Subprocessors
The vendors Lotly engages to deliver the Services, and what each one handles.
Below is the current list of subprocessors Lotly Software LLC engages to deliver the Services. Subscribers may subscribe to receive prior notice of material changes by emailing privacy@lotly.ai with the subject line “subprocessor change notice”. We commit to at least fifteen (15) calendar days’ prior notice before any new subprocessor begins processing Customer Data, except where the change is required to address a security emergency or a legal obligation.
| Vendor | Purpose | Data categories | Hosting region | Transfer basis |
|---|---|---|---|---|
| Amazon Web Services | Compute, storage, database, email (SES), file delivery, CDN | All Personal Information processed by the Services (encrypted at rest) | us-west-1 (primary), us-west-2 (SES inbound) | US-only; AWS DPA |
| TransUnion LLC | Consumer credit reports, identity verification, fraud detection | SSN, DOB, name, address, credit data (FCRA reseller relationship) | United States | Reseller agreement; FCRA |
| Asurint | Housing court records, criminal background reports | Name, DOB, address, criminal-record data | United States | Reseller agreement; FCRA |
| TLO / TRADS (TransUnion Risk and Alternative Data Solutions) | Fraud and identity-verification reports | Name, DOB, SSN-last4, address history | United States | Reseller agreement; FCRA |
| Pinwheel CRA Co. (affiliate of Underdog Technologies, Inc. d/b/a Pinwheel) | Income & employment verification | Applicant identity (name, DOB, SSN), employer, payroll and employment data | United States | Reseller agreement; FCRA |
| Anthropic, PBC | AI inference for the Maintenance Agent, Paper Application OCR, document classification, AI Lot Inspector (property-condition analysis of walkthrough video/photos; no facial recognition), eviction/notice drafting, and other AI-Assisted Output | Operator-submitted free-text, uploaded images, and walkthrough video/photos; no consumer-report data | United States | Anthropic DPA; zero-retention API tier where supported |
| Google LLC | Google Places API for vendor discovery in the AI Maintenance Agent | Property-address strings only; no consumer PII | United States | Google Cloud DPA |
| Plaid Inc. | Bank-account verification and transaction sync (operator banking) | Bank-credentials proxy, transaction data (operator-side accounts) | United States | Plaid DPA |
| Accept.blue | Subscription billing and tenant rent payment processing (ACH + card) | Subscriber and tenant name, billing address, bank-account / card details | United States | Accept.blue MSA |
| Five Star Bank | NACHA ACH origination (rent collection) | Tenant name, routing/account, payment amount | United States | Treasury services agreement |
| LetterStream, Inc. | Physical mail delivery (certified mail, decision letters, adverse-action notices) | Recipient name, address, document content | United States | LetterStream MSA |
| Twilio Inc. | SMS notifications (rent reminders, OTP) | Phone number, message body | United States | Twilio DPA |
| Vosy LLC (Vosy.ai) | Voice / telephony (outbound reference verification; inbound maintenance & support calls) | Caller phone number, call-audio metadata | United States | Vosy DPA |
| Collabora Productivity | In-browser document editing (files.lotly.ai) | Document content (operator-uploaded) | Self-hosted (us-west-1) | Self-hosted; no third-party processing |
Scroll the table sideways to see every column.
All subprocessors listed above have executed Data Processing Agreements (or, for FCRA reseller relationships, FCRA-compliant reseller agreements) with Lotly Software LLC. None of them are authorized to use Customer Data for their own commercial purposes or to train consumer-facing AI models on it; vendor-specific carve-outs (e.g., service-improvement processing) are flowed down from each vendor’s DPA and are limited to aggregated, de-identified data as permitted by Cal. Civ. Code § 1798.140(ag)(1)(D) and analogous state-law provisions.
Subscribe to change notices
To be notified of subprocessor additions, removals, or material role changes, email privacy@lotly.ai from the address you want notices sent to, with the subject line “subprocessor change notice” and the name of your Lotly account. You may unsubscribe at any time. This subscription is in addition to (not in place of) any notice Lotly is required to provide under the DPA.