Privacy Policy

Before anything else, the commitment that shapes this whole policy: we will never sell your personal data. Not to advertisers, not to data brokers, not to partners. We will never use your data to serve you third-party advertising. If Collective Loft ever shuts down, your data gets deleted, not auctioned. If Collective Loft is ever acquired, your data transfers only to an owner who agrees in writing to these exact commitments, and you get 30 days notice and the chance to delete your account first.

This is not a preference. It is a binding term of our contract with every member, written into Section 15 of our Terms & Conditions. Collective Loft exists because creative people keep getting used by platforms that hold all the leverage. We fund this platform with membership fees precisely so that you are the customer and never the product.

• ○Name and email address
• ○Password (stored encrypted)
• ○Location (country, state, city)
• ○Creative profile: disciplines, skills, bio, headline, Right Now card, portfolio links, social links
• ○Collaboration preferences
• ○Uploaded content: portfolio files, studio files, profile and cover images
• ○Messages and communications within Loft Studios
• ○Collaboration terms you create or accept
• ○Ratings and reviews you submit
• ○Payment information (processed by Paddle for membership, Stripe for collaboration payments)
• ○Membership billing records: for each membership charge we keep the transaction id, amount, tax, currency, date, and status. Never your card number, which only Paddle sees
• ○If you claim a free student membership: your school email domain and the dates you verified it
• ○Your choice about news and update emails, if you make one, the wording you were shown, and when you made it
• ○The version of the Terms and this Policy you accepted, and when
• ○Anything you send us through the Help page or by email

• ○Log data: IP address, browser type, pages visited, time spent
• ○Device information: device type, operating system, browser version
• ○Usage data: features used, actions taken, collaboration activity
• ○Session data: authentication tokens managed by Supabase Auth
• ○Anonymous page view counts via Vercel Analytics

• ○Authentication cookies (Supabase): maintain your logged-in session. Required for Platform functionality.
• ○We do not use analytics or advertising cookies. Page views are counted anonymously by Vercel Analytics, which sets no cookies and does not track you across sites.

We do not use advertising cookies, third-party tracking pixels, or behavioral targeting technologies beyond those described above.

We do not collect, capture, purchase, or otherwise obtain biometric identifiers or biometric information, as those terms are defined in the Illinois Biometric Information Privacy Act (740 ILCS 14) or any other biometric privacy law, such as face geometry, fingerprints, voiceprints, or retina or iris scans. The photos you upload stay photos: we never run facial recognition on them or extract biometric data from them. If that ever changed, we would first publish a written biometric policy and obtain your written consent, as that Act requires. We also do not collect precise geolocation from your device, government identification numbers, or payment card numbers, and we ask you not to put sensitive personal information in your profile or messages.

Each purpose uses only the information it needs. The table lists each purpose, the data it uses, and, for members in the EEA, the UK and Switzerland, the legal basis under the GDPR.

We do not sell your personal data. We do not use your data to serve third-party advertising. We do not make automated decisions about you that have legal or similarly significant effects; Discipline Matching only orders what you see.

The full list of who receives your data is below, and it is the whole list. Sharing with the service providers that run the Platform, under contracts that bar them from using member data for their own purposes, is the only sharing we do. See the Data Covenant in Section 1.

• ○Name, headline, bio, and Right Now card
• ○Disciplines, skills, and collaboration preferences
• ○Location
• ○Portfolio links and social links
• ○Collaboration history
• ○Community Voice rating and reviews

Members you collaborate with also see what you share inside your shared Loft Studio. If we look into a dispute between you and another member, we may share information between the members involved to the extent needed to address it (Terms, Section 20.3).

We may disclose your information when required by law, subpoena, court order, or government request. Where the law allows, we will tell you before we do.

Only as the Data Covenant permits: to a successor that agrees in writing to be bound by Section 15 of the Terms, with 30 days' notice and the chance to delete your account first. Never as a standalone asset.

Collective Loft never stores your payment card information, which only our processors see. Membership billing is handled by Paddle as merchant of record; collaboration payments are handled by Stripe. We keep our own record of each membership transaction (amount, tax, date, status) so your billing history is visible to you and to no other member, and so a charge or a refund is never invisible to us.

We keep personal data only as long as the purpose in Section 3 needs it, then delete or anonymize it. The schedule:

If we shut down: all member personal data is deleted within 90 days of shutdown. You get at least 30 days notice and the ability to export your own content first. Only legally required records survive, such as billing records kept 7 years, and only for their mandated retention period.

Wherever you live, you can: see and correct your profile information in your account settings at any time; ask us for a copy of the personal data we hold about you; ask us to correct or delete it; ask us to send you your data in a portable form; and turn off news and update emails at any time. To exercise a right that settings do not cover, contact us through the Help page at collectiveloft.com/help or write to hello@collectiveloft.com. We may need to confirm it is really you. We respond within 30 days, or within the shorter period your local law requires, and we do not charge for a request unless the law allows it for repeated or excessive ones. We will never treat you differently for exercising a right.

You can close your account yourself at any time. Open the menu and choose Close your account, confirm your email and password, and the closure happens immediately. Your profile, photos, portfolio, and links are deleted, and any subscription is cancelled so you are not charged again.

Collaborations you completed remain on record for the people you worked with, credited to a former member rather than to you. Ratings, agreed terms, and the shared contents of a Loft Studio are part of another person's history as much as your own, so they are not removed when you leave. Your name, contact details, and profile content are.

If you would rather we handle it, or you want data removed that closing your account does not cover, contact us through the Help page at collectiveloft.com/help or write to hello@collectiveloft.com. We process those requests within 30 days.

If you live in California, Colorado, Connecticut, Texas, Virginia, or another US state with a comprehensive privacy law, you have the right to know what personal data we collect and how we use and share it, to access it, to correct it, to delete it, and to receive a portable copy. Exercise these under Section 7.1.

These laws also give you the right to opt out of the sale of personal data, of sharing for targeted (cross-context behavioral) advertising, and of profiling that produces legal or similarly significant effects. Those rights need no request here, because the practices they regulate do not exist on Collective Loft: we do not sell personal data, we do not share it for targeted advertising, and we do not profile you in that way. We honor Global Privacy Control signals from your browser as an opt-out request where one applies. We do not respond to Do Not Track signals because there is no cross-site tracking to turn off.

If we decline a request, you may appeal by replying to our answer and we will review it again within 45 days; if you are still unsatisfied you may contact your state attorney general. An authorized agent may make a request for you if they show us your written permission, and we will verify it with you. California residents: we have not sold or shared personal information in the preceding 12 months, and the categories we collect are listed in Section 2.

The controller is Morgan Collective Group LLC, Chicago, Illinois, reachable at hello@collectiveloft.com. We process your data on four legal bases, shown purpose by purpose in Section 3: performance of our contract with you; our legitimate interests; your consent, where we ask for it; and compliance with legal obligations. Where we rely on legitimate interests, we have checked that they are not outweighed by your interests and rights, and you can ask us to explain the balance. You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to receive it in a portable form, to withdraw consent at any time without affecting what was done before, and not to be subject to a solely automated decision with legal or similarly significant effects. Exercise them under Section 7.1. You also have the right to complain to a supervisory authority, in particular in the country where you live or work; in the UK that is the Information Commissioner's Office. Your data is stored in the United States; Section 8.1 explains where and Section 8.2 the safeguards.

• ○Encrypted data transmission (HTTPS/TLS)
• ○Encrypted password storage (managed by Supabase Auth)
• ○Row Level Security (RLS) enforced at the database level
• ○Access controls limiting staff access to user data

Member data is stored in the United States. Our database, authentication, and file storage run on Supabase in its us-west-1 region in Northern California, and the Platform itself is hosted on Vercel in the United States. If you use Collective Loft from the EEA, the UK, or Switzerland, your personal data is transferred to and processed in the United States.

Each processor named in Section 4 handles member data under a data processing agreement that commits it to act only on our instructions, to secure the data, to notify us of any breach, to disclose its subprocessors, and to delete member data when our relationship ends. Transfers of EEA, UK, and Swiss personal data to the United States rely on the Standard Contractual Clauses incorporated in those agreements (with the UK Addendum and the Swiss amendments where they apply). We keep copies of these agreements on file, and you may request confirmation of them at hello@collectiveloft.com.

If we learn that your personal data has been accessed or taken without authorization, we will tell you by email without unreasonable delay, and in any case within the time the law requires, including the Illinois Personal Information Protection Act (815 ILCS 530) and the breach notification laws of the other places our members live. We will tell you what happened, what data was involved, what we are doing about it, and what you can do. We will also notify regulators where the law requires it. Every processor we use is contractually obliged to tell us about a breach on its side so that we can tell you.

The Platform is exclusively for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18, and we never knowingly collect it from a child under 13 as defined by the Children's Online Privacy Protection Act. If we learn that we have collected personal information from anyone under 18, we will close the account and delete the information. If you are a parent or guardian and believe a child has given us personal information, contact us at hello@collectiveloft.com and we will remove it.

We send news and updates about Collective Loft only to members who have opted in, at signup or in account settings. Every such email says it is from Collective Loft, includes our mailing address, and has an unsubscribe link that works with one click; we act on it within 10 days, and usually at once. You can also change your choice in account settings. Opting out does not stop the service messages your account needs, which are listed in Section 11 of the Terms. We do not use third-party marketing lists and we do not share your email address with anyone for their marketing.

We will notify you by email at least 14 days before material changes take effect. Changes that weaken the Data Covenant require at least 30 days notice and never apply retroactively to data collected before they take effect. Each version carries its effective date, and earlier versions are available on request.

Collective Loft · Morgan Collective Group LLC
201 W Lake St STE 40769, Chicago, IL 60606-1803
hello@collectiveloft.com · collectiveloft.com

Illinois residents may ask us by email for the name, address and contact details of the operator of the Platform, and we will provide them.