Privacy Policy

Effective Date: March 2, 2026

Last Updated: October 27, 2026

1. Introduction

Welcome to Doughy, a product of Secondly Homes LLC (doing business as “Secondly”) (“Company,” “we,” “our,” “us”). Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our services, including:

• Doughy — our mobile and web application for real estate investors and landlords, including deal management, portfolio tracking, call coaching, CRM, SMS communications, automated briefings, draft generation, and approval workflows

By using any of our services, you consent to the data practices described in this policy.

2. Information We Collect

Information You Provide Directly

• Account information: Name, email address, phone number, and password when you create an account.

• Property data: Property addresses, financial details, mortgage information, and related documents you enter into our platform.

• Contacts and leads: Names, phone numbers, email addresses, and notes about your real estate contacts and leads.

• Communications: SMS messages, email content, and chat messages sent or received through our platform.

• Call recordings and transcripts: Audio recordings and AI-generated transcriptions of calls made through Doughy, subject to your recording settings.

• Form submissions: Property details, contact information, and offer requests submitted through our website.

Information Collected Automatically

• Device information: Device type, operating system, browser type, and unique device identifiers.

• Usage analytics: Pages visited, features used, time spent in the application, and interaction patterns.

• Cookies and local storage: Used for sign-in sessions, saved preferences, and — only if you agree when asked — page analytics. Never for advertising or cross-site tracking (see Section 12).

Information from Third-Party Services

• Authentication data: Information from our authentication provider used to verify your identity.

• SMS metadata: Delivery status, timestamps, and carrier information for text messages sent through our platform.

3. How We Use Your Information

We use the information we collect to provide, maintain, and improve our services. Specific uses include:

• Managing deals, properties, contacts, and leads; providing AI-powered analysis and suggestions; tracking portfolio performance; and facilitating property management.

• Recording and transcribing calls (with consent), providing call coaching insights, sending and receiving SMS messages, managing CRM contacts, and generating call summaries.

• Classifying user intent from incoming messages, generating daily briefings from your data, drafting reply suggestions, creating approval workflows for AI-composed messages, and routing communications across channels.

• Processing property inquiries and offers, responding to contact form submissions, and sending service notifications via our website.

We do not sell or rent your personal information to third parties.

Google user data

If you connect a Google account, Doughy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Gmail. We send messages you have asked us to send, from your own address, so replies come back to you. We do not read your mailbox.

Calendar. We read the list of your calendars, so you can choose which one we put bookings on. We then add the bookings and viewings we arrange to that calendar and update them when they change. We do not read what is already in your calendar, we do not add guests to an event, and we do not email anyone about one.

Your account email. We read the address of the account you connect, so we can show you which one is connected.

We do not use Google data for advertising, we do not sell it, and we do not use it to train AI models. No person at Secondly Homes reads it except where you ask us to for support, where it is needed for security, or where the law requires it. You can disconnect a Google account at any time, which revokes our access.

4. AI and Automated Processing

Our platform uses artificial intelligence to provide features including:

• Call transcription and summarization

• Intent classification for incoming messages

• Daily briefing generation from your deals, leads, and communications

• Draft reply suggestions for SMS and email

• Deal analysis and call coaching notes

Important: We do not use your data to train AI models. Your data is processed by AI solely to provide our services to you.

Anything the AI would send outside your workspace on your behalf, including an SMS, an email, a call or a public listing, waits for your approval first, unless you have released it yourself with a per-contact setting or a lead-reply lease. The per-contact setting is not in the web app. Both releases are deliberate, and both are described here. The first exists only in the Doughy mobile app: on a contact edit screen you may set that one person to be answered without approval, which applies to replies to inbound messages and nothing else. Set to “autonomous” the reply is sent as soon as it is written; set to “guarded” it is sent sixty seconds later, so you have that long to stop it. The second is a reply to a rental inquiry: after you have approved five of its drafts in a row without editing them, the assistant may ask you for a 30-day permission to send those replies itself. You grant it, it covers replies to inquiries and nothing else, and it lapses unless you renew it. Everything else waits for you on every plan. You can also set spending and volume limits, or stop all automated activity outright. Calls and texts follow the federal 8am to 9pm calling hours in the local time of the person being contacted.

Every message the AI sends after you approve it is recorded in your activity feed, and any limits you have set continue to apply.

AI-generated content is clearly identified within our applications, and you retain full control over whether to act on AI suggestions.

5. SMS/Text Messaging

When you provide your phone number through our application or website and consent to receive text messages, we may send you SMS messages related to our services.

How We Collect Consent

Consent to receive SMS messages is collected through multiple channels:

• You message us first: when someone calls or texts one of our numbers, we reply in the same conversation. Our first reply tells you how to stop — reply STOP at any time.

• Web forms: five of them, each carrying the same optional box, unticked by default, and each able to be submitted without it — the public contact form at rent.doughy.app/contact, and, on every listing, the inquiry, the tour request, the pre-application and the application. Someone contacting a landlord may tick the box to agree to receive text messages about that request and the listing, at the number they entered. The contact form, the pre-application and the application ask about text messages only; the inquiry and the tour request ask about voice and AI-assisted calls as well, so a tick there covers those too.

• Tenants: a renter who ticked the optional box on their application, at the number they entered there, keeps that permission as a tenant and receives service messages about their tenancy — rent, maintenance and access. Signing a lease is not itself agreement to be texted, and we do not treat it as one.

• Business-recorded permission: a Doughy user may text a contact who gave that user permission in person, by phone or in writing. Before any automated or AI-sent message goes to that contact, the user records that permission in the app — who gave it, when, and in which form. This is also how a tenant is covered — no lease carries an SMS consent line, and signing one is not treated as agreement to be texted. No automated message is sent to a number without a recorded permission, or where the permission has been withdrawn, has expired, or the person has opted out. The first automated message identifies the business and includes “Reply STOP to opt out, HELP for help”, and the opt-out line is repeated at least once a month after that.

Types of Messages

• Service notifications and account alerts

• AI-generated daily briefings summarizing your deals and leads

• Draft reply suggestions for your review and approval

• Call summaries and follow-up reminders

• Property management updates and maintenance coordination

• Responses to your inquiries

Message Frequency

Message frequency varies based on your account activity and settings. You can control messaging preferences within the application settings.

Opting Out

Reply STOP to opt out of text messages at any time. Reply HELP for support.

Costs and Carrier Liability

Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. Not all carriers are supported.

We will not sell, share, or transfer your mobile phone number or any mobile information to third parties or affiliates for marketing or promotional purposes.

SMS consent is not a condition of purchase or use of any of our services. You may use our application without opting into text messages.

6. Information Sharing

We do not sell or rent your personal information. We may share your data with the following categories of third parties solely to provide our services:

• Communication providers: SMS message delivery and phone services.

• Cloud infrastructure providers: Database hosting, authentication, and file storage.

• AI providers: AI processing for call transcription, briefings, and draft generation.

• Public-site assistant: questions typed into the AI assistant on doughy.app, and the IP address they come from, are processed by our AI provider to generate the answer and by our bot-protection service to verify the request came from a person.

We may also disclose your information if required by law, court order, or government request; to protect the rights, property, or safety of Secondly Homes, our users, or others; or in connection with a merger, acquisition, or sale of assets.

7. Data Storage and Security

Your data is stored in secure cloud databases, and your workspace's data is kept separate from every other customer's — you can only access your own data. All data is encrypted in transit via TLS. Server-side credentials are stored securely and never exposed to client applications.

When our support staff can see your workspace

Doughy staff do not browse your workspace as part of normal operations. A member of our support team can open it and see what you see in limited situations: to investigate a problem you have raised with us, to look into a security issue or suspected fraud, or where the law requires it.

These sessions are read-only — nothing can be changed, sent or spent while one is open. They end automatically after 30 minutes. Every session records who opened it, whose account it was, and the reason given. While in your workspace, our staff can see what you can see, which includes your applicants' and tenants' information. We use that access only for the reason it was opened.

Call recordings, where calling features are active on your account, are stored securely and retained on the same schedule as your account data. We implement appropriate technical and organizational measures to protect your personal information, but no method of transmission over the Internet is 100% secure.

Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users without undue delay after becoming aware of it, and within any deadline applicable law sets. Notifications will be sent via email to the address associated with your account, and we will provide details about the nature of the breach, the data involved, and the steps we are taking to address it.

8. Data Retention

• Account data: Retained while your account is active and for 30 days after account deletion, then deleted from the service.

• Backups: Encrypted backups made before deletion are kept separately and are not part of the live service.

• Call recordings: Retained on the same schedule as account data.

• AI-generated content: Briefings, drafts, and suggestions are retained until you delete them.

• Communication logs: SMS and email records are retained for compliance and service continuity purposes.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.

• Correction: Request correction of inaccurate or incomplete data.

• Deletion: Request deletion of your personal data, subject to legal retention requirements.

• Portability: Request your data in a portable format.

• Opt-out: Opt out of marketing communications at any time.

Virginia Consumer Data Protection Act (VCDPA): If you are a Virginia resident, you have additional rights under the VCDPA, including the right to opt out of targeted advertising and profiling.

California Consumer Privacy Act (CCPA): If you are a California resident, you have additional rights under the CCPA, including the right to know what personal information is collected, the right to request deletion, and the right to opt out of automated decision making technology. See Section 13 for our ADMT disclosure.

To exercise any of these rights, contact us at hello@doughy.app.

10. Children's Privacy

Our services are intended for users who are at least 18 years of age, and accounts, listings, and rental applications are for adults. A rental application asks the adult applicant for household composition — the number of adults and the number of children who would live in the home. That is a count only: we do not ask for a child's name, date of birth, or any other identifier, and we do not knowingly collect personal information that identifies a person under 18. If we learn that we hold information identifying a child under 18, we will take steps to delete it promptly.

11. Third-Party Links

Our services may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to read the privacy policies of any third-party services you visit.

12. Cookies and Tracking

What we ask your permission for

Our marketing website (doughy.app) and our rentals site (rent.doughy.app) can measure page traffic with Google Analytics, which, if you agree, stores cookies in your browser (named _ga and _ga_ followed by a stream identifier) to recognize a returning visit. No analytics cookie is set unless you tell us it may be. The first time you visit, a notice at the foot of the window asks. Refusing is one press, in a button the same size as the one that accepts. You can change your answer at any time from “Cookie settings” at the foot of any page — switching it off stops collection immediately and deletes those cookies. We do not enable Google's advertising features: advertising storage, advertising user data and ad personalization are declared denied on every page load and are never turned on by any choice you can make here.

Before you answer, and if you answer no, on doughy.app: Google Analytics still loads, with every kind of storage denied, and sends cookieless, anonymous signals that a page was viewed or a button was pressed. They carry no cookie and no identifier that recognizes you or a returning visit; Google uses them only to estimate how many people visit, in aggregate. On rent.doughy.app nothing from Google is requested, run, or stored until you agree.

Your answer is remembered in your browser's own storage, under doughy:analytics-consent. It records only your choice and the date you made it, it never leaves your device, and clearing your browser's storage removes it — after which we will ask again rather than assume.

What is there whether or not you agree

Four small things, none of which identifies you, follows you to another website, or builds a profile: your light/dark display preference; whether you have dismissed a site notice; — only if you arrived through a referral link — the referral code from that link, so that whoever referred you is credited if you join the waitlist; and your analytics answer above. All four live in your browser's own storage and clearing it removes all of them. Our bot-protection provider may set a strictly necessary cookie while verifying that a form submission is human. We also measure page traffic with a cookieless analytics service provided by our hosting platform: it counts visits and pages in aggregate, does not use cookies, does not follow you across other sites, and does not build individual profiles — which is why it is not part of the question above.

Signed-in product surfaces use essential cookies and similar technologies to keep you authenticated and your session secure. We do not sell browsing data, and we do not use cross-site advertising trackers. If we ever ask analytics to collect anything beyond page traffic, we will ask you again rather than rely on the answer you gave to this question, and update this section first. You can manage or clear cookies through your browser settings.

13. Automated Decision Making Technology

In accordance with the California Consumer Privacy Act (CCPA) and its regulations regarding Automated Decision Making Technology (ADMT), we provide the following disclosure about how our platform uses automated processing.

How We Use Automated Processing

Our platform uses AI-powered decision support tools to assist with operational tasks related to real estate investing and property management. These automated systems provide suggestions and draft content in the following areas:

• Leasing operations: Comparison of applicant-supplied information against criteria the landlord set, and draft communications for prospective tenants. No recommendation, score, or decision about an applicant is produced.

• Maintenance coordination: Priority classification of maintenance requests, vendor matching suggestions, and cost estimates.

• Bookkeeping: Categorization of income and expenses, financial summary generation, and budget tracking alerts.

• Communications: Draft reply suggestions for SMS and email, intent classification of incoming messages, and daily operational briefings.

• Deal analysis: Property valuation estimates, comparable sale analysis, and investment return projections.

Human Oversight

Anything that leaves your workspace — a message to a contact, a change to a financial record, a change to an application status — is held for your approval before it happens, on every account. Apart from the per-contact setting and the lead-reply lease described under AI and Automated Processing (section 4) above, nothing turns that off. The AI recommends and drafts; you make the final decision on each item.

Daily spending and call limits cap what the platform can queue in a day, and a kill switch stops all automated activity outright. Every action the AI takes is recorded for you to review afterwards.

Your Right to Opt Out

You have the right to opt out of automated processing of your personal information. If you choose to opt out:

• You may stop all automated activity at any time using the kill switch.

• You may request that your data not be subject to automated analysis by contacting us directly.

• Opting out of automated processing will not affect your ability to use the core features of our platform. Manual alternatives are available for all automated functions.

Requesting Access to ADMT Information

California residents may request additional information about our use of Automated Decision Making Technology, including the logic involved and the intended outcomes. To submit a request, contact us at:

• Email: hello@doughy.app

• Phone: (703) 679-8951

• Mail: Secondly Homes, LLC d/b/a Secondly, 8401 Mayland Dr #5052, Richmond, VA 23294, USA

We aim to respond to verified requests within 45 days. You will not be discriminated against for exercising your rights.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through an in-app notification. The updated policy will be posted on this page with a revised effective date. Your continued use of our services after changes are posted constitutes your acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Secondly Homes, LLC d/b/a Secondly

8401 Mayland Dr #5052

Richmond, VA 23294, USA

Email: hello@doughy.app

Phone: (703) 679-8951