Privacy Policy

1. Who this covers

This policy applies to lobbyhq.app, community websites hosted by Lobby, the administrative studio, resident portal, and service-related messages. A customer organization decides what content and people to place in its workspace. We process that data on its instructions; the organization must have authority to provide it and handle its residents’ requests.

2. Information we process

• Account and access data: name, email, membership, role, optional unit, invitations, sessions, and security events.
• Organization and site data: name, domain, configuration, public content, notices, posts, forms, and versions.
• Documents and private content authorized administrators upload for residents, plus categories, visibility, history, and technical metadata.
• Requests, Concierge answers, generation instructions, and content submitted to artificial-intelligence features.
• Commercial and billing data: subscription status, Stripe identifiers, integer-cent amounts, and leads or individual messages created by authorized sales personnel.
• Technical data: limited IP address use for security and abuse controls, request logs, device/browser details, dates, errors, and audit events.

We do not ask for Social Security numbers, medical records, or card details. Stripe processes payment data; Lobby does not store full card numbers.

3. How we use information

We use information to provide, host, secure, and maintain Lobby; authenticate users and enforce roles; publish sites and serve private files after access checks; process payments; send sign-in links, operational notices, and authorized individual messages; generate or answer requested content; prevent abuse; provide support; maintain accounting and audit records; and meet legal obligations.

We do not sell personal information, share it for cross-context behavioral advertising, or use targeted advertising. We use only cookies and storage essential to sessions, security, language choice, and requested operation; we do not use advertising cookies.

4. Providers

Lobby serves its fonts from its own hosting; visiting a page does not send a font request to Google. We share only what is needed with providers that operate the service:

• Railway, for application and PostgreSQL hosting.
• Cloudflare, for DNS, delivery, and private R2 storage.
• Resend, for authentication, invitation, operational, and authorized individual email.
• Anthropic, for requested generation and Concierge features; it may receive instructions and relevant content needed to produce a response.
• Replicate, for optional photo super-resolution when enabled; it receives only the selected photo's pixels to improve them.
• Stripe, for checkout, subscriptions, payments, and billing events.

We may also disclose information when legally required, to protect rights or safety, or in a business transaction with appropriate protections. We do not permit these providers to use Lobby data for their own advertising.

5. Private files, security, and transfers

Private documents are held in private R2 storage. Lobby checks the session, organization, and role before issuing a short-lived download URL. No safeguard eliminates all risk; we use reasonable access controls, encryption in transit, limited privileges, audit trails, and tenant separation.

Providers may process data in the United States or other locations where they operate, subject to their commitments and applicable law.

6. Retention

We retain information while the account or service is active. Afterward, we keep only what is needed for legal obligations, security, fraud prevention, dispute resolution, backups, and accounting, and delete or anonymize it when those needs end. Organizations control their records and must meet their own retention duties; Lobby does not provide legal advice or guarantee compliance.

7. Your choices

You may request access, correction, or deletion of information we control, or opt out of individual marketing outreach, at jnavarro@lobbyhq.app. Residents should first direct requests about organization-managed files, membership, or content to their organization. We will honor rights provided by applicable law and may verify identity and authority before acting.

8. Children and changes

Lobby is an organizational service for authorized adults and is not directed to children under 13. We may update this policy; we will publish the current version here and give additional notice when required by law.

9. Contact