Effective date: October 23, 2026
Last updated: October 23, 2026
This Privacy Policy explains how Michael Uhr, an individual doing business as LateKey ("LateKey," "we," "us" or "our") collects, uses, shares and protects personal information when you use the LateKey website, the LateKey iOS app and our related services (together, the "Services"). LateKey is a curated, same-day booking marketplace that connects identity-verified business travelers ("Travelers") with professional lodging operators ("Hosts"). We are launching in New York City, with Miami, Chicago, Boston, Washington, DC and Austin planned.
By using the Services you acknowledge this Privacy Policy. Where we need your consent (for example, for biometric data or precise location), we ask for it separately.
1. Who this policy applies to
This policy applies to Travelers, Hosts and their staff, people who join our waitlist or submit a host-interest form, and visitors to our website. The Services are intended for users in the United States.
2. Information we collect
Information you give us
- Account and profile information: name, company, work email address and phone number.
- Identity verification information: images of your government-issued ID and a live selfie, which are collected and processed by our identity verification partner (see Section 4).
- Payment information: card and payment details are collected and processed by Stripe. We do not store your full card number. We receive limited information from Stripe, such as the card brand, last four digits, expiration date and payment status.
- Host information: company name, contact details, property and unit details, information about the legal status of the property (such as hotel licensing or short-term rental registration), and payout details, which are collected by Stripe through Stripe Connect.
- Website forms: when you join the traveler waitlist we collect your name, work email, company and the city you travel to. When you submit the host-interest form we collect your name, email, company, property type, number of units and city.
- Communications: messages you send to us or to a Host or Traveler through the Services, and support requests.
Information collected automatically
- Booking history: listings viewed and booked, dates, prices, fees, deposit holds and any damage claims.
- Location: with your permission, the app uses your approximate or precise device location to show stays near you on the map. You can turn this off in your device settings at any time; you can still search by neighborhood.
- Push notification tokens: if you allow notifications, we store a device token so we can send booking updates.
- Device and analytics data: device type, operating system, app version, IP address, crash logs, and how you use the app and website (for example, pages and screens viewed).
Information from third parties
- Identity verification partner: the result of your verification (for example, pass, fail or needs review), the information extracted from your ID (such as name, date of birth and document expiration), and fraud and risk signals.
- Stripe: payment, deposit hold and payout status, and fraud-prevention signals.
- Hosts: information about your stay and, if relevant, a damage claim.
3. How we use information
We use personal information to:
- create and manage accounts and confirm that Travelers are 18 or older and eligible to use the Services;
- verify identity, prevent fraud and keep the community safe, including manual review and approval of Traveler accounts by our team;
- process bookings, the verification fee, service fees, damage deposit holds and claims, and Host payouts;
- share the details a Host needs to prepare for and manage a stay;
- show stays near you on the map;
- send booking confirmations, account messages and push notifications;
- provide support and resolve disputes;
- review Host listings for legal compliance, including New York City Local Law 18;
- understand and improve the Services, and fix errors;
- send waitlist and launch updates (you can unsubscribe at any time);
- comply with law, enforce our Terms of Service and protect our rights and the rights of others.
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it to track you across other companies' apps or websites.
4. Biometric data notice and consent
To verify a Traveler's identity, our identity verification partner compares the live selfie you take with the photo on your government ID. This process may create a facial geometry scan or template, which some laws treat as "biometric identifiers" or "biometric information" (including the Illinois Biometric Information Privacy Act, or BIPA, which will apply to us as we launch in Chicago, as well as laws in Texas, Washington and other states).
- Purpose: we use biometric data only to verify that you are the person on your ID and to prevent fraud. We do not use it for any other purpose.
- Who processes it: our identity verification partner performs the comparison on our behalf. [Confirm with the chosen partner whether LateKey itself receives or stores any face templates or selfie images.]
- Consent: before you take a selfie, the app will ask for your written consent (an in-app checkbox) to the collection, use and storage of your biometric data as described here. If you don't consent, you can't complete verification or book.
- No sale: we and our partner do not sell, lease, trade or otherwise profit from your biometric data.
- Disclosure: we disclose biometric data only to our identity verification partner, with your consent, or where required by law or valid legal process.
- Retention and destruction: biometric data is permanently destroyed when the initial purpose for collecting it has been satisfied, and in any case no later than [retention period, e.g., 1 year] after your last interaction with LateKey, and never later than 3 years after your last interaction. [Confirm the partner's actual deletion schedule and set the retention period.]
- Security: we protect biometric data with at least the same care we use for our other most sensitive information.
5. How we share information
We share personal information only as described here:
- Between Travelers and Hosts: when you book, we share with the Host the information needed for the stay, such as your name, stay dates and [phone number, if shared with Hosts]. Hosts see that you are verified; they do not receive your ID images or selfie. We share Host and listing information with Travelers.
- Service providers (processors): companies that process information on our behalf under contracts that limit their use of it:
| Provider | What it does | Data involved |
|---|---|---|
| Our identity verification partner (Stripe Identity) | ID document and selfie verification, fraud checks | ID images, selfie, biometric data, name, date of birth |
| Stripe (including Stripe Connect) | Payments, deposit holds, Host payouts | Payment and payout details, transaction data |
| Supabase (United States) | Database, authentication and file storage | Account, booking and app data |
| Netlify | Website hosting and website forms | Waitlist and host-interest form submissions, IP address |
| Expo (push notifications) | Delivering push notifications | Push tokens, notification content |
| Google Maps | Maps and location search in the app | Location (approximate or precise), map searches |
| [Analytics / crash reporting provider, if any] | App analytics and crash reports | Device and usage data |
| Resend (email delivery) | Sending account and waitlist emails | Name, email address |
- Legal and safety: to comply with law, a subpoena or other legal process; to respond to a claim; or to protect the safety, rights or property of LateKey, our users or the public.
- Compliance with lodging laws: where a law requires it (for example, local short-term rental or tax rules), we may share booking information with government authorities or with Hosts to meet their legal obligations.
- Business transfers: in a merger, acquisition, financing or sale of assets, subject to this Privacy Policy.
- With your consent or at your direction.
6. Data retention
We keep personal information only as long as we need it for the purposes in this policy, then delete or de-identify it.
| Data | How long we keep it |
|---|---|
| ID images and selfie | Deleted by our identity verification partner [retention period, e.g., within 30 days] after verification is complete |
| Biometric data (face geometry) | See Section 4: no later than [retention period], and never more than 3 years after your last interaction |
| Verification result and audit record (pass/fail, date, reviewer decision) | For the life of your account plus [period], for fraud prevention and legal compliance |
| Account and booking records | For the life of your account plus [period, e.g., 7 years] for tax, accounting and legal purposes |
| Payment records | As required by law and Stripe's requirements |
| Waitlist and host-interest form submissions | Until launch plus [period], or until you ask us to delete them |
| Device and analytics data | [period, e.g., 24 months] |
7. Your choices
- Location: turn location access on or off in your iPhone settings.
- Push notifications: turn notifications off in your iPhone settings.
- Marketing email: use the unsubscribe link in any marketing email. We'll still send transactional messages about your account and bookings.
- Account deletion: you can delete your account in the app (in your account settings) or by emailing micuhr@gmail.com. We'll delete your information except what we must keep for the reasons in Section 6.
8. Your California privacy rights (CCPA/CPRA)
If you live in California, you have the right to:
- Know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we disclose it to;
- Delete personal information we collected from you, subject to legal exceptions;
- Correct inaccurate personal information;
- Opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined in California law, and we have no actual knowledge of selling or sharing information of anyone under 16;
- Limit the use of sensitive personal information. We collect sensitive personal information (government ID, biometric data, precise location, and account login details) only to provide the Services, verify identity and prevent fraud, which California law permits without offering a right to limit;
- Non-discrimination: we will not discriminate against you for exercising these rights.
Categories collected in the last 12 months: identifiers (name, email, phone, IP address, device identifiers); customer records (company, payment information through Stripe); characteristics of protected classifications (age, from your ID); commercial information (booking history); biometric information (face geometry, through our verification partner); internet and network activity (app and website usage); geolocation data (approximate or precise, with your permission); professional information (company, work email); and sensitive personal information (government ID, biometric data, precise geolocation). We use and disclose these categories for the purposes in Sections 3 and 5, and keep them as described in Section 6.
How to make a request: email micuhr@gmail.com. We'll verify your identity by matching information in your account, and we'll respond within 45 days (extendable once by 45 days with notice). You may use an authorized agent; we may ask for proof of the agent's authority and verify your identity directly. We honor Global Privacy Control signals as an opt-out of sale or sharing, although we don't sell or share personal information.
9. Other U.S. state privacy rights
Depending on where you live, state law may give you rights similar to those above (for example, to access, correct, delete or get a copy of your data, and to appeal our decision). To make a request, email micuhr@gmail.com. If we deny your request, you can appeal by replying to our decision with "Appeal" in the subject line, and we will respond within the time the law requires.
10. Note for New York residents
New York's SHIELD Act requires us to maintain reasonable safeguards for private information such as your ID number and account credentials (see Section 11). If a data breach involving your private information occurs, we will notify you and the relevant New York authorities as the law requires. New York City Local Law 18 requires short-term rental platforms to work only with eligible listings and may require us to report booking information to the City's Office of Special Enforcement; where it does, we share only what the law requires. You can contact us about your information at any time at micuhr@gmail.com.
11. Security
We use administrative, technical and physical safeguards to protect personal information, including encryption in transit, access controls and limiting access to sensitive data (such as ID images) to the people and providers who need it. No system is 100% secure, so we can't guarantee absolute security. If you think your account has been compromised, contact micuhr@gmail.com right away.
12. Children
The Services are for adults only. You must be 18 or older to create an account, join the waitlist or book. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. If you believe a minor has given us information, contact micuhr@gmail.com.
13. Where we store data
We and our main providers store and process data in the United States. Our database provider, Supabase, hosts our data in the United States.
14. Changes to this policy
We may update this Privacy Policy from time to time. We'll post the new version with a new "Last updated" date and, if the changes are material, notify you by email or in the app before they take effect.
15. Contact us
Michael Uhr, an individual doing business as LateKey
[Mailing address]
Privacy questions, requests and support: micuhr@gmail.com