Privacy Policy
Last Updated: Oct 22, 2026
Lofty Inc., along with our affiliates and subsidiary sites and services (collectively, “Lofty”, “company”, “we”, “our”, “us”) are committed to protecting the privacy of our customers. Lofty is a leading technology provider for real estate professionals and provides a robust CRM platform and real estate website solution for individuals or organizations of any size.
This Privacy Policy is designed to help you understand how we collect and use personally identifiable information (“Personal Information” or “PII”) that you provide us and to help you make informed decisions when using our website and mobile services (collectively, “Website”, “Site”, “Services”, or “App”).
By visiting or using any part of this website or our services, you agree to the terms of this Privacy Policy as they may be amended from time to time. As we update our Website and Services over time, this Privacy Policy may change.
Important Notice to European Union Individuals: The General Data Protection
Regulation (GDPR)
By using this site and services, you agree to take basic steps to ensure your privacy online. You agree to log out of this site when you are finished, protecting your information from other users. You also agree not to share your password or login ID with anyone else. In addition, you agree to take reasonable precautions against malware and viruses by installing an antivirus software to protect your online activities.
“Personal Information” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Personal Information may include the following: name, address, date of birth, gender, credit card/payment information, username and password, and contact data (i.e., email address, telephone number, and employer name).
If you use Site features operated by third-party social networking services (such as Facebook), we may receive information you have made available to those services, including the geographic location of your mobile device and other information about you (such as name, email address, gender, locale, time zone, languages, social media profile URL, personal website URL, biographical information, date of birth, photo, list of devices, education history, work history, hometown, interests, current city, political views, favorite athlete and teams, relationship status and information, religion, name of significant other, and certain security settings information) and your contacts on those services. Some of these social networking services allow you to push content from our Sites to your contacts or to pull information about your contacts so you can connect with them on our Sites. Some of these services also will facilitate your registration for our Sites or enhance or personalize your experience on our Sites. You should make sure you understand the information your third-party social networking services may make available to our Sites.
We may also collect information that is related to you but that does not personally identify you (“Non-personal Information”). Non-personal Information also includes information that could personally identify you in its original form, but that we have modified (for instance, by aggregating, anonymizing or de-identifying such information) in order to remove or hide any Personal Information.
This Privacy Policy applies to Personal Information and other information collected by Lofty or its service providers from or about:
- Visitors to, or users of, its websites or mobile applications
- Prospective and current customers using Lofty’s services
- Service providers and business partners
- Prospective and current employees
- Other third-parties that Lofty interacts with
We collect this information to continually improve and enhance the functionality of Lofty. We gather certain information automatically. This information may include IP addresses, browser type, Internet Service Provider (ISP), referring/exit pages, operating system, date/time stamp, and/or click stream data. We link this automatically collected data to other information we collect about you.
We take your privacy seriously and employ information protection controls in keeping with industry standards and practices or applicable governmental requirements to safeguard your information and protect your anonymity. Personal Information about you may be collected from you through various sources, including information (i) that is entered manually and voluntarily by you on the Site’s application and other forms or postings on the Site; (ii) that you provide regarding your preferences (for example, based on your activity on our website); (iii) from other sources with your consent (for example, from other institutions such as auditors or administrators); (iv) from sources in the public domain; and (v) from other interactions you may have with us (for example, discussions or emails with our staff, including through the use of the Site’s contact features).
In addition, when you visit our Site, we may gather anonymous technical and navigational information, such as computer browser type, Internet protocol address, cookie information, pages visited, and average time spent on our Website. This information does not personally identify you and may be used, for example, to alert you to software compatibility issues, to customize any advertising or content you see, fulfill your requests for products and services, contact you, conduct research, or analyze and improve our Site design and functionality.
Such information collected by us is stored and processed in the United States. By using the website and our Services, you consent to the foregoing collection and use of information and any such transfer of information outside of your country. We make no representation or warranty with respect to any duty to permanently store any Personal Information you may provide.
In order to provide the best experience when you visit our website, we may ask you for Personal Information. Personal Information includes, for example, your name and e-mail address, both of which you may be asked to provide when registering with Lofty. A description of some of the ways that you may provide Personal Information to us, as well as further details on how we may use such Personal Information, is given below.
If you email us using a "Contact Us" link or form on our Website, we may ask you for information such as your name and e-mail address so we can respond to your questions and comments. If you choose to correspond with us via e-mail, we may retain the content of your e-mail messages, your e-mail address, and our response to you.
We may occasionally ask website visitors to complete online surveys and opinion polls about their activities, attitudes, and interests. These surveys help us improve our products and services. When asking for participation in these surveys, we may ask you to provide us with your name and email address.
Our Website may offer visitors contact forms to request additional details and to download collateral. If you fill out one of our web forms, we may ask you for information such as your name and email address so we can respond to your questions and comments. If you choose to correspond with us via web forms, we may retain the form data which can include name, email address and other contact related details.
Our Website links to community platforms that provide individuals the opportunity to ask questions and answer questions within the Lofty user community. This community user data may contain self-reported demographics. If you choose to correspond with us and the community using these platforms, we may retain the data which could include name, email address, and other contact related details.
Technologies such as: cookies, beacons, tags, and scripts are used by Lofty and our marketing partners, analytics providers, and customer support systems. These technologies are used in analyzing trends, administering the site, tracking users’ movements around the site and gathering demographic information about our user base as a whole. We may receive reports based on the use of these technologies by these companies on an individual as well as aggregated basis.
We may supplement data we collect through automated means with information about your location (such as your zip code) to provide you with content that may be of interest to you.
When you visit Lofty, we may use cookies on or in connection with our Website to maintain information about you. A cookie is a very small text file, which often includes an anonymous unique identifier and additional information necessary to support the site's intended functionality. Lofty uses session cookies. A session cookie is temporary and disappears after you close your browser. Our cookies do not, by themselves, contain Personal Information. We use cookies to enable our servers to recognize your web browser and tell us how and when you visit the Site and otherwise use the Services through the Internet. Collecting this information helps us design the site and the services to best suit your needs. This information may be compiled and analyzed on both an individual and an aggregate basis.
We use cookies for marketing and for authentication. Users can control the use of cookies at the individual browser level. If you reject cookies, you may still use our site, but your ability to use some features or areas of our site may be limited.
Most web browsers can be set to tell you when a cookie has been sent to you and give you the opportunity to refuse that cookie. Refusing a cookie may in some cases prevent you from using or negatively impact the display or function of our Website or certain areas or features of our Website. There are numerous resources on the Internet that can provide more information about how cookies work and how you can manage them.
If advertisements appear on our website or services, the advertisers may employ cookies and other tracking technologies in connection with those advertisements. Your accessing any of those advertisements from our webpage may cause your exposure to those tracking technologies. Third party websites that you visit may use the cookies placed by third party vendors for similar purposes. We have no responsibility for any such cookies and other tracking technologies.
Web Beacons, also known as pixel tags and clear GIFs, ("Web Beacons"), are electronic images that allow a website to access cookies and help track marketing campaigns and general usage patterns of visitors to those websites. Web Beacons can recognize certain types of information, such as cookie numbers, time and date of a page view, and a description of the page where the Web Beacon is placed. No personally identifiable information about you is shared with third parties through the use of Web Beacons on the Site. However, through Web Beacons, we may collect general information that will not personally identify you, such as: Internet browser, operating system, IP address, date of visit, time of visit, length of visit, and path taken through the Site.
- Internal use of Web Beacons: Lofty may use Web Beacons internally to count visitors and recognize visitors through cookies. Access to cookies helps personalize your experience when you visit the Site.
- Email: Lofty may include Web Beacons in HTML-formatted email messages that Lofty sends to you. Web Beacons in email messages helps determine your interest in and the effectiveness of such emails.
- External use of Web Beacons: Lofty may also use Web Beacons externally. For example, Lofty may report aggregate information about visitors, such as demographic and usage information, to its affiliates and other third parties. Lofty may also include other Web Beacons within the Site.
In addition to the information described above, when you use the Lofty mobile applications for Android and iOS ("Apps"), we and our service providers collect the following information from your device.
Device and installation identifiers
We collect identifiers that let us recognize your installation of the App and deliver its features:
- an installation identifier for the App, which is sent with every request to our servers, used to sign those requests, and used to secure your account (new-device verification, sign-in attempt limits, session binding). On Android this is a random identifier generated by the App when it is first launched and discarded when you uninstall the App. On iOS it is derived from Apple's identifier for vendor (IDFV) and stored in the device keychain, so it is retained if you reinstall the App;
- a Firebase installation identifier generated by Google's Firebase software development kit ("SDK"), used to report crashes and count active installations and, on Android, to deliver push notifications;
- the Android ID (on Android), which our in-app messaging component uses to associate your device with your messaging session;
- push notification tokens issued by Google (Android) or Apple (iOS) so that we can deliver notifications to your device; on iOS this includes a separate token used to ring incoming calls.
We do not collect the Google Advertising ID or Apple's Identifier for Advertisers (IDFA), we do not request Apple's App Tracking Transparency permission because the App does not track you across other companies' apps or websites, and we do not use the Apps to serve third-party advertising.
Account and usage information
When you sign in, the App associates your activity with your Lofty account identifier, your name, your email address, your role within your team, your team identifier, and your subscription plan. We record how you use the App — the screens you view, the features you tap, and the sequence of those actions — together with technical information about your device such as model, operating system version, language, time zone, screen size, and network type.
Contacts
If you choose to use the "Sync contacts" or "Import contacts" features, and grant the App permission, the App reads the contacts stored on your device and uploads them to Lofty so that we can create leads you select or suggest other real estate professionals you may already know. You can decline or later revoke this permission in your device settings; the feature will then be unavailable.
Location
If you grant location permission, the App uses your device's approximate or precise location while you are using the App to show nearby leads and properties on the door-knocking map, to search listings and agents near you, and to fill in addresses for appointments, door-knocking stops, and transactions. Your live location is used for the request you make and is not stored as a location history. When you save a location as part of an appointment, a door-knocking record, or a listing, that location is stored with the record. The App does not collect location in the background.
Microphone, voice, and calls
With your permission, the App uses the microphone to place and receive calls, to record voice messages, and to let you speak to the Lofty AI assistant. Calls placed through Lofty's calling feature may be recorded and stored with the lead's record in accordance with your account settings and applicable call-recording laws. Voice input to the AI assistant is transmitted to a speech-recognition service provider (Microsoft Azure Speech or, on iOS, Apple's speech recognition service) to be converted to text.
Photos, videos, files, and documents
When you choose to attach photos, videos, files, or documents — for example to a message, a listing, or a transaction — the App uploads the items you select to Lofty. On iOS, the camera can also be used to scan paper documents; the scanned image stays on your device until you choose to upload it. If you pick a file from Dropbox, the App receives only the file you select through Dropbox's file chooser. If you pick a file from Google Drive, you sign in with your Google account and grant the App access to your Google Drive so that you can choose a file; the App uploads only the file you select.
Messages, texts, and calls
Messages you send and receive through the App's messaging features, including team chat and AI conversations, are transmitted to and stored on Lofty's servers so that they can be delivered and shown to you across your devices. Text messages and calls you exchange with your contacts through a Lofty phone number are routed through our telephony provider and stored in the contact's record in your account.
Sign-in and biometric unlock
If you enable fingerprint or face unlock (Face ID or Touch ID on iOS), the check is performed by your device's operating system. The App only receives the result; it never receives or stores your biometric data.
How you found the App
On Android, the App reads the Google Play install referrer once after installation to learn whether you installed it from a store search or an advertising link. This value is kept on your device and is not currently sent to Lofty. The App Store does not provide equivalent information, and the iOS App collects nothing of this kind.
Caller identification (iOS)
If you turn on Lofty in your iPhone's call blocking and identification settings, the App writes the names and phone numbers of your leads to the iOS call directory on your device so that incoming calls from them can be labeled. This data stays on your device and is not transmitted by this feature.
Diagnostics
The App reports crashes, performance measurements, and diagnostic events about push-notification delivery so that we can keep the App working reliably. The App also uploads its diagnostic logs to Lofty's servers to help us investigate problems.
The Apps rely on the following providers, which process information on our behalf and under contract:
- Google Maps Platform (Google LLC): map display (Maps SDK) and, on Android, place search (Places SDK); on iOS, place search is performed through Lofty's servers. The SDKs collect device metadata, IP address, crash data and an SDK-specific pseudonymous identifier; on iOS the Maps SDK also reads the identifier for vendor.
- Google Firebase (Google LLC): analytics (Google Analytics for Firebase) and crash reporting (Crashlytics) on both platforms; performance monitoring and push notifications (Firebase Cloud Messaging) on Android; and app-integrity verification (Firebase App Check, backed by Google Play Integrity on Android and Apple App Attest on iOS) on both platforms. On iOS, Firebase Analytics does not collect the identifier for vendor and analytics data is not used for ad personalization. See "How Google uses information from sites or apps that use our services" at www.google.com/policies/privacy/partners/.
- Google LLC (reCAPTCHA Enterprise): bot protection at sign-in on both platforms.
- Apple Inc. (iOS): push notification delivery (APNs, and PushKit for incoming calls), App Attest device verification, and speech recognition when you use voice input in the AI assistant.
- Mixpanel, Inc.: product analytics and diagnostics, including the text of AI reminder notifications shown to you.
- Userpilot, Inc.: in-app guidance and product analytics; it receives your Lofty user ID, name, email address, role and company name (and, on iOS, your subscription plan). Data is processed in Userpilot's EU region.
- Zendesk, Inc.: in-app customer support (chat and support requests).
- Twilio Inc.: voice calling and call recording.
- Microsoft Corporation (Azure Speech): speech-to-text for the AI assistant.
- Dropbox, Inc. and Google LLC (Google Drive): file selection when you choose to attach a file stored in Dropbox or Google Drive.
- NetEase Yunxin messaging SDK, deployed on Lofty-operated servers: in-app messaging. No message content is sent to NetEase.
- Permissions. You can grant or revoke the App's access to contacts, location, microphone, camera, notifications and, depending on your platform, photos, speech recognition, phone and Bluetooth (used for calling) at any time in your device's settings. The exact set of permissions depends on your platform and operating system version.
- Deleting your account and data. Use the account-deletion option in the App's settings, visit https://lofty.com/page/m_cancelAccount.html, or contact privacy@lofty.com.
Closely is Lofty's consumer app for home buyers and sellers who work with a real estate agent, team or brokerage whose website is built on Lofty. In addition to the information described above, when you use the Closely app for iOS and Android ("Closely" or the "App"), we and our service providers collect the following information from your device. Your Closely account is the same account you use on your agent's website; an account may also be created for you on that website or by your agent, and such accounts can sign in to the App directly. Information you share through the App (your contact details, saved searches, saved listings, tour requests and messages) is held in that agent's Lofty account, in the same way as information you enter on the agent's website. The agent's own privacy policy, available inside the App under Profile → Privacy Policy, describes how the agent uses it.
Device and installation identifiers
We collect identifiers that let us recognize your installation of the App and deliver its features:
- an installation identifier for the App. On Android this is a random identifier generated by the App; an installation from before version 2.7.0 keeps the value the earlier version stored, which could be derived from device identifiers, and the value can be restored from a device backup after reinstalling. On iOS it is derived from Apple's identifier for vendor (IDFV) and stored in the device keychain, so it is retained if you reinstall the App. It is sent with each request to our servers, together with your device model, operating system version, App version and time zone, so that we can attribute requests to a device and investigate problems;
- a Firebase installation identifier generated by Google's Firebase software development kit ("SDK"), used to report crashes and count active installations;
- a push notification token issued by Apple (iOS) or Google (Android), if you allow notifications, so that we can deliver notifications to your device;
- for agent links (see "How you found the App" below), the identifier for vendor on iOS and the Google Advertising ID on Android (or, if you have opted out of ads personalization or deleted the advertising ID, the device's Android ID), read by our attribution provider.
We do not collect Apple's Identifier for Advertisers (IDFA), and we do not request Apple's App Tracking Transparency permission because the App does not track you across other companies' apps or websites. We do not use the App to serve advertising, and the App's analytics and sign-in components are configured not to collect advertising identifiers. On Android, you can reset or delete your advertising ID, or opt out of ads personalization, in your device settings (Settings → Google → Ads, or Settings → Privacy → Ads). If you do, our attribution provider uses your device's Android ID for agent links instead.
Account and usage information
When you sign in, the App associates your activity with your Lofty account identifier, your name, your email address and your phone number, and with the identifier of the agent team you belong to. We record how you use the App — the screens you view and the features you tap — together with technical information about your device such as model, operating system version, App version and time zone. Your account and team identifiers are also attached to analytics events so that we can measure how the App is used per agent team; they are internal record numbers, not your name.
Location
If you grant location permission, the App uses your device's precise location while you are using the App to show homes near you and to position the map. Your location is sent with the search request and is not stored as part of your profile. The App does not collect location in the background.
Microphone and voice messages (iOS)
On iOS, with your permission, the App uses the microphone to record voice messages you choose to send to your agent in the in-app chat. Voice messages are stored on Lofty's servers like other chat messages. The App does not place calls and does not record audio for any other purpose.
Photos, files, and documents
When you choose to attach photos or documents — for example to a chat message, to feedback, as your profile photo (iOS), or to a transaction — the App uploads the items you select to Lofty's servers. Nothing is uploaded from your photo library or files without your selection.
Messages
Messages, images and voice messages you exchange with your agent through the in-app chat are transmitted to and stored on Lofty's servers so that they can be delivered and shown to you and your agent across devices. The chat runs on messaging software deployed on servers that Lofty operates; the software vendor does not receive your messages, account or device information.
Sign-in options
You can sign in with your email address (one-time code or password), or with Google, Facebook or Apple. When you use Google, Facebook or Apple sign-in, that provider sends us your name and email address (for Apple, the address you choose to share) together with a signed identity token that we verify through Google's Firebase Authentication service. On iOS, Facebook sign-in uses Facebook's Limited Login: the App receives only an identity token and does not receive a Facebook access token or any Facebook data beyond your name and email address. On Android, Facebook sign-in gives the App an access token limited to your public profile and email address. The App never posts to your social accounts.
How you found the App (agent links)
Agents share Closely with their clients through personal links. When you install or open the App from an agent's link, our attribution provider (Branch) matches the link to your installation — using the identifier for vendor on iOS or the Google Advertising ID on Android (the device's Android ID if you have opted out of ads personalization or deleted the advertising ID), together with your device model, operating system version, IP address and the link you tapped — so that the App can connect you with that agent. On iOS, the first time the sign-in screen appears after installation, the App also checks your clipboard once for an agent link you may have copied; the clipboard is read only on that one occasion, and nothing on it is used or stored unless it is a Closely agent link. On Android, our attribution provider may also read the Google Play install referrer for the same purpose.
Calendar
If you choose "Add to calendar" for a tour you booked, the App writes that event to your device calendar, with your permission. Afterwards it only looks up that event, to check that it still exists; it does not read any other entries in your calendar.
Diagnostics
The App reports crashes and errors to Google's Firebase Crashlytics so that we can find and fix problems. A report contains the error details, the device model and operating system version, the App version, identifiers generated by the App and by Firebase for this installation, short technical log lines about which App screen was in use, and, when you are signed in, your account identifier, email address and name, so that we can identify whose problem we are investigating. The App does not upload performance measurements.
The Closely App relies on the following providers, which process information on our behalf and under contract:
- Google Firebase and Google Sign-In (Google LLC): analytics (Google Analytics for Firebase), crash reporting (Crashlytics), push notification delivery on Android (Firebase Cloud Messaging), app integrity checks (Firebase App Check, with Google Play Integrity on Android), sign-in with Google, and verification of Google, Facebook and Apple sign-ins (Firebase Authentication). Firebase Analytics does not collect advertising identifiers or, on iOS, the identifier for vendor, and analytics data is not used for ad personalization. See "How Google uses information from sites or apps that use our services" at www.google.com/policies/privacy/partners/.
- Google Maps Platform (Google LLC): map display (Maps SDK). The SDK receives the map area you view, your IP address and device metadata; in Closely it does not read the identifier for vendor.
- Apple Inc. (iOS): "Sign in with Apple" and push notification delivery (APNs).
- Meta Platforms, Inc.: "Log in with Facebook" (sign-in only). The App sends Meta no app events and no advertising identifiers.
- Branch Metrics, Inc.: install attribution and deep linking for agent links (see "How you found the App").
- NetEase Yunxin messaging SDK, deployed on Lofty-operated servers: in-app chat. No message content, account or device information is sent to NetEase.
- Permissions. You can grant or revoke the App's access to location, camera, photos, microphone (iOS), calendar and notifications at any time in your device's settings.
- Deleting your Closely account. Open the Profile tab, tap the menu and choose Delete Account; or submit a Data Deletion request through our Data Subject Access Request (DSAR) Portal, stating that you are a Closely App user, or email privacy@lofty.com. Deleting your account removes your Closely login credentials for every real estate website you signed in to through the App and revokes any "Sign in with Apple" authorization; you will no longer be able to sign in. Information you previously shared with your agent (your contact details, saved searches, saved listings, tour requests and messages) is part of that agent's customer records and is not deleted by this action; to request its deletion, contact your agent or submit a request through the DSAR Portal.
You may “opt in” and/or “opt out” of certain uses of your Personal Information. For example, you may have the opportunity to choose whether you would like to receive email correspondence from us. Your Personal Information will not be shared with third-party service providers unless you give consent. You will have the opportunity to opt out of Lofty marketing emails by clicking the "opt out" or “unsubscribe” link in the email you receive. You can also request this by filling out a web form via our Data Subject Access Request (DSAR) Portal. If the Lofty (DSAR) Portal is unavailable, requests can be sent to privacy@lofty.com.
Please take note that if you opt out of receiving promotional correspondence from us, we may still contact you in connection with your relationship, activities, transactions, and communications with us.
Lofty uses your Personal Information to provide you products and services, such as to fulfill your requests for products or to help us personalize our offerings to you. We also use your Personal Information to support our business functions, such as fraud prevention, marketing, and legal functions. To do this, we combine personal and non-Personal Information, collected online and offline, including information from third-party sources.
- Fulfill Requests: To fulfill your requests for products and services and communicate with you about those requests. This includes sending information to others if you ask us to do so.
- Understand Customer Behavior: To better understand customer behavior so that we may improve our marketing and advertising efforts and to improve the distribution of our products and services.
- Personalize Offerings: To help us personalize our service offerings, websites, mobile services, and advertising.
- Protection: To protect the security and integrity of our websites, mobile services, and our business.
- Legal: To comply with legal and/or regulatory requirements.
- Responding to Customer: To respond to reviews, comments, or other feedback you provide us.
- AI Tools: We use both internal and externally hosted software, platforms, and applications that utilize data analysis, learning, reasoning, problem solving, perception, prediction, planning or other cognitive functions in an attempt to augment or replicate human intelligence (we refer to these, collectively, as “AI Tools”). Examples of techniques employed by AI Tools include machine learning, deep learning, computer vision, natural language processing, robotics, virtual agents, chatbots, and other emerging technologies that aim to simulate human intelligence. AI Tools with which we share your personal data can be found in the list of sub-processors listed below.
- Employment Applications: In connection with a job application or inquiry, you may provide us with data about yourself, including your educational background, resume, professional licenses, legal work eligibility status, and other information including your ethnicity where required or permitted by law. We may use this information throughout Lofty, its subsidiaries and affiliates, and its joint ventures, for the purpose of employment consideration.
- Promotional Messaging or Advertising: With your consent, Lofty uses your contact information to recommend products and services that might be of interest to you, to send you marketing and advertising messages such as newsletters, announcements, or special offers or to notify you about our upcoming events. You may see certain ads on other websites based on your visits to our Sites because we participate in advertising networks administered by third-party vendors. Ad networks allow us to target our messaging to users through interest-based and contextual means. These networks track your online activities over time by collecting information through automated means, including through the use of cookies, web server logs and web beacons. The networks use this information to show you advertisements that are tailored to your individual interests. If at any time, you would like to discontinue receiving any such email updates, you may unsubscribe by following the unsubscribe instructions included in each promotional email.
By providing us with your phone number, you consent to our using your phone number to deliver or cause to be delivered to you at that phone number telemarketing calls (which may use an automatic telephone dialing system) and artificial or prerecorded voice or text messages from us. If you do not wish to receive such calls or messages, you may opt out. You release us from any possible liability or claim stemming from how we use your phone number, included but not limited to claims arising from the Telephone Consumer Protection Act (“TCPA”). You understand that you are not required to provide this consent and authorization and that it is not a condition to qualify to receive our services.
Use, Disclosure, and Sharing of Personal Information
We may use third-party partners to help us operate and maintain our Website and deliver our products and services. We may also share your information with our service providers and other third parties (“Affiliated Parties”) that provide products or services for or through this Website or for our business (such as website or infrastructure hosting companies, communications providers, email providers, analytics companies, credit card processing companies, and other similar service providers that use such information on our behalf).
We may share data with Lofty partners to contact you based on your request to receive such communications, help us perform statistical analysis, provide sales support, or provide customer support. We also partner with trusted third parties to provide you with co-marketing content that we think may be relevant to you.
Third-party service providers are contractually restricted from using or disclosing the information, except as necessary to perform services on our behalf or to comply with legal requirements.
The service providers used by the Lofty mobile applications and the Closely App are listed in the “Service Providers Used by the Apps” and “Service Providers Used by the Closely App” sections of this Privacy Policy.
Lofty may be required to disclose collected information in order to (i) respond to investigations, court orders or legal process, (ii) to investigate, prevent or take action regarding illegal activities, suspected fraud, potential threats to the physical safety of any person, (iii) violations of the Company’s terms of service, or (iv) as otherwise required by law.
You may request access to your personal data to update, correct or delete, or to limit the use or disclosure of, your personal data.
Individuals wishing to view, update, delete, or supplement their personal data may do so by contacting the business that provided Lofty their personal data directly to make their requests, or alternatively they can submit your request through our Data Subject Access Request (DSAR) Portal. If the Lofty DSAR Portal is unavailable, requests can be sent to privacy@lofty.com.Individuals outside the European Union (“EU”) may also use our Data Subject Access Request (DSAR) Portal to submit complaints about your privacy and our collection or use of your personal information.
Lofty does not sell or otherwise disclose the Personal Information it holds to third parties, except for the following exceptional circumstances:
- Third Parties: Lofty will not rent or sell your Personal Information to others but may disclose Personal Information with third-party vendors and service providers that work with Lofty. We will only share Personal Information to these vendors and service providers to help us provide a product or service to you at your request and in accordance with our respective agreement. We will ensure appropriate contractual clauses are in place to ensure compliance with applicable data protection legislation.
- Business Purposes: In a prospective business transaction, Lofty may disclose Personal Information where Lofty has entered into an agreement that restricts the use and disclosure of that data solely for purposes related to the transaction, protects the data by security safeguards appropriate to the sensitivity of the information, and if the transaction does not proceed, the data is returned to Lofty or destroyed within a reasonable time. With respect to employee data, Lofty may disclose Personal Information if it is necessary to establish, manage or terminate an employment relationship, as allowed by law.
- Legal and Safety Reasons: Lofty may be required to disclose Personal Information to law enforcement agencies, government agencies, or legal entities. We may disclose information by law, litigation, or as a matter of national security to comply with a valid legal process including subpoenas, court orders or search warrants, and as otherwise authorized by law. We may also need to disclose Personal Information in the event of an emergency that threatens an individual’s life, health, or security. If the data requested is held on behalf of a customer, Lofty will inform the customer unless it is prohibited to do so by law. Lofty may be required to disclose information without your consent or knowledge if: (i) it is reasonable to expect that disclosure with the customer’s knowledge or consent would compromise an investigation of a breach of an agreement or a contravention of the law; (ii) it is reasonable for the purposes of preventing, detecting or suppressing fraud and it is reasonable to expect that the disclosure with the customer’s knowledge or consent would compromise the ability to prevent, detect or suppress the fraud; (iii) it is necessary to identify an individual who is injured, ill or deceased to a government institution or the individual’s next of kin or authorized representative and, if the individual is alive, with notification to the individual.
- Via Links to Third-Party Websites, Services, and Applications: Using our website or services may link to third party web websites, services, and applications. Lofty is not responsible for any Personal Information collected by these means. Information collected is governed by the third party’s website’s privacy policy. Any interactions you have with these websites, services, or applications are beyond the control of Lofty. We encourage you to carefully review the privacy policies of any third party services you access.
- Change of Ownership: If we (or our assets) are acquired by another company, whether by merger, acquisition, bankruptcy, or otherwise, that company would receive all information gathered by Lofty on the websites and services. In this event, you will be notified via email and/or a prominent notice on our website, of any change in ownership, uses of your Personal Data, and choices you may have regarding your Personal Data.
Your Right to Correction. You have the right to request the correction of any inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes of the processing of the personal information. We will use commercially reasonable efforts to correct the inaccurate personal information as you may direct.
We take reasonable and appropriate precautions, including administrative, technical, personnel, and physical measures, to safeguard Personal Data against loss, misuse, theft, and unauthorized access, disclosure, alteration, and destruction. We also use Secure Sockets Layer (SSL) encryption when transmitting sensitive information. In addition, our business practices are reviewed periodically for compliance with policies and procedures governing the security and confidentiality of our information.
To help protect the privacy of data and personally identifiable information you transmit through use of this site and any other related services, we maintain physical, technical and administrative safeguards. We update and test our security technology on an ongoing basis. We restrict access to your personal data to those employees who need to know that information to provide benefits or services to you. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information. We commit to taking appropriate disciplinary measures to enforce our employees' privacy responsibilities.
All Personal Information is retained only for as long as it is necessary for the purposes for which it was collected or transferred. Lofty retains your information for business purposes, for as long as your account is active, and/or as long as is reasonably necessary to provide you with our products and services. Lofty will also retain your information as reasonably necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. We may also retain cached or archived copies of your information for a reasonable period of time. At any point in time, you can withdraw consent and we will immediately stop processing your data.
Lofty may share customer information within our affiliated companies for a variety of purposes, for example, to provide you with the latest information about our products and services and offer you our latest promotions. “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity. To facilitate our global operations, Lofty may transfer Personal Information from your home country to other Lofty locations across the world. To protect your Personal Information, we will only transfer data to countries who provide an “adequate” level of Personal Information protection. If the data is transferred to counties without “adequate” protection as determined by the European Parliament, we will use additional safeguards to ensure your data is protected.
In regard to the aforementioned rights to voice questions, make requests regarding your data privacy or withdraw consent, we will respond to your request within 30 days. In some cases, however, we may limit or deny your request if: the law permits or requires us to do so, if it infringes on the privacy of other individuals or internal procedures, if we find the request to be unfounded or excessive, or if we are unable to verify your identity.
If the volume or complexity of the request requires internal processing at Lofty beyond 30 days, Lofty will inform the requester within 30 days of the reasons for an extension and may charge a reasonable fee to cover administrative costs.
Security of all information is of the utmost importance for Lofty. Lofty uses technical and physical safeguards to protect the security of your Personal Information from unauthorized disclosure. We use encryption technology to keep all information secure. We also make all attempts to ensure that only necessary people and third parties have access to Personal Information. Nevertheless, such security measures cannot prevent all loss, misuse, or alteration of Personal Information and, unless otherwise agreed in a written agreement between Lofty and the applicable party, we are not responsible for any damages or liabilities relating to any such incidents to the fullest extent permitted by law. In the case of a data breach, we will notify you without undue delay of any loss, misuse or alteration of Personal Information that may affect you. We will notify relevant regulatory bodies within 72 hours of indentifying a breach.
To facilitate our business practices, your Personal Data may be collected, transferred to, and stored by us in the United States. As a result, your Personal Data may be processed outside the European Economic Area (“EEA”), and in countries which are not subject to an adequacy decision by the European Commission, and which may not provide for the same level of data protection in the EEA. In this event, we will ensure an adequate level of protection, for example by entering into standard contractual clauses for the transfer of data as approved by the European Commission (Art. 46 GDPR), or we will ask you for your prior consent to such international data transfers.
Lofty commits to resolve complaints about your privacy and our collection or use of your personal information under GDPR. European Union individuals with inquiries or complaints should use our Data Subject Access Request (DSAR) Portal to submit complaints about your privacy and our collection or use of your personal information.
Alternative Means of Contact
If the Lofty (DSAR) Portal is unavailable, requests can be sent to privacy@lofty.com or to our mailing address:
Lofty Inc.
45 W Buchanan St
Phoenix, AZ 85004
If you have any unresolved privacy concerns that we have not addressed to your satisfaction after contacting us, you have the right to contact the EU Data Protection Authorities by clicking on the following link: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm
Lofty may employ and contract with third-party service providers and other entities to assist in providing our services to customers by performing certain tasks on our behalf. These third-party providers may offer customer support, data storage services (data centers), or technical operations. Lofty maintains contracts with these third parties restricting their access, use and disclosure of personal data in compliance with this Privacy Policy and applicable law. These third parties may access, process, or store personal data in the course of providing their services. Unless we tell you differently, these third-party providers do not have any right to use Personal Information or other information we share with them beyond what is necessary to assist us. You hereby consent to our sharing of Personal Information with these third-party service providers. We may be liable for the appropriate onward transfer of UK, EU, and Swiss personal data to third parties.
The service providers used by the Lofty mobile applications and the Closely App are listed in the “Service Providers Used by the Apps” and “Service Providers Used by the Closely App” sections of this Privacy Policy.
We acknowledge the right of UK, EU, and Swiss individuals to access their personal data. You may request to access and limit use and disclosure of this data by using our Data Subject Access Request (DSAR) Portal. If the Lofty (DSAR) Portal is unavailable, requests can be sent to privacy@lofty.com.
UK, EU, and Swiss individuals may “opt in” and/or “opt out” of certain uses of your Personal Information. For details on how you can exercise your choices please refer to the “Your Opt In/Opt Out Choices” section of this Privacy Policy.
We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.
In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:
- If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
- For investigations and fraud detection and prevention
- For business transactions provided certain conditions are met
- If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
- For identifying injured, ill, or deceased persons and communicating with next of kin
- If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
- If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
- If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
- If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
- If the collection is solely for journalistic, artistic, or literary purposes
- If the information is publicly available and is specified by the regulations
This California Privacy Policy applies only to California consumers (“you” or collectively as “consumers”). The California Consumer Privacy Act of 2018 (“CCPA”) and the California Privacy Rights Act of 2020 (“CPRA”), collectively referred to as “California Consumer Privacy Laws”, provide California consumers with specific rights regarding their personal information.
Yes, if you are a resident of California, you are granted specific rights regarding access to your personal information.
California Civil Code Section 179883, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.
On January 1, 2020, the California Consumer Privacy Act of 2018 (CCPA) took effect and established requirements and rights relating to personal information of California consumers. This section for California residents applies solely to visitors, users, and others who reside in the State of California (“consumers” or “you”). We adopt this notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and other California privacy laws. Any terms defined in the CCPA have the same meaning when used in this notice.
Information We Collect We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:
| Category | Examples | Collected |
| A. Identifiers. | A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers. For the Lofty mobile applications: an installation identifier (derived from Apple's identifier for vendor on iOS; generated by the App on Android), a Firebase installation identifier, push notification tokens, and, on Android, the Android ID. For the Closely App: a device identifier (derived from Apple's identifier for vendor on iOS; generated by the App on Android), a Firebase installation identifier, a push notification token, your Lofty account and team identifiers, and, on Android, the Google Advertising ID used for agent-link attribution (or the device's Android ID when the advertising ID is unavailable). |
Yes |
| B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). | A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories. | Yes |
| C. Protected classification characteristics under California or federal law. | Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). | Yes |
| D. Commercial information. | Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | Yes |
| E. Biometric information. | Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data. | No |
| F. Internet or other similar network activity. | network activity. Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement. | Yes |
| G. Geolocation data. | Physical location or movements. | Yes |
| H. Sensory data. | Audio, electronic, visual, thermal, olfactory, or similar information. | Yes |
| I. Professional or employment-related information. | Current or past job history or performance evaluations. | No |
| J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). | Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. | No |
| K. Inferences drawn from other personal information. | Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. | No |
| L. Sensitive Personal Information | No |
We will use and retain the collected personal information as needed to provide the Services or for:
Category A - As long as the user has an account with us
Category B - As long as the user has an account with us
Category G - As long as the user has an account with us
We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:
- Receiving help through our customer support channels;
- Participation in customer surveys or contests;
- Facilitation in the delivery of our Services and to respond to your inquiries;
The Fair Information Practices, also known as the Fair Information Practice Principles (FIPPs), form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect personal information.
In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur:
- We will notify the users via email within seven (7) business days
- We also agree to the individual redress principle, which requires that individuals have a right to pursue legally enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or a government agency to investigate and/or prosecute non-compliance by data processors.
The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.
To be in accordance with CAN-SPAM we agree to the following:
If at any time you would like to unsubscribe from receiving future emails, you can email us at
privacy@lofty.com and we will promptly remove you from ALL correspondence.
We do not collect any information from anyone under 18 years of age. Our website, products and services are all directed to people who are at least 18 years old or older. If we learn that we have mistakenly collected personal information from a child under age 18, we will delete that information as soon as possible. If you believe that we might have information from or about a child under age 18, please contact us via email at privacy@lofty.com.
Lofty's use and transfer to any other app of information received from Google APIs will adhere to Google’s API Services User Data Policy, including the Limited Use requirements.
Notwithstanding anything else in this Privacy Policy, if you provide the App access to the following types of your Google data, the App's use of that data will be subject to these additional restrictions:
- The App will only use access to read, write Gmail message bodies (including attachments), metadata, headers, and settings to provide a web email client that allows users to compose, send, read, and process emails and will not transfer this Gmail data to others unless doing so is necessary to provide and improve these features, comply with applicable law, or as part of a merger, acquisition, or sale of assets.
- The App will not use this Gmail data for serving advertisements.
- The App will not allow humans to read this data unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes such as investigating abuse, to comply with applicable law, or for the App's internal operations and even then only when the data have been aggregated and anonymized.
Any information acquired through integration with Google services (Gmail, Drive, etc.) is done so explicitly for the purpose of facilitating the usage of user-facing features. Data is not used for advertisements of any kind, and never transferred or accessed aside from cases of enabling functionality, customer support, or for necessary security purposes outlined and coinciding with Google’s Limited Usage Requirements.
By visiting the Google security settings page, you may revoke any access to your Lofty Data by that Google may have access.
By visiting our site, using our services, and providing information to us, you agree that any dispute over privacy or the terms contained in this Privacy Policy will be governed by the law of the State of Arizona and the venue for any action arising out of such dispute shall be the State and Federal Courts sitting in Maricopa County, Arizona.
This Privacy Policy is governed by the Terms of Use, which includes all disclaimers of warranties and limitation of liabilities. All capitalized terms not defined in this Privacy Policy will have the meaning set forth in the Terms of Use.
To review other applicable terms and conditions that apply to this Privacy Policy, including, without limitation, intellectual property rights, representations and warranties, disclaimer of warranties, limitation of liability and resolving disputes, please review the Terms of Use.
We may need to change, modify and/or update this Privacy Policy from time to time and we reserve the right to do so without prior notice and at any time. If we do make changes in the way personal information is used or managed, any updates will be posted here, so you should also revisit this Privacy Policy periodically. Your continued use of the Site and any Services following the posting of any such changes shall automatically be deemed your acceptance of all changes.
If you have any questions or comments about this Privacy Policy, or if you would like to review, delete, or update information we have about you or your preferences, requests should be submitted through our Data Subject Access Request (DSAR) Portal. If the Lofty DSAR portal is unavailable, requests can be sent to privacy@lofty.com or via mail to:
Lofty Inc.
45 W Buchanan St
Phoenix, AZ 85004
To submit a violation of the Lofty Privacy Policy, please utilize this Contact Us Form: https://lofty.com/contact-us