HouseKey by Fortress Hospitality

How we collect SMS consent

Last updated: September 11, 2026

HouseKey is operated by Nicolas Brem, doing business as Fortress Hospitality. This page documents exactly how a person opts in to text messages from HouseKey, for anyone verifying our messaging program.

Where consent is collected

Four places, and only four: three for members and applicants, and one for venue staff. The web screens each show a separate checkbox that is not pre-selected:

joinhousekey.com/apply — the membership application, at the “Submit application” button.
joinhousekey.com/member — the member sign-in screen, directly above the send button. The box picks where the sign-in code goes: untouched, the button reads “Email me a code” and the code goes to the address on the membership; ticked, it reads “Text me a code”. The button is never disabled for want of consent, and there is no step on this screen that consent unlocks.
In person at a venue — a spoken question and a separate unticked box on a staff device. It has no public URL, so the exact words and the exact control are published below.
Venue staff, in the staff app — a separate program for the people who run a venue: operational alerts they switch on themselves, behind a staff login, so the exact control is published below.

The control, exactly as it appears

☐ Text me sign-in codes and notices about my membership at this number.

Message frequency varies. Message and data rates may apply. Reply STOP to opt out, HELP for help. Consent is not a condition of applying or of any purchase — leave this unticked and we’ll email you instead. See our Terms and Privacy Policy.

The box renders unticked on every visit. It is never pre-selected, never remembered between visits, and never checked on the user’s behalf.

Declining is fully supported

Consent is not a condition of anything. A person who leaves the box untouched can still submit an application, be approved, receive a membership pass, and sign in:

On the sign-in screen, declining is the default state, not a fallback: with the box untouched the one send button reads “Email me a code”, is fully enabled, and signs the member in without sending anything to their phone.
Nothing anywhere in HouseKey is disabled, hidden, or greyed out until someone consents to messaging. There is no button, step, or feature that ticking the box unlocks — it changes only whether a code arrives by text or by email.
Every notice we would have texted goes to their email address instead.
The membership application submits normally with the box unticked.

Enforced on the server, not just in the interface

Opt-in is recorded per phone number with a version, a timestamp, and the surface it came from. Every outbound SMS passes through a single server gate that checks that record; a number with no recorded opt-in is not texted, regardless of what any client asks for. Declining is a data fact, not a UI state.

In-person opt-in at a venue

This is our third and only other opt-in path, and the only one that has no public URL: it happens on a venue staff member’s own device, on a screen behind a staff login, while the consumer is standing at the door. Everything a reviewer would look for on a web form is reproduced below.

The call to action, read aloud, before anything is ticked. Staff ask the consumer this question in these words:

“Can we text you sign-in codes and notices about your membership at this number? Message frequency varies, message and data rates may apply, and you can reply STOP any time. It’s optional — say no and we’ll email you instead.”

Only if the consumer says yes does staff tick the consent box on the approval screen. That box is a separate control from the approval itself, and it renders unticked on every approval:

☐ They agreed to texts from HouseKey. Ask first, out loud: “Can we text you sign-in codes and notices about your membership at this number? …”

Consent here is not forced, and cannot be:

The question is asked before the box exists to tick, and it names the alternative (“say no and we’ll email you instead”) in the same sentence.
Approving a membership does not enroll anyone. The approval and the consent box are separate actions; staff complete approvals with the box untouched, and the member’s pass works immediately either way.
Nothing is pre-filled or remembered. The box starts unticked for every person, every time.
A person who declines is told so on screen — “they didn’t opt in to texts, so no profile link was sent” — and finishes their profile by signing in and receiving codes by email.
The consent is recorded against that phone number with a version, a timestamp, and the source staff_in_person, and passes through the same server gate as the web checkbox. No record, no message.

Staff operational alerts

Venue staff who review membership applications can ask HouseKey to text them when something needs them: a new application, an applicant’s answer to a question they asked, or an invited teammate joining. This is a separate, opt-in program for staff, not for members, and nobody is enrolled by their role, by their employer, or by being invited to a venue. The screen lives in the staff app behind a staff login, so the control is reproduced here exactly as it appears.

Step 1. The staff member opens “Text alerts” in their own settings, enters their own mobile number, and sees this box, which renders unticked every time:

☐ Text me the HouseKey staff alerts I turn on below, at this number.

Operational alerts for venue staff, at most 6 an hour. Message and data rates may apply. Reply STOP to opt out, HELP for help. Optional: the queue and email alerts work without it.

Step 2. They tap “Text me a code”. One message goes to that number: HouseKey code: 123456. Enter it to turn on staff text alerts. Entering the code proves they hold the number. The tick together with the verified code is the consent record.

Step 3. Each alert is its own switch, all off until the staff member turns it on:

New membership applications — at any venue where they review applications.
Answers to their Needs Info requests — when an applicant replies to what they asked.
Invites accepted — when someone they invited joins the team.

Consent here is not forced, and cannot be:

Declining costs nothing. Every alert still arrives in the staff queue and by email; text is an extra channel, never the only one.
No manager, owner, or administrator can enroll a staff member or tick the box for them. Only the person holding the phone can, and only after entering the code sent to it.
Nothing is pre-filled or remembered. The box starts unticked for every person, every time, and turning off the last switch stops the texts.
Sending is capped at 6 alerts an hour per person, enforced on the server.
The consent is recorded against that phone number with a version, a timestamp, and the source, and passes through the same server gate as every other message. A number that replied STOP is not texted until it replies START and verifies again.

What we send

One-time sign-in passcodes.
A receipt when a membership application is submitted.
A link to open the membership pass when an application is approved.
Notices about the person’s own membership at a venue they belong to.
To venue staff who opted in above: a code to verify their number, and the operational alerts they switched on, each with a link to the item.

No marketing or promotional content is sent. Phone numbers are never purchased, rented, or shared, and consent is never transferred to another business. Reply STOP to opt out at any time, or HELP for help.

Contact

nicolasrobertbrem@gmail.com · Terms · Privacy Policy