DPA · Subprocessor List
Subprocessors
The vendors Lotly engages to deliver the Services, and what each one handles.
Below is the current list of subprocessors Lotly Software LLC engages to deliver the Services. Subscribers may subscribe to receive prior notice of material changes by emailing privacy@lotly.ai with the subject line “subprocessor change notice”. We commit to at least fifteen (15) calendar days’ prior notice before any new subprocessor begins processing Customer Data, except where the change is required to address a security emergency or a legal obligation.
| Vendor | Purpose | Data categories | Hosting region | Transfer basis |
|---|---|---|---|---|
| Amazon Web Services | Compute, storage, database, email (SES), file delivery, CDN | All Personal Information processed by the Services (encrypted at rest) | us-west-1 (primary), us-west-2 (SES inbound) | US-only; AWS DPA |
| TransUnion LLC | Consumer credit reports and ResidentScore tenant-screening scores, including identity-mismatch and fraud alerts | Sent: applicant name, SSN, date of birth, current and previous addresses, phone, email, and income and employer where provided. Received: credit report (accounts, inquiries, collections, public records), ResidentScore, and identity and fraud alerts | United States | Reseller agreement; FCRA |
| One Source Technology, LLC d/b/a Asurint | Housing records (landlord-tenant and eviction court filings and judgments), criminal background records, and sanctions and watchlist screening | Sent: applicant name and aliases, SSN, date of birth, and address history. Received: housing records, criminal case records, sanctions and watchlist results, and aliases | United States | Reseller agreement; FCRA |
| TLO / TRADS (TransUnion Risk and Alternative Data Solutions) | Fraud and identity-verification reports (Lotly Fraud Report) | Sent: applicant name, SSN, date of birth, and address. Received: identity and address-history results, including aliases, current and past addresses, phone numbers, and other public-record identifiers | United States | Reseller agreement; FCRA; DPPA/GLBA permissible use |
| Pinwheel CRA Co. (affiliate of Underdog Technologies, Inc. d/b/a Pinwheel) | Income and employment verification, identity verification, and authentication of income documents an applicant uploads | Applicant identity (name, date of birth, SSN, contact details); payroll-account connection, employer, pay stubs, income, shifts, and employment data; uploaded pay stubs and other income documents | United States | Reseller agreement; FCRA |
| Anthropic, PBC | Primary AI provider: Maintenance Agent and maintenance call intake; paper rental-application and lease extraction; bill, bank-statement, and insurance-document extraction; transaction categorization; prospect-reply and delinquency-outreach drafting; operator and resident help assistants; AI Lot Inspector (no facial recognition); eviction and notice drafting; data-import mapping; reading caller details from dispute-line transcripts | Content submitted to AI features: messages from Subscribers, residents, and prospects; rental applications (which can include SSN, date of birth, and income) and leases; bills, bank statements, transaction details, and insurance documents; resident balances and ledgers; maintenance requests and call transcripts; photos and walkthrough video; dispute-line call transcripts. Consumer reports received from CRAs are not sent | United States | Anthropic DPA; zero-retention API tier where supported |
| OpenAI, L.L.C. | Speech-to-text transcription and summaries of operator phone calls and voicemails; backup provider for the AI features listed for Anthropic | Call and voicemail audio, transcripts, and summaries; when used as backup, the categories listed for Anthropic | United States | OpenAI DPA; API inputs not used for model training |
| Google LLC (Gemini API) | Backup provider for the AI features listed for Anthropic when the primary provider is unavailable | The categories listed for Anthropic, when used as backup | United States | Google Cloud DPA; paid-tier API inputs not used for model training |
| Google LLC | Google Maps Platform (Places, Geocoding, Maps, and aerial imagery) for vendor discovery in the AI Maintenance Agent, property maps, and address lookup | Addresses and place searches entered in the Services; no consumer-report data | United States | Google Cloud DPA |
| Google LLC | Google Analytics 4 — aggregate usage measurement on the lotly.ai marketing website. Not used in the Lotly mobile applications and not used in the Tenant, Owner, or Operator portals. | Marketing-site visitors only: IP address (truncated where supported), device and browser data, pages viewed. No Applicant, Resident, or Consumer Report data. | United States | Google Ads Data Processing Terms; loaded only on consent to the analytics cookie category |
| Google LLC | Google Ads conversion measurement on the lotly.ai marketing website. Not used in the Lotly mobile applications and not used in the portals. | Marketing-site visitors only: IP address, device and browser data, conversion events. No Applicant, Resident, or Consumer Report data. | United States | Google Ads Data Processing Terms; loaded only on consent to the marketing cookie category. Where Applicable Law so requires this is treated as “sharing” for cross-context behavioral advertising and Global Privacy Control is honored |
| Plaid Inc. | Bank-account verification and transaction sync for Subscriber banking; bank-account linking for resident autopay | Account-holder name, account and routing numbers, balances, and transactions for linked Subscriber accounts; resident bank-account details for autopay (bank login credentials go directly to Plaid, never to Lotly) | United States | Plaid DPA |
| Accept.blue | Subscription billing and tenant rent payment processing (ACH + card) | Subscriber and tenant name, billing address, bank-account / card details | United States | Accept.blue MSA |
| Five Star Bank | NACHA ACH origination (rent collection) | Tenant name, routing/account, payment amount | United States | Treasury services agreement |
| LetterStream, Inc. | Physical and certified mail: adverse-action and decision letters, lease, renewal, and rent-increase notices, violation notices, and 1099 tax forms | Recipient name and mailing address and letter content, including 1099 forms (which contain taxpayer identification numbers) | United States | LetterStream MSA |
| Twilio Inc. | SMS messaging; voice calling (softphone, call routing, conference calls, voicemail) with call recording; A2P 10DLC brand registration; the toll-free consumer dispute line, including recording and speech-to-text transcription | Phone numbers and message content; call audio, recordings, and voicemails; Subscriber business registration details (business name, EIN, address, contact person); dispute-line recordings and transcripts (deleted from Twilio once copied to Lotly systems) | United States | Twilio DPA |
| Vosy LLC (Vosy.ai) | Voice / telephony: AI-assisted prior-landlord reference calls; inbound maintenance and support calls | Applicant name, prior-landlord name and phone number, property name and reference address, reported rent and reference questions; call audio, transcripts, and AI summaries; inbound caller phone numbers | United States | Vosy DPA |
| Microsoft Corporation | Microsoft 365 / Exchange Online: delivery of email sent by the Services (notices, receipts, dispute and screening correspondence), inbound email processing, and calendar sync at a user’s direction | Recipient and sender names and email addresses, message content and attachments; calendar event details for connected calendars | United States | Microsoft Products and Services DPA |
| Google LLC | Google Calendar integration at a user’s direction (booking and scheduling) | Calendar event details and attendee names and email addresses for connected calendars | United States | Google terms for the connected account |
| IPinfo | IP-address geolocation used to determine which state-law notices apply to an applicant | Applicant IP address | United States | Vendor terms |
| ip-api.com | IP-address geolocation for e-signature audit trails and employee time-clock location checks | Signer and employee IP addresses | Vendor infrastructure | Vendor terms |
| Second Nature | Resident protection-plan (renters insurance / resident benefits) enrollment, where a Subscriber offers the plan | Enrolled resident and adult occupant names, unit address, plan status and dates | United States | Program agreement |
| WaterScope | Utility meter-reading sync for Subscribers that connect a WaterScope account | Property, unit, and meter identifiers; water-usage readings | United States | Vendor terms |
| Select Bankcard | Merchant-account applications for Subscribers that apply for card processing | Subscriber business and principal contact details submitted with the application | United States | Merchant services agreement |
| Meta Platforms, Inc. | Facebook and Instagram connection for Subscriber listing posts and marketing, at the Subscriber’s direction | Subscriber page and account identifiers, listing content and photos, and messages or leads received through connected accounts | United States | Meta Platform Terms |
| Zillow Group | Rental listing syndication (Zillow Rentals / HotPads feed) and receipt of rental leads, where a Subscriber publishes listings | Listing details and photos; prospect names, contact details, and messages sent through Zillow | United States | Zillow listing feed terms |
| Apple, Google, and Mozilla push services | Delivery of browser and device push notifications | Device push tokens and end-to-end encrypted notification payloads (content not readable by the service) | United States | Platform push terms |
| Collabora Productivity | In-browser document editing (files.lotly.ai) | Document content (operator-uploaded) | Self-hosted (us-west-1) | Self-hosted; no third-party processing |
Scroll the table sideways to see every column.
Subprocessors whose Transfer basis names a DPA, reseller agreement, or other agreement have executed that agreement with Lotly Software LLC (for FCRA reseller relationships, an FCRA-compliant reseller agreement); the others process data under the vendor’s standard terms, which limit use to providing the service. None of them are authorized to use Customer Data for their own commercial purposes or to train consumer-facing AI models on it; vendor-specific carve-outs (e.g., service-improvement processing) are flowed down from each vendor’s DPA and are limited to aggregated, de-identified data as permitted by Cal. Civ. Code § 1798.140(ag)(1)(D) and analogous state-law provisions.
Subscribe to change notices
To be notified of subprocessor additions, removals, or material role changes, email privacy@lotly.ai from the address you want notices sent to, with the subject line “subprocessor change notice” and the name of your Lotly account. You may unsubscribe at any time. This subscription is in addition to (not in place of) any notice Lotly is required to provide under the DPA.