Subprocessors
Below is the current list of subprocessors Lotly Software LLC engages to deliver the Services. Subscribers may subscribe to receive prior notice of material changes by emailing privacy@lotly.ai with the subject line “subprocessor change notice”. We commit to at least fifteen (15) calendar days’ prior notice before any new subprocessor begins processing Customer Data, except where the change is required to address a security emergency or a legal obligation.
Version: 2026-05-21 · Effective: 2026-05-21. Older versions are retained in our internal subprocessor archive and provided on request.
| Vendor | Purpose | Data categories | Hosting region | Transfer basis |
|---|---|---|---|---|
| Amazon Web Services | Compute, storage, database, email (SES), file delivery, CDN | All Personal Information processed by the Services (encrypted at rest) | us-west-1 (primary), us-west-2 (SES inbound) | US-only; AWS DPA |
| TransUnion LLC | Consumer credit reports, identity verification, fraud detection | SSN, DOB, name, address, credit data (FCRA reseller relationship) | United States | Reseller agreement; FCRA |
| Asurint | Housing court records, criminal background reports | Name, DOB, address, criminal-record data | United States | Reseller agreement; FCRA |
| TLO / TRADS (TransUnion Risk and Alternative Data Solutions) | Fraud and identity-verification reports | Name, DOB, SSN-last4, address history | United States | Reseller agreement; FCRA |
| Anthropic, PBC | AI inference for the Maintenance Agent, Paper Application OCR, and document classification | Operator-submitted free-text and uploaded images; no consumer-report data | United States | Anthropic DPA; zero-retention API tier where supported |
| Google LLC | Google Places API for vendor discovery in the AI Maintenance Agent | Property-address strings only; no consumer PII | United States | Google Cloud DPA |
| Plaid Inc. | Bank-account verification and transaction sync (operator banking) | Bank-credentials proxy, transaction data (operator-side accounts) | United States | Plaid DPA |
| Stripe, Inc. | Subscription billing for Subscribers | Subscriber name, email, billing address, last-4 card | United States | Stripe DPA |
| Accept Blue | Tenant rent payment processing (ACH + card) | Tenant name, bank-account / card details | United States | Accept Blue MSA |
| Five Star Bank | NACHA ACH origination (rent collection) | Tenant name, routing/account, payment amount | United States | Treasury services agreement |
| LetterStream, Inc. | Physical mail delivery (certified mail, decision letters, adverse-action notices) | Recipient name, address, document content | United States | LetterStream MSA |
| Twilio Inc. | SMS notifications (rent reminders, OTP) | Phone number, message body | United States | Twilio DPA |
| Vosy (subprocessor of Twilio) | Voice/SMS routing for Maintenance Agent inbound | Caller phone number, call-audio metadata | United States | Twilio flow-down |
| Collabora Productivity | In-browser document editing (files.lotly.ai) | Document content (operator-uploaded) | Self-hosted (us-west-1) | Self-hosted; no third-party processing |
All subprocessors listed above have executed Data Processing Agreements (or, for FCRA reseller relationships, FCRA-compliant reseller agreements) with Lotly Software LLC. None of them are authorized to use Customer Data for their own commercial purposes or to train consumer-facing AI models on it; vendor-specific carve-outs (e.g., service-improvement processing) are flowed down from each vendor’s DPA and are limited to aggregated, de-identified data as permitted by Cal. Civ. Code § 1798.140(ag)(1)(D) and analogous state-law provisions.
Subscribe to change notices
To be notified of subprocessor additions, removals, or material role changes, email privacy@lotly.ai from the address you want notices sent to, with the subject line “subprocessor change notice” and the name of your Lotly account. You may unsubscribe at any time. This subscription is in addition to (not in place of) any notice Lotly is required to provide under the DPA.