Privacy Policy

Last updated: October 6, 2026

Who we are

Lofi Lotus LLC ("Lofi Lotus," "we," "us," or "our") is a California limited liability company that builds AI-powered automation software for small and medium businesses, starting with the AI Leasing Assistant ("Lotus") for multifamily property operators. This policy covers lofilotusllc.com and the Lotus product, including its website chat widget, AI phone receptionist, and owner dashboard.

If you're a prospective tenant interacting with a property's chat widget or phone line, or a property owner/operator connecting your Google Workspace to Lotus, this policy explains what we collect and why.

Information we collect

From property owners and operators (our direct customers):

• Account and contact information you give us during onboarding (name, email, phone, company).
• The specific Google Drive folder you designate, containing your leasing policies, FAQs, and amenity documentation — never your full Drive.
• Free/busy availability on the specific Google Calendar you designate for tour scheduling, and the events Lotus creates on it.
• Unit, pricing, and availability data you provide via a connected Sheet, or (where enabled) your AppFolio account.

From prospective tenants and website visitors:

• Messages sent through a property's chat widget or spoken during a phone call with the AI receptionist, including any contact information you share (name, phone, email).
• Call recordings and transcriptions of phone conversations with the AI receptionist, kept for the same quality and audit reasons as chat transcripts.
• Basic technical information (like browser type and IP address) needed to operate the chat widget securely.

From visitors to this website generally: information you submit through our contact form, and standard web server logs.

How we use this information

• To operate the Lotus Leasing Assistant: answering questions accurately from a property's own documentation, checking real unit availability and pricing, and booking tours on a property's calendar.
• To route leads and booked tours to the property owner or their staff in real time.
• To maintain a record of conversations and outcomes, for quality assurance and as an audit trail — including flagging conversations that were escalated to a human.
• To keep a property's answers current by syncing with the documents, calendar, and pricing data the owner has connected.
• To respond to inquiries submitted through our contact form, and to operate and improve our website and product.

Google user data

Lotus requests access to Google Workspace data only with a property owner's explicit consent, and only what the product needs to function:

• Drive: access is limited to the single folder the owner selects through Google's file picker during onboarding — Lotus never requests or receives access to any other file in the owner's Drive.
• Calendar: access is limited to reading free/busy time and creating tour-booking events on the one calendar the owner designates. Lotus does not read or modify any other calendar or calendar settings.
• Gmail: access is send-only. Lotus uses it only to send tour-confirmation and lead-notification emails from the owner's own connected Gmail account — it never reads, searches, or modifies anything already in the owner's mailbox.

Lotus's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. OAuth credentials are encrypted at rest (see "Data storage and security" below), and an owner can revoke Lotus's access at any time from their Google Account permissions page.

In keeping with the Limited Use requirements, Lotus uses Google user data only to provide and improve the user-facing features described above. We do not sell Google user data, do not use it for advertising (including retargeting or interest-based ads), and do not transfer it to third parties except as needed to provide those features, to comply with law, or as part of a merger or acquisition with notice to affected users. Our staff do not read Google user data unless the owner gives specific consent, it is necessary for security purposes such as investigating abuse, or it is required by law. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models.

If an owner revokes Lotus's access or asks us to stop, we stop accessing their Google data. An owner can ask us to delete the Google user data and stored OAuth credentials Lotus holds for their property by contacting us at the email below, and we will act on the request promptly.

How we share information

We do not sell personal information. We share information only as needed to operate the product:

• With the property owner or operator whose property a conversation relates to — that's the core function of the product.
• With service providers who process data on our behalf under contract, including Google Cloud (which hosts our infrastructure and provides the Gemini AI models, via Vertex AI, used to generate conversational responses), our telephony/voice provider (for the AI phone receptionist), and providers who deliver email or SMS notifications on our behalf.
• If required by law, or to protect the rights, safety, or property of Lofi Lotus, our customers, or others.

Information will not be sold or shared with third parties for promotional or marketing purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Data storage and security

Data is hosted on Google Cloud Platform. We use the following safeguards to protect personal information, including data we receive from Google APIs:

• Encryption in transit: all traffic between your browser, phone provider, our services, and Google's APIs is encrypted with TLS (HTTPS).
• Encryption at rest: data in our databases and storage is encrypted at rest using Google Cloud's encryption. In addition, Google OAuth refresh tokens are encrypted before they are stored, using keys managed in Google Cloud Key Management Service (KMS); the plaintext token is never written to our database or logs.
• Secrets management: application credentials, API keys, and signing secrets are kept in Google Secret Manager rather than in source code or configuration files.
• Tenant isolation: each property's data is logically isolated from every other property's, enforced in our data-access layer — one property's information is never retrievable in another property's conversation.
• Access controls and auditing: access to production systems and data is restricted to authorized Lofi Lotus personnel on a least-privilege basis, and administrative access to our Google Cloud resources is recorded in Google Cloud audit logs.
• Revocation: an owner can revoke Lotus's access to their Google account at any time at myaccount.google.com/permissions.

No method of transmission or storage is perfectly secure, but we work to protect your information and will notify affected customers of a security incident as required by law. We also monitor the freshness of the data each property connects, and the assistant is designed to hedge or escalate to a human rather than confidently state information that may be out of date.

Cookies and tracking

The chat widget keeps track of your conversation within a browsing session so a page refresh doesn't lose your place. We do not track you across sessions or across other websites without your consent.

Your choices and rights

• Prospective tenants can ask to speak with a human at any point in a chat or call, and can ask what information has been collected about them by contacting the property directly or us at the email below.
• Property owners can revoke Lotus's access to their Google account at any time at myaccount.google.com/permissions.
• California residents have additional rights under California law regarding access, deletion, and correction of personal information. We do not sell personal information, so there is nothing to opt out of in that respect.
• To exercise any of these rights, contact us at the email below.

SMS Communications

• We send text messages only to people who have explicitly agreed to them. A prospective renter agrees by saying yes when Lotus asks, on a phone call or in website chat, whether it may text a tour confirmation, or by checking the unchecked, optional SMS consent box next to the phone field on our contact form. A property's leasing staff opt in to alert texts when their property operator enters their mobile number during onboarding. Simply having your phone number on file (for example, from caller ID, or because you typed it in chat) is never treated as consent. Consent is not a condition of any purchase. See our Terms & Conditions and SMS program page for full SMS program terms. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. We do not sell or share phone numbers or SMS consent with third parties or affiliates for their marketing purposes.
• Messages come from "Lotus" and relate to your request: tour confirmations and scheduling updates for prospects, and account alerts (new lead, tour booked, urgent hand-off) for property staff. Message frequency: up to 3 messages per tour request for prospects (usually just one), and for property staff one alert per event, typically up to 3 alerts per lead. Message and data rates may apply. Reply STOP at any time to opt out, reply START or YES to rejoin, or reply HELP for assistance.

Children's privacy

Lotus is intended for use by adults inquiring about rental housing and by business customers. It is not directed at children, and we do not knowingly collect personal information from children under 13.

Changes to this policy

We may update this policy as the product evolves. We'll update the "Last updated" date above when we do, and for material changes we'll take reasonable steps to let our customers know.

Contact us

Questions about this policy or your information? Reach us at info@lofilotusllc.com.