Privacy policy
Version of
In short: this policy covers the website loftapp.io and the rooms at rooms.loftapp.io. You don't need an account to visit a room, and you don't tell us anything about yourself. We collect usage statistics without cookies and without identifying you. We only ask for personal data from creators who join the waitlist.
Who is responsible
Loft is at an early stage and has no registered company yet. For now, the person responsible for your data (the controller, under the GDPR and Brazil's LGPD) is Rafael Schaefer, a private individual based in Malmö, Sweden. Contact: privacy@loftapp.io.
When Loft's Swedish company (aktiebolag) is set up, it will take over this role. We will update this page and let registered creators know.
We have not appointed a data protection officer. The e-mail above is the channel for any privacy matter.
What we collect and why
| What | Why | Legal basis | How long |
|---|---|---|---|
| Creator form: name, e-mail, channel link, platform, niche, follower range | To review your application and contact you about building a room | Steps taken at your request before an agreement (GDPR art. 6(1)(b); LGPD art. 7, V) | 6 months after you submit. If we partner, the data then follows our agreement |
| Usage statistics in rooms: pages viewed, objects and links clicked, language changes, time in the room, referring page, whether the room was opened directly or embedded, device and browser type, and technical loading diagnostics | To learn what works in the room and fix problems | Legitimate interest (GDPR art. 6(1)(f); LGPD art. 7, IX) | 12 months |
| Server logs: IP address, date and time, page requested, browser | To keep the site running and secure | Legitimate interest | Up to 30 days |
| Website visit counts (Vercel Web Analytics): aggregated traffic numbers for loftapp.io | To measure the website's reach | Legitimate interest | We keep only aggregated numbers, nothing that identifies you |
Usage statistics use no cookies and store no identifier on your device. Each visit is counted on its own: we can't tell whether you've been here before, and we don't build a profile of you. We don't keep your IP address in these statistics.
What stays on your device
The site saves in your browser your chosen language, your progress in the room's Escape Room (the mystery gift) and, if you ask for it, your choice to turn off statistics. This data is not sent to Loft. It only lets the site remember where you left off. To delete it, clear this site's data in your browser settings.
On the creators page it also remembers, for that tab only, which room you came from, so the back link works.
What we don't do
- We don't sell or rent data.
- We don't use advertising cookies or track you across other sites.
- The Escape Room collects no player data. Your progress and result stay in your browser. If you post your result on the creator's Discord, that happens outside Loft, under Discord's rules.
- Loft doesn't run giveaways or hand out prizes. If a creator runs a promotion of their own, it is their responsibility and follows the rules they publish.
Affiliate links
Some objects in the room have affiliate links, always marked with a commission notice. When you click one, you leave Loft for the store (for example, Mercado Livre or AliExpress) in a new tab. The link identifies the creator, not you. From then on, the store handles your data under its own privacy policy. Loft receives no data from stores about who clicked or bought.
Rooms inside other sites
A room may be embedded in a creator's website or opened in an app's built-in browser, such as Instagram's. The surrounding site or app has its own rules and cookies, which we don't control. This policy covers only what happens inside the room.
Who helps us run Loft
| Service | Role | Where data is stored |
|---|---|---|
| Vercel Inc. | Hosting of the website and the rooms, server logs and website visit counts | USA and global network |
| PostHog | Usage statistics in rooms | European Union (Frankfurt) |
| Tally | Creator form | European Union |
| Google (Google Workspace) | E-mail: receiving applications and privacy requests | Google's global network |
These services process data only on our instructions. When data leaves Brazil or the EU, we rely on the safeguards the law provides, such as standard contractual clauses or the EU-US Data Privacy Framework.
The form is shown by Tally inside our page. To work, it may store its own information in your browser, and it receives the address of the page it appears on.
Children and teenagers
Anyone can visit a room without giving personal data. The creator form is for adults (18+) only. If we learn that a minor submitted the form, we delete the application.
Your rights
You can ask us at any time to confirm whether we hold data about you, and to give you access, correct it, delete it, transfer it, or tell you who we share it with. You can also object to usage statistics: the page rooms.loftapp.io/statistics turns them off from this browser. In rooms embedded on other websites, your browser keeps that choice separate, so you need to make it there again. We also honour your browser's "Do Not Track" signal.
For any request, write to privacy@loftapp.io. We reply within 15 days. We may ask for a simple check that the request is yours, such as replying from the e-mail you used on the form.
If you're not satisfied, you can complain to IMY in Sweden (imy.se) or ANPD in Brazil (gov.br/anpd).
Changes to this policy
When we change something important, we update the date at the top. If a change affects registered creators, we tell them by e-mail.