1. Overview

ClientLoft is operated by Media Yard LLC (New Jersey, USA). We built ClientLoft to be minimal by design: we collect what the product needs to work — your account details, your client checklists, and the documents your clients choose to upload — and nothing else. We do not sell personal data, we do not run advertising trackers, and we do not use your data to train AI models.

2. Data we collect

• Account data: your email address (used for magic-link sign-in).
• Client data you enter: your clients’ names and (optionally) email addresses, and the checklist items you create for them.
• Uploaded documents: the files and typed answers your clients submit through their portal. These are visible only to you and are never published.
• Usage tallies: anonymous counts of product events (portal created, file uploaded) — no cookies, no visitor identifiers on client portals.
• Technical logs: standard server logs (IP address, timestamps, requested pages) kept briefly for security and debugging.

Cookies: we set one essential cookie — the professional’s sign-in session. Clients using a portal link get no cookies at all. No analytics cookies, no ad cookies, no cross-site tracking.

3. How we use data

• To provide the Service: hosting client portals, storing uploaded documents, and delivering them to the professional who requested them.
• To send transactional email: magic sign-in links and the reminder emails a professional explicitly triggers. No marketing email without your explicit opt-in.
• To keep the Service secure and diagnose problems.

4. If you uploaded documents through a portal

If a professional sent you a ClientLoft portal link, they control the documents you upload — we process them on their behalf under our Data Processing Agreement and make them available only to that professional. To correct or delete something you uploaded, contact the professional who sent you the link, or email us at legal@getclientloft.com and we will assist.

5. Service providers (subprocessors)

We share data only with the infrastructure providers needed to run ClientLoft:

• Netlify — application hosting and delivery
• Neon — database hosting (Postgres, US region)
• Resend — transactional email delivery
• Stripe — subscription billing and payment processing (your payment data, never your clients’ documents)

No AI provider is on this list: uploaded documents are never processed by or shared with AI — see the AI disclosure.

Each provider processes data under its own security and privacy commitments. We never share your data with advertisers or data brokers.

6. Retention

Account data, checklists, and uploaded documents are kept while your account is active. Deleting a client permanently deletes their uploaded files. If you close your account, we delete your data within 30 days, except minimal records we must keep for legal or accounting reasons. Server logs rotate on a short schedule.

7. Your rights

Depending on where you live (including the EU/EEA, UK, and California), you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. Email legal@getclientloft.com and we will respond within 30 days. We do not discriminate against you for exercising these rights.

8. Security

Data is encrypted in transit (TLS) and at rest by our database provider. Sign-in uses single-use, expiring magic links — no passwords to leak. Access to production systems is limited to the operator of the Service.

9. International transfers

Our infrastructure is hosted in the United States. If you use ClientLoft from outside the US, your data will be processed in the US under the safeguards described in this policy.

10. Children

ClientLoft is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

11. Changes

If we materially change this policy, we will notify account holders by email or in the dashboard before the change takes effect.

12. Contact

Media Yard LLC · legal@getclientloft.com