Skip to content
HULOFTON

Last updated: July 2026

Privacy Policy

HuLofton™ ("HuLofton", "we", "us", "our") seeks to collect, use and retain only information reasonably necessary to operate, secure and improve the Platform, process requested transactions, comply with law, and protect users. This Privacy Policy explains what we collect, why, who we share it with, and how long we keep it. It applies to hulofton.com, our mobile and web apps, and every related service.

1. Information We Collect

  • Account: email, display name, avatar, password credential (hashed), optional phone.
  • Listings & activity: listings, photos, titles, descriptions, prices, messages, saved items, reviews, reports.
  • Payments: Stripe processes card details directly. HuLofton stores only limited metadata such as Stripe session / payment intent IDs, amount, currency, status, refund status, and card brand + last-four when useful.
  • Location: approximate city or ZIP that you choose to share publicly; approximate IP-derived location for fraud prevention. HuLofton does not continuously track precise device location.
  • Device / usage: IP address, user-agent, session activity, and error diagnostics used to secure and operate the service.

2. Data Minimization — What We Deliberately Do Not Collect

  • SSN, driver's license number, passport number, biometrics, full birth date, contact lists, unrelated device data — unless legally required and disclosed at the point of collection.
  • Continuous precise location.
  • Full card numbers, CVVs, card screenshots, bank login credentials.

We use approximate city or ZIP for public display, never your exact home address. Email and phone are not exposed publicly by default. Uploaded images have EXIF/GPS metadata stripped before publication.

3. Purposes & Legal Bases

  • Operate, secure and improve the Platform.
  • Process listings, promotions, payouts, refunds, disputes, and support.
  • Detect and prevent fraud, abuse, and marketplace-safety risks.
  • Send transactional messages (receipts, security alerts, dispute updates) and, with consent, marketing communications.
  • Comply with legal obligations and enforce our policies.

4. Recipients

  • Stripe — payment processing.
  • Managed cloud hosting & database — application infrastructure.
  • Authentication providers — Google, Apple (if used) for sign-in.
  • Email & notification providers — transactional and account emails.
  • Analytics — product analytics and error monitoring, where enabled.
  • AI providers — routed through our AI gateway to generate suggestions, summaries, and moderation signals. AI providers process the specific prompt for the specific request; we do not sell user data to AI providers.
  • Law enforcement & legal process — where required by valid legal process; see Law Enforcement Requests.
  • Successors — in the event of merger, acquisition, or asset sale.

5. Cookies & Similar Technologies

We use cookies, local storage, and similar technologies for authentication, security, preferences, analytics (where enabled), and — with consent — advertising. Manage your choices in Privacy Choices or via the Cookie Preferences link in the footer.

6. Retention — [ATTORNEY REVIEW REQUIRED]

Retention periods are configurable and reviewed periodically. Current defaults:

  • Unsubmitted drafts (listing or service): 90 days after last edit.
  • Temporary uploads / failed uploads: prompt deletion.
  • Deleted-account public content: removed or anonymized promptly.
  • Payment & tax records: retained for the period legally required.
  • Moderation, appeals, and abuse records: retained for the safety and appeal window.
  • Support attachments: limited period after ticket resolution.
  • Security logs: only as long as reasonably needed.

7. Security

We use technical and organizational safeguards designed to protect information, including encryption in transit, access controls, and monitoring. No system is completely secure and we do not claim otherwise. See Security.

8. Your Choices

  • Edit your profile, notification preferences, and privacy settings in your account.
  • Request access, correction, deletion, download, or privacy questions via Privacy Choices.
  • Delete your account at /delete-account.
  • Opt out of advertising cookies / data sharing via the "Do Not Sell or Share" link in the footer.

9. California Privacy Rights

California residents have additional rights under the CCPA/CPRA, including the Right to Know, Right to Access, Right to Delete, Right to Correct, Right to Opt Out of Sale or Sharing, Right to Limit Use of Sensitive Personal Information, and Right to Non-Discrimination. See California Privacy Notice.

10. Children

HuLofton is not directed to children under 18 and we do not knowingly collect personal information from children. If we learn we have, we will delete it.

11. International Users

HuLofton is operated in the United States. If you use the Platform from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data protection laws than your jurisdiction.

12. Changes

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated date and, where required, notified through the Platform. Continued use after changes take effect constitutes acceptance.

13. Contact

Reach our privacy team at /contact.