Privacy Policy

1. Information we collect

1.1 Information Pros provide directly

When a Pro creates and uses a Loft account, we collect:

• Account details: name, email address, phone number, and a chosen booking-page URL (“slug”)
• Public profile content the Pro chooses to add: bio, specialties, profile photo, cover photo, business address, website, public contact email, and social media links
• Business configuration: availability, lesson types and pricing, cancellation policy, automation message templates, and calendar color preferences
• Payment configuration: Stripe Connect account identifiers (see Section 1.4 — we do not store card numbers)

1.2 Information about Students

Pros use Loft to manage their own students, and Students may also submit information themselves through a Pro's public booking page. This can include:

• Contact details: first and last name, email address, phone number
• Booking details: lesson type, date/time, payment status, and any notes submitted with a booking or inquiry
• Golf-specific and profile information a Pro may record: handicap, goals, skill/experience level, playing history, home course, preferred lesson times, equipment details, physical limitations, and free-text notes the Pro writes about the Student's progress
• Performance data: logged metrics (e.g. club speed, ball speed), handicap history, and swing videos or photos a Pro uploads to a Student's profile
• Package and payment history: lesson packages purchased, lessons used/remaining, and invoices
• For junior (minor) students: a parent or guardian's name, phone number, and email address, entered by the Pro or, on a public booking page, by the parent/guardian themselves — see Section 8 for more on children's information

Most of this information is entered by the Pro as part of running their coaching business, not collected by Loft directly from the Student — the exception is information a Student or their parent/guardian submits themselves through a public booking page (name, contact details, and any optional details like handicap or goals on an intake form).

1.3 Information collected automatically

Like most web applications, our infrastructure automatically logs standard technical information when you use the Service — IP address, browser type, device information, pages visited, and timestamps — primarily for security, debugging, and abuse prevention (for example, rate-limiting repeated submissions from the same source on public booking pages). We do not use this information for advertising, and we do not currently use any third-party analytics or advertising trackers on the Service.

1.4 Payment information

Payments are processed through Stripe, a PCI-compliant third-party payment processor. When a Pro connects Stripe (via Stripe Connect) and a Student pays for a lesson or package, card details are entered directly into Stripe's hosted checkout and are never seen by or stored on Loft's own servers. We store limited payment metadata (amounts, timestamps, payment status, and Stripe's own transaction identifiers) needed to reconcile bookings, invoices, and revenue reporting.

1.5 Cookies and similar technologies

We use cookies set by our authentication provider (Clerk) to keep you signed in, and a local browser preference for light/dark theme. These are functional, not advertising, cookies. We do not currently use cookies for cross-site tracking or targeted advertising.

2. How we use information

• To provide, operate, and maintain the Service — bookings, scheduling, packages, invoicing, and student records
• To process payments and payouts through Stripe
• To send transactional and operational communications: booking confirmations, lesson reminders, rebooking nudges, package-expiry warnings, receipts, and account notices
• To respond to support requests submitted through the in-app Help page or by email
• To detect, prevent, and investigate fraud, abuse, and security incidents (including automated rate-limiting of public forms)
• To maintain, secure, and improve the Service, including debugging and error monitoring
• To comply with legal obligations

We do not sell personal information, and we do not use Student or Pro data to serve targeted advertising, on or off the Service.

3. Legal bases for processing (EEA/UK users)

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases:

• Contractual necessity — to create your account and provide the Service you've signed up for
• Legitimate interests — to secure the Service, prevent abuse, and improve our product, balanced against your rights
• Consent — where you've given it (for example, optional details on an inquiry form), which you may withdraw at any time
• Legal obligation — where we must retain or disclose information to comply with the law

4. Who we share information with

We don't sell personal information. We share it only as needed to run the Service, with the following categories of service providers (“subprocessors”), each bound by their own data protection obligations:

• Clerk — authentication and account/session management
• Stripe — payment processing and payouts (Stripe Connect)
• Resend — transactional email delivery
• Twilio — SMS delivery, for Pros who enable text-message automations
• Neon — database hosting
• Vercel — application hosting and infrastructure
• Anthropic — powers optional AI-assisted features on Student profiles; limited relevant profile data is sent to generate these features and is not used by Anthropic to train models under our agreement with them
• Sentry — error monitoring, if enabled, to help us diagnose bugs and outages

We may also disclose information: to comply with a legal obligation, subpoena, or court order; to protect the rights, property, or safety of Loft, our users, or the public; or in connection with a merger, acquisition, or sale of assets (with notice to affected users where required by law).

5. Data retention

We retain Pro account information for as long as the account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations. We retain Student records for as long as the Pro's account that manages them remains active, since that data is part of the Pro's own business records. A Pro can delete a Student's record at any time from within the Service. Rate-limiting records (used to throttle abuse of public forms) are automatically deleted once they age out of the relevant time window.

6. Your rights and choices

Depending on where you live, you may have some or all of the following rights over your personal information:

• Access the personal information we (or a Pro, through the Service) hold about you
• Correct inaccurate or incomplete information
• Request deletion of your information, subject to legal and legitimate business exceptions
• Object to or restrict certain processing
• Request a copy of your information in a portable format
• Withdraw consent where processing is based on consent

If you're a Student, the fastest way to exercise these rights over your own booking/profile information is usually to contact your Pro directly, since they manage that record day-to-day. You can also contact us at the email below and we'll route your request appropriately, including to the relevant Pro where needed. If you're a Pro, you can access, edit, or delete most account and Student information directly within the Service, or contact us for help.

Unsubscribing from automated messages. Automated emails a Pro sends through the Service (such as lesson reminders and re-booking nudges) include an unsubscribe link. Clicking it stops all further automated messages to you; you may still receive direct, one-to-one messages from your Pro about lessons you've booked. Automated text messages, where a Pro has enabled them, can typically be stopped by replying STOP.

Deleting your account. A Pro can permanently delete their Loft account, and all associated data, at any time from their account menu (Manage account → Delete account). Deleting the account removes its Students, bookings, invoices, packages, groups, and settings from our active systems, and account deletions are propagated to our systems automatically so the associated records are removed as well.

7. California privacy rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you additional rights, including the right to know what personal information we collect, use, and disclose; the right to request deletion; the right to correct inaccurate information; and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. We will not discriminate against you for exercising any of these rights. To submit a request, contact us using the details in Section 12.

8. Children's information

The Service itself is intended for use by adults — Pros running a coaching business, and adults booking lessons for themselves or their children. We understand that Pros use Loft to keep records for junior (minor) students, including a parent or guardian's contact information. This information is provided by an adult (the Pro, or the parent/guardian themselves via a booking form) rather than collected directly from a child, and is used solely to support the coaching relationship — scheduling, progress tracking, and parent communication.

Pros are responsible for obtaining parental or guardian consent before entering or storing any information about a minor Student in the Service, and for ensuring they have the right to provide that information to us. By adding a minor Student, a Pro represents that they have obtained the necessary consent.

We do not knowingly collect personal information directly from children under 13 for the purpose of their own independent use of the Service. If you believe a child has provided us with personal information other than as described above, please contact us and we will investigate and delete it as appropriate.

9. International data transfers

Our infrastructure providers (including Neon and Vercel) may process and store data in the United States. If you are accessing the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

10. Data security

We use reasonable technical and organizational measures designed to protect personal information, including encryption in transit, access controls, and rate-limiting on public-facing forms. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify affected users and relevant authorities as required by applicable law.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the “Last updated” date above and, where appropriate, notify Pros directly (for example, by email). Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact us

If you have questions about this Privacy Policy or want to exercise any of the rights described above, contact us at jeffreycurlew@me.com.