Privacy Policy

Effective Date: March 2, 2026

Last Updated: August 24, 2026

1. Introduction

Welcome to Doughy, a product of Secondly Homes LLC (doing business as “Secondly”) (“Company,” “we,” “our,” “us”). Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our services, including:

• Doughy — our mobile and web application for real estate investors and landlords, including deal management, portfolio tracking, call coaching, CRM, SMS communications, automated briefings, draft generation, and approval workflows

By using any of our services, you consent to the data practices described in this policy.

2. Information We Collect

Information You Provide Directly

• Account information: Name, email address, phone number, and password when you create an account.

• Property data: Property addresses, financial details, mortgage information, and related documents you enter into our platform.

• Contacts and leads: Names, phone numbers, email addresses, and notes about your real estate contacts and leads.

• Communications: SMS messages, email content, and chat messages sent or received through our platform.

• Call recordings and transcripts: Audio recordings and AI-generated transcriptions of calls made through Doughy, subject to your recording settings.

• Form submissions: Property details, contact information, and offer requests submitted through our website.

Information Collected Automatically

• Device information: Device type, operating system, browser type, and unique device identifiers.

• Usage analytics: Pages visited, features used, time spent in the application, and interaction patterns.

• Cookies and local storage: Used for sign-in sessions, saved preferences, and — only if you agree when asked — page analytics. Never for advertising or cross-site tracking (see Section 12).

Information from Third-Party Services

• Authentication data: Information from our authentication provider used to verify your identity.

• SMS metadata: Delivery status, timestamps, and carrier information for text messages sent through our platform.

3. How We Use Your Information

We use the information we collect to provide, maintain, and improve our services. Specific uses include:

• Managing deals, properties, contacts, and leads; providing AI-powered analysis and suggestions; tracking portfolio performance; and facilitating property management.

• Recording and transcribing calls (with consent), providing call coaching insights, sending and receiving SMS messages, managing CRM contacts, and generating call summaries.

• Classifying user intent from incoming messages, generating daily briefings from your data, drafting reply suggestions, creating approval workflows for AI-composed messages, and routing communications across channels.

• Processing property inquiries and offers, responding to contact form submissions, and sending service notifications via our website.

We do not sell or rent your personal information to third parties.

4. AI and Automated Processing

Our platform uses artificial intelligence to provide features including:

• Call transcription and summarization

• Intent classification for incoming messages

• Daily briefing generation from your deals, leads, and communications

• Draft reply suggestions for SMS and email

• Deal analysis and call coaching notes

Important: We do not use your data to train AI models. Your data is processed by AI solely to provide our services to you.

You control whether the AI sends on your behalf. For each kind of outbound message — SMS, email, and calls — you can require your approval before anything is sent, set spending and volume limits, restrict after-hours activity, or stop all automated activity outright. These controls are available on every plan.

Where you have not required approval for a kind of message, the AI may send that kind of message on your behalf without asking first. Every message it sends is recorded in your activity feed, and any limits you have set continue to apply. We recommend reviewing these settings before you connect a phone number or a mailbox.

AI-generated content is clearly identified within our applications, and you retain full control over whether to act on AI suggestions.

5. SMS/Text Messaging

When you provide your phone number through our application or website and consent to receive text messages, we may send you SMS messages related to our services.

How We Collect Consent

Consent to receive SMS messages is collected through multiple channels:

• In-app: When users create an account and add contacts with phone numbers in the Doughy application, a consent disclosure is displayed. Users acknowledge that SMS messages may be sent on their behalf.

• Existing business relationships: Tenants who provide their phone numbers as part of lease agreements or property management onboarding consent to receive service-related text messages.

• Website: Property owners who submit their phone number and inquiry through doughy.app or secondlyhomes.com consent to receive follow-up communications.

Types of Messages

• Service notifications and account alerts

• AI-generated daily briefings summarizing your deals and leads

• Draft reply suggestions for your review and approval

• Call summaries and follow-up reminders

• Property management updates and maintenance coordination

• Responses to your inquiries

Message Frequency

Message frequency varies based on your account activity and settings. You can control messaging preferences within the application settings.

Opting Out

Reply STOP to opt out of text messages at any time. Reply HELP for support.

Costs and Carrier Liability

Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. Not all carriers are supported.

We will not sell, share, or transfer your mobile phone number or any mobile information to third parties or affiliates for marketing or promotional purposes.

SMS consent is not a condition of purchase or use of any of our services. You may use our application without opting into text messages.

6. Information Sharing

We do not sell or rent your personal information. We may share your data with the following categories of third parties solely to provide our services:

• Communication providers: SMS message delivery and phone services.

• Cloud infrastructure providers: Database hosting, authentication, and file storage.

• AI providers: AI processing for call transcription, briefings, and draft generation.

• Public-site assistant: questions typed into the AI assistant on doughy.app, and the IP address they come from, are processed by our AI provider to generate the answer and by our bot-protection service to verify the request came from a person.

We may also disclose your information if required by law, court order, or government request; to protect the rights, property, or safety of Secondly Homes, our users, or others; or in connection with a merger, acquisition, or sale of assets.

7. Data Storage and Security

Your data is stored in secure cloud databases, and your workspace's data is kept separate from every other customer's — you can only access your own data. All data is encrypted in transit via TLS. Server-side credentials are stored securely and never exposed to client applications.

When our support staff can see your workspace

Doughy staff do not browse your workspace as part of normal operations. A member of our support team can open it and see what you see in limited situations: to investigate a problem you have raised with us, to look into a security issue or suspected fraud, or where the law requires it.

These sessions are read-only — nothing can be changed, sent or spent while one is open. They end automatically after 30 minutes. Every session records who opened it, whose account it was, and the reason given. While in your workspace, our staff can see what you can see, which includes your applicants' and tenants' information. We use that access only for the reason it was opened.

Call recordings, where calling features are active on your account, are stored securely and retained on the same schedule as your account data. We implement appropriate technical and organizational measures to protect your personal information, but no method of transmission over the Internet is 100% secure.

Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users within 72 hours of becoming aware of the breach, in accordance with applicable law. Notifications will be sent via email to the address associated with your account, and we will provide details about the nature of the breach, the data involved, and the steps we are taking to address it.

8. Data Retention

• Account data: Retained while your account is active and for 30 days after account deletion.

• Call recordings: Retained on the same schedule as account data.

• AI-generated content: Briefings, drafts, and suggestions are retained until you delete them.

• Communication logs: SMS and email records are retained for compliance and service continuity purposes.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.

• Correction: Request correction of inaccurate or incomplete data.

• Deletion: Request deletion of your personal data, subject to legal retention requirements.

• Portability: Request your data in a portable format.

• Opt-out: Opt out of marketing communications at any time.

Virginia Consumer Data Protection Act (VCDPA): If you are a Virginia resident, you have additional rights under the VCDPA, including the right to opt out of targeted advertising and profiling.

California Consumer Privacy Act (CCPA): If you are a California resident, you have additional rights under the CCPA, including the right to know what personal information is collected, the right to request deletion, and the right to opt out of automated decision making technology. See Section 13 for our ADMT disclosure.

To exercise any of these rights, contact us at hello@doughy.app.

10. Children's Privacy

Our services are intended for users who are at least 18 years of age, and accounts, listings, and rental applications are for adults. A rental application asks the adult applicant for household composition — the number of adults and the number of children who would live in the home. That is a count only: we do not ask for a child's name, date of birth, or any other identifier, and we do not knowingly collect personal information that identifies a person under 18. If we learn that we hold information identifying a child under 18, we will take steps to delete it promptly.

11. Third-Party Links

Our services may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to read the privacy policies of any third-party services you visit.

12. Cookies and Tracking

What we ask your permission for

Our marketing website (doughy.app) and our rentals site (rent.doughy.app) can measure page traffic with Google Analytics, which stores cookies in your browser (named _ga and _ga_ followed by a stream identifier) to recognise a returning visit. It is not loaded unless you tell us it may be. The first time you visit, a notice at the foot of the window asks; until you answer, and forever if you answer no, nothing from Google is requested, run, or stored, and no analytics cookie exists. Refusing is one press, in a button the same size as the one that accepts. You can change your answer at any time from “Cookie settings” at the foot of any page — switching it off stops collection immediately and deletes those cookies. We do not enable Google's advertising features: advertising storage, advertising user data and ad personalisation are declared denied on every page load and are never turned on by any choice you can make here.

Your answer is remembered in your browser's own storage, under doughy:analytics-consent. It records only your choice and the date you made it, it never leaves your device, and clearing your browser's storage removes it — after which we will ask again rather than assume.

What is there whether or not you agree

Four small things, none of which identifies you, follows you to another website, or builds a profile: your light/dark display preference; whether you have dismissed a site notice; — only if you arrived through a referral link — the referral code from that link, so that whoever referred you is credited if you join the waitlist; and your analytics answer above. All four live in your browser's own storage and clearing it removes all of them. Our bot-protection provider may set a strictly necessary cookie while verifying that a form submission is human. We also measure page traffic with a cookieless analytics service provided by our hosting platform: it counts visits and pages in aggregate, does not use cookies, does not follow you across other sites, and does not build individual profiles — which is why it is not part of the question above.

Signed-in product surfaces use essential cookies and similar technologies to keep you authenticated and your session secure. We do not sell browsing data, and we do not use cross-site advertising trackers. If we ever ask analytics to collect anything beyond page traffic, we will ask you again rather than rely on the answer you gave to this question, and update this section first. You can manage or clear cookies through your browser settings.

13. Automated Decision Making Technology

In accordance with the California Consumer Privacy Act (CCPA) and its regulations regarding Automated Decision Making Technology (ADMT), we provide the following disclosure about how our platform uses automated processing.

How We Use Automated Processing

Our platform uses AI-powered decision support tools to assist with operational tasks related to real estate investing and property management. These automated systems provide suggestions and draft content in the following areas:

• Leasing operations: Comparison of applicant-supplied information against criteria the landlord set, and draft communications for prospective tenants. No recommendation, score, or decision about an applicant is produced.

• Maintenance coordination: Priority classification of maintenance requests, vendor matching suggestions, and cost estimates.

• Bookkeeping: Categorization of income and expenses, financial summary generation, and budget tracking alerts.

• Communications: Draft reply suggestions for SMS and email, intent classification of incoming messages, and daily operational briefings.

• Deal analysis: Property valuation estimates, comparable sale analysis, and investment return projections.

Human Oversight

Anything that leaves your workspace — a message to a contact, a change to a financial record, a change to an application status — is held for your approval before it happens, on every account. There is no setting that turns this off. The AI recommends and drafts; you make the final decision on each item.

Daily spending and call limits cap what the platform can queue in a day, and a kill switch stops all automated activity outright. Every action the AI takes is recorded for you to review afterwards.

Your Right to Opt Out

You have the right to opt out of automated processing of your personal information. If you choose to opt out:

• You may stop all automated activity at any time using the kill switch.

• You may request that your data not be subject to automated analysis by contacting us directly.

• Opting out of automated processing will not affect your ability to use the core features of our platform. Manual alternatives are available for all automated functions.

Requesting Access to ADMT Information

California residents may request additional information about our use of Automated Decision Making Technology, including the logic involved and the intended outcomes. To submit a request, contact us at:

• Email: hello@doughy.app

• Phone: (703) 679-8951

• Mail: Secondly Homes, LLC d/b/a Secondly, 8401 Mayland Dr #5052, Richmond, VA 23294, USA

We aim to respond to verified requests within 45 days. You will not be discriminated against for exercising your rights.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through an in-app notification. The updated policy will be posted on this page with a revised effective date. Your continued use of our services after changes are posted constitutes your acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Secondly Homes, LLC d/b/a Secondly

8401 Mayland Dr #5052

Richmond, VA 23294, USA

Email: hello@doughy.app

Phone: (703) 679-8951