Privacy notice – Keyfly app

This English text is provided for information only. In case of any discrepancy, the Hungarian version in Part I prevails.

1. Who processes your data, and what does this notice cover?

1.1. Controller:

• Plattio Magyarország Kereskedelmi Korlátolt Felelősségű Társaság (Plattio Magyarország Kft.)
• Registered office: 1061 Budapest, Andrássy út 5. 3. em. 8., Hungary
• Company reg. no.: Cg. 01-09-351494; tax no.: 27275421-2-42
• Email: support@keyfly.app
• Brand: Keyfly (https://keyfly.app, app: https://app.keyfly.app)

1.2. Scope. This notice covers processing in the Keyfly app (app.keyfly.app): accounts and account security (two-step verification, active sign-ins), company accounts and teams, email notifications, phone confirmation, bank accounts, properties, leases, invitations, quotes, checks (identity, income, KHR), payments, claims and support. Processing for the keyfly.app website waitlist is covered by a separate notice.

1.3. Legal framework. Processing is governed by the General Data Protection Regulation (EU) 2016/679 (GDPR), Hungarian Act CXII of 2011 on informational self-determination and freedom of information (Infotv.), and the insurance secrecy rules of Act LXXXVIII of 2014 on Insurance Activity (Bit.).

1.4. Role of the Partner Insurer. The deposit-replacement guarantee is provided by the Partner Insurer, which processes data for underwriting, claims and recovery as an independent controller under its own privacy notice.

2. Purposes, legal bases and data categories

The table shows, per purpose, the data subjects, data categories and legal basis under GDPR Article 6(1). Retention periods are in section 3 (column “R” points there).

2.1. Data received from others. If another User provides your data (e.g. as invitee, Co-tenant or Occupant), we inform you of this notice at first contact (invitation email), and at the latest within one month (GDPR Art. 14).

2.2. Legitimate interest. We carry out a balancing test for processing based on legitimate interest, available on request. You may object to such processing (section 8).

2.3. Special categories. We do not ask for special-category data (e.g. health or religious data). In open-banking checks we only examine credits (income) and do not store details of debits.

2.4. Consequence of not providing data. Data needed for purposes A, C and F–I is a condition of the service or the quote; without it we cannot create an Account or give a quote.

2.5. Email notifications. You can switch off service notifications (row Q) by topic in your settings: lease changes, reminders before the lease term ends, Team (access requests, Account holder changes), invoices. Invitations and security notices (e.g. two-step verification turned on or off, sign-in with a backup code) are always sent. Emails about Keyfly news (row T, at most one a month) are off by default: we only send them if you turn the switch on, and you can withdraw your consent at any time by turning it off.

2.6. Source of Company account data. When a Company account is created, we send the first eight digits of the tax number entered to the számlázz.hu taxpayer lookup service, which returns the organisation's name, tax number and registered office from the NAV taxpayer register (row B, section 4.4). This data is retrieved again when the Company account is created. Later, the Account holder and Admins can edit the company details by hand (except the first eight digits of the tax number) and retrieve them again with “Refresh from NAV”; this too sends only the first eight digits of the tax number, and the retrieved data is only stored in the Company account when saved. The Company account's contact email and phone number may be an employee's personal data (e.g. an email address containing their name).

2.7. Phone number. Giving your phone number is optional. We use it to contact you about the lease and the insurance and (planned) to confirm your identity when you request insurance. When you add or change the number, you must confirm it with a 6-digit code sent by SMS; this requires a confirmed email address. The code is generated by our processor Twilio's Verify service (section 4.3), sent from a sender Twilio chooses per country (with the text “A Keyfly ellenőrző kódod: …” and a warning not to share it), and checked by Twilio; Keyfly never sees or stores the code. Twilio receives your phone number and, as part of the service, also processes it for fraud prevention (Fraud Guard). The code is valid for 10 minutes; Twilio blocks it after too many wrong tries. We request at most 3 codes an hour and 10 a day. We only send SMS to mobile numbers used in the European Union and EEA member states, Switzerland, the United Kingdom, Ukraine, Serbia, the United States and Canada. We keep the phone number and the time of confirmation until you remove it or delete the Account.

2.8. Bank accounts. We use the bank accounts given for your personal account or a Company account to pay claims and refunds; payouts go to the primary account in the payout currency. Hungarian account numbers are converted to IBAN and the check digits are verified locally; no external bank service is used for this.

2.9. Sign-in with Google. If you sign up or sign in with your Google account, Google (Google Ireland Limited or Google LLC), as an independent controller, identifies you in its own sign-in service (Google Privacy Policy) and passes us your name, email address and Google account identifier. We use these to sign you in and to create your Account; we do not use or store your Google profile picture. Legal basis: (b) contract (the sign-in method you choose). You can unlink the Google account under Settings → Sign-in and security; we then delete the link to the Google account identifier, and you can later link another Google account. Your Account's sign-in email does not change when a Google account is linked. The Keyfly staff portal (admin) does not offer Google sign-in.

3. How long do we keep your data?

We keep data only as long as needed for the purpose or to meet a legal obligation. Where there is a dispute, regulatory proceeding or open claim/recovery, the data concerned is kept until it is finally closed. After the retention period, data is deleted or irreversibly anonymised.

4. Who can see your data?

4.1. Keyfly staff access data only as needed for their tasks, with two-factor authentication; access is recorded in the audit log. Staff are bound by confidentiality.

4.2. Other Users. Lease data is visible to the Landlord and Tenant (and Co-tenants); Company account data is visible to Team members according to their Role. Team members see each other's name, email and Role; for an access request, the Account holder and Admins see the requester's name, email and message. Your profile photo, home and mailing address, and your lists of active sign-ins and trusted devices are not visible to other Users (Team members, the other party to a Lease); your addresses are not copied into Lease data either. A Company account's company details – including the contact email and phone number – are visible to all its Team members. A Company account's bank accounts are also visible to all Team members, but only the Account holder and Admins can add, change or delete them; your personal account's bank accounts are not visible to other Users. Keyfly staff may see bank accounts for payouts (section 4.1). The other party does not see raw check data (M5); the Landlord.

4.3. Processors (acting on Keyfly's behalf under a data processing agreement):

4.4. Independent controllers to whom we transfer data, or who process your data directly for their own service:

• Partner Insurer – underwriting, contract, claims, recovery;
• Payment provider – card and payment data;
• Licensed account information service provider – retrieving bank account data based on your consent;
• Identity provider – identity verification;
• Google Maps Places – when you enter the rented property's address, your home or mailing address, or a Company account's address, Keyfly's server forwards the text you type to Google and receives address suggestions. Google receives only the typed text: not your name, email address or IP address; your browser does not connect to Google directly and no Google cookie is placed on your device. The suggestion list shows a "Powered by Google" label;
• Google Ireland Limited / Google LLC – sign-in with Google, if you choose it: Google identifies you in its own sign-in service as an independent controller and passes us your name, email address and Google account identifier (section 2.9; Google Privacy Policy);
• számlázz.hu – when a Company account is created and when “Refresh from NAV” is used, we send the first eight digits of the tax number entered and receive the organisation's name, tax number and registered office from the NAV taxpayer register (section 2.6); no personal data about the User is sent;
• Authorities and courts (e.g. NAIH, MNB, police) – only on a request based on law.

4.5. Transfers outside the EU. Your data is stored primarily in the EU. Supabase, Vercel, Resend, Google, Twilio and Cloudflare have US parent companies or are based in the US, so access from outside the EU may occur for support, maintenance or network purposes. Any such transfer relies on certification under the EU–US Data Privacy Framework (GDPR Art. 45) or on the European Commission's standard contractual clauses (GDPR Art. 46). You can request a copy of the safeguards at support@keyfly.app.

5. Automated decision-making and profiling

5.1. When do we decide automatically? When you request a quote, the Platform assesses whether you are eligible for the deposit-replacement guarantee and at what Fee. If it is fully automated and produces legal effects concerning you or similarly significantly affects you (e.g. refusal or a higher Fee), GDPR Article 22 applies.

5.2. Legal basis. The automated decision is necessary for entering into the contract (GDPR Art. 22(2)(a)), as it enables an instant online quote.

5.3. Logic involved. The decision is based on the following factors:

• the result of identity verification;
• the ratio of verified income to rent;
• the deposit amount;
• for large deposits, data from the uploaded KHR report.

We do not use special-category data, nor any characteristic indicating sex, age, origin or another protected attribute.

5.4. Safeguards. If an automated decision affects you, you have the right to:

1. obtain human intervention (the decision is reviewed by an authorised employee of Keyfly);
2. express your point of view and submit further documents;
3. contest the decision.

You can make your request on the decision screen or at support@keyfly.app. We complete the review within 15 days and send you a reasoned outcome. We regularly test the decision model for errors and unjustified discrimination.

5.5. The Partner Insurer's decision. The final underwriting decision is made by the Partner Insurer; your related rights are set out in the Partner Insurer's privacy notice.

5.6. Marketing. We do not build marketing profiles from your data.

6. Cookies in the app

6.1. The app uses only cookies and similar local storage that are strictly necessary for its operation or for a feature you expressly request. Under section 155(4) of Act C of 2003 on Electronic Communications, these do not require consent.

6.2. We do not use analytics or marketing cookies in the app. If we introduce them, we will ask for your consent first. You can delete cookies in your browser settings; after deleting necessary cookies you will need to sign in again.

7. How do we protect your data?

Under GDPR Article 32 we apply technical and organisational measures appropriate to the risk, in particular:

• encrypted (HTTPS/TLS) transmission; storage in EU data centres;
• passwords stored only in hashed form; expiring email links (confirmation, password reset: 1 hour) and single-use invitation links (invitations: 7 days, staff invitations: 48 hours);
• role-based access (Account holder/Admin/Manager/Viewer); lease data accessible only to the parties concerned;
• staff access only with two-step verification and only as needed;
• optional two-step verification for Users with an authenticator app or a code sent by email (the code is stored only as a hash, valid for 5 minutes and stops working after 5 wrong tries); backup codes are stored only as SHA-256 hashes, backup-code attempts are limited to 10 an hour, and we always send an email when two-step verification is turned on or off and when a backup code is used to sign in;
• trusted devices: skipping the two-step code for 30 days only at the User's request (off by default); only the hash of the random token kept in the browser is stored; at most 10 devices per User, all deleted on a password change, when two-step verification is turned off and on a backup-code sign-in; not available to Keyfly staff;
• phone confirmation: a phone number is only added to the profile once confirmed with an SMS code; the code is generated and checked by Twilio and not stored by Keyfly; it is valid for 10 minutes, and Twilio blocks it after too many wrong tries; at most 3 codes an hour and 10 a day can be requested;
• bank accounts: IBAN check digits are verified locally; only the account's Account holder and Admins (for a personal account, you) can add, change or delete bank accounts, and changes are recorded in the audit log with only the last four characters of the account number and without the holder's name;
• a list of active sign-ins from which any other device can be signed out; after a password change, other devices are signed out automatically;
• changing the email address or password requires the current password, and deleting the Account requires the password and – if turned on – a two-step verification code;
• profile photos are kept in private storage, accessible only to the User, and shown through short-lived links;
• an append-only, immutable audit log;
• prompt deletion of raw check data (section 3, M5);
• data processing agreements with providers; regular backups.

We record any personal data breach, notify the NAIH within 72 hours where required (GDPR Art. 33), and inform you without undue delay if the breach is likely to result in a high risk to you (GDPR Art. 34).

8. Your rights and how to exercise them

8.1. Send your request to support@keyfly.app. We reply without undue delay and within one month at the latest; this may be extended by two further months where necessary, and we will tell you (GDPR Art. 12(3)). The procedure is free. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.

8.2. Closed leases. As a Tenant you have read-only access to a closed Lease during the retention period; erasure requests are assessed taking into account the retention obligations in section 3.

8.3. Downloading your data. In the settings (Your data → Download data) you can download, in one JSON file, your profile, your accounts and memberships, your access requests, your lease requests, the leases and properties visible to you, the invitations you sent, your consents, your quote requests, policies and claims, your active sign-ins (device, start, last activity), your two-step verification data (type, time turned on), your trusted devices (label, times marked, expiring and last used), the time your phone number was confirmed and the bank accounts of your accounts (GDPR Arts. 15 and 20). The file contains no secrets (e.g. invitation or backup codes).

8.4. Deleting your Account. You can delete your Account yourself in the settings (Your data → Delete account) by entering your password and – if you turned it on – a two-step verification code. Deletion is not possible while you are the Account holder of a Company account that has other members (you must hand over the Account holder role first), while you have an insurance policy or a claim (in that case support handles the deletion, taking the retention obligations in section 3 into account), if you are Keyfly staff, or if a property, lease or lease request is linked to your personal account or to a Company account used only by you (in that case too, support handles the deletion: support@keyfly.app). On deletion, the following are deleted at once: your sign-in (with your sessions, two-step verification, backup codes and trusted devices), your profile (with the phone confirmation data) and profile photo, your personal account (with its bank accounts), your team memberships, your access requests, the records of your consents and quote requests, and any Company accounts of which you were the only member (with their bank accounts). In Company accounts that have other members, the data you recorded (e.g. properties, leases) stays with the Company account; audit log entries (M9) remain.

9. Remedies

9.1. You may first contact us (support@keyfly.app), but this is not a precondition for authority or court proceedings.

9.2. Complaint to the supervisory authority (GDPR Art. 77):

• Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
• Office: 1055 Budapest, Falk Miksa utca 9–11., Hungary
• Postal address: 1363 Budapest, Pf. 9.
• Phone: +36 1 391 1400
• Email: ugyfelszolgalat@naih.hu
• Website: https://naih.hu

You may also complain to the supervisory authority of the EU Member State of your habitual residence or place of work.

9.3. Judicial remedy (GDPR Art. 79, Infotv. s. 23): you may go to court; the case falls within the competence of the regional courts (törvényszék) and, at your choice, may be brought before the regional court of your place of residence or stay.

10. Data protection officer, changes, version

10.1. Data protection officer. Contact us on data protection matters at support@keyfly.app.

10.2. Changes. We update this notice when our processing or the law changes. We notify you by email and in the app before material changes. If new processing requires consent, we will ask for it separately.

10.3. Version:

• Version: account-privacy-2026-11-02
• Effective date: 2 Nov 2026
• Related documents: Keyfly General Terms; waitlist privacy notice; the Partner Insurer's privacy notice