believe we have collected Personal Information from a minor, please contact us at support@keytostay.com and we will promptly delete it.

15. Cookies and Tracking Technologies

We use a minimal set of strictly-necessary technologies on the Services. We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking. Specifically:

• Plausible Analytics — cookieless, IP-anonymized aggregate analytics. No personal identifier is set in your browser.
• Strictly-necessary local storage — used to remember a session and to suppress an exit-intent modal you've already dismissed.

We honor Global Privacy Control ("GPC") signals to the extent required by applicable law. We do not currently respond to legacy "Do Not Track" browser signals because there is no industry consensus on how to interpret them.

16. Marketing Communications and SMS

We send marketing emails only to people who have requested information about our services or who otherwise consent to receive them. You can unsubscribe at any time by clicking the link in any marketing email or by emailing support@keytostay.com. If you give us your phone number, we may use it to follow up about your inquiry and (if you opt in) send transactional or marketing SMS messages. Message and data rates may apply. Reply STOP to opt out of SMS at any time.

17. Third-Party Links and Services

The Services may contain links to third-party websites and services that are not operated by Keytostay. We are not responsible for the privacy practices of those services. We encourage you to read the privacy policy of any third-party service before providing it with Personal Information.

18. Changes to This Policy

We may revise this Policy from time to time. When we do, we will update the "Last updated" date at the top. If we make material changes, we will provide additional notice (such as a banner on the Site or an email to addresses we have on file). Changes will not apply retroactively and will become effective no sooner than thirty (30) days after they are posted, unless required by law to take effect sooner.

19. Contact

To exercise a privacy right, ask a question, or submit a complaint about this Policy or our handling of your Personal Information, contact:

Keytostay LLC — Privacy
Roanoke, Virginia
Email: support@keytostay.com (subject: "Privacy Request")
Phone: (833) KEY-STAY

EU/UK residents may also lodge a complaint with their local data-protection authority. California residents may contact the California Privacy Protection Agency at cppa.ca.gov.