Privacy Policy

This Privacy Policy explains how Intake Scout LLC, an Ohio limited liability company doing business as Lotably (“Lotably,” “we,” “us” or “our”), collects, uses, discloses and protects personal information. It applies to lotably.com, app.lotably.com, the parking operator websites we host at subdomains of lotably.com or at an operator’s own domain, our officer app, and our other online services (together, the “Services”). It replaces our earlier privacy policy, which covered only our marketing website.

The short version:

• If you received a parking citation, bought parking or used a parker portal on an operator’s website, the parking operator controls your information and we process it for the operator. Please contact the operator first; if you contact us, we will forward your request.
• On our marketing website, lotably.com, and on the pages where you sign up for an account (together, our “marketing pages”), we use analytics and advertising cookies from Google and Meta to see how people find us and sign up, and to measure and improve our ads. Some US state laws call this “selling” or “sharing” personal information. If you visit from California or from outside the United States, we ask before using these cookies. Anyone can turn them off under “Your privacy choices” at the bottom of any marketing page (see Sections 7 and 9).
• Once you sign in, our apps use only cookies that are strictly necessary, and so do the parking operator websites we host. We never sell Driver Data or use it for advertising, and none of it goes to our analytics or advertising partners.
• We host the Services in the United States, and some of our service providers may process information in other countries (see Section 8).

1. Who we are and our two roles

1.1 What we do. Lotably provides parking-management software to parking operators, such as private lot and garage operators, property managers, homeowners’ associations, universities, hospitals and municipalities (“Operators”).

1.2 When we decide how information is used. We are responsible for, and decide how to use, personal information about:

• visitors to our websites, including the operator websites we host, for the device, log, error and rate-limiting information described in Section 2 (Website visitors), and visitors to our marketing pages for the analytics and advertising information described there and in Section 9;
• people who request a demo, register for our live demo or contact us;
• people who sign up for an Operator account (“applicants”), including the information they give during signup and email verification, their electronic signature records, and any property authorization letters they uploaded under earlier versions of signup;
• the people who hold and use Operators’ accounts, such as administrators, enforcement officers and other staff (“business users”), to the extent we use their information to run accounts, keep the Services secure, bill and communicate with Operators;
• Operators’ billing contacts; and
• people who report abuse or a security issue to us.

1.3 When we act for Operators. When an Operator uses the Services, it collects information about drivers, vehicle owners, parkers, residents, guests, permit holders and other members of the public (“Driver Data”), for example when its officers scan plates and issue citations, or when you pay, buy a pass, dispute a citation or use its parker portal. The Operator decides how Driver Data is used, and its own privacy notice applies. We process Driver Data on the Operator’s behalf, as its service provider or processor, under our contract with the Operator. We describe our practices for Driver Data in this policy for transparency, but the Operator is responsible for it. The same applies to the operational records an Operator keeps about its staff, such as the citations an officer issued, and about the people it lists to receive property reports.

1.4 Requests about Driver Data. If you are a driver or parker and want to access, correct or delete your information, or have a question or complaint about it, please contact the Operator named on your citation, receipt or the Operator’s website. If you contact us instead, we will forward your request to the Operator and tell you which Operator it is.

2. Information we collect

Website visitors

• Device and usage information: IP address, browser and device type, operating system, the pages and features you use, the referring page, and the date and time of your visit, which our hosting provider records in server logs.
• Error information: when something goes wrong, technical details such as the page, browser, error message and IP address, and a small sample of performance data. We have turned off session replay, so our error monitoring does not record your screen.
• Rate-limiting information: your IP address and a count of recent requests, used to stop abuse such as repeated sign-in attempts or citation-number guessing.
• Analytics and advertising information (marketing pages only): on lotably.com and on the signup pages at app.lotably.com (our “marketing pages”), and only as described in Section 9, cookie and advertising identifiers, your IP address and the approximate location it indicates, the pages you view, the links and buttons you click (for example, a “Start free” or phone link), the website, search engine, AI assistant or ad that referred you, whether you went on to send us a message or start a signup, and which signup steps you completed, with the plan and country you chose. For a message, this can include the number of lots and the answer you chose to “How did you hear about us?”, but we do not send your name, email address, phone number, business name, site address or message to analytics or advertising partners.
• Cookies and browser storage: see Section 9.

People who request a demo or contact us

Your name, work email, organization, role, phone number, the number of lots you manage, how you heard about us, your message and anything else you choose to tell us.

People who register for the live demo

• Registration: your name, work email address, your company if you give it, and whether you ticked the optional “Email me Lotably product news” box, which starts unticked.
• Email confirmation: a one-time code that we email you to confirm your address (stored only in hashed form), and the time you confirmed it.
• Technical information: the IP address and browser information of the device you register from.
• Your sandbox: once you confirm your email, we give you a private sample account (a “sandbox”) filled with invented sample data, and we keep whatever you add or change in it, such as plates, photos, tickets and settings, until the sandbox is deleted 24 hours after it is created. In a sandbox, nothing is emailed or texted to anyone: messages are shown in an on-screen outbox instead. No real payments are taken. The features you try use the same service providers as a real account (Section 6); for example, a plate photo you take is read by Plate Recognizer.

Applicants

• Account details: your name, email address, password (which we store only in hashed form), phone number if you give it, the business’s legal name and address, country, state or province, the lotably.com site address you choose, the plan you choose, and how you heard about us: your answer, if you give one, and any campaign details in the link that brought you to the signup page.
• Email verification: a one-time code (stored only in hashed form) and the time you verified your email.
• Setup answers: the features you choose, your locations and their addresses, rules, fines, passes, branding such as your logo and colors, ticket wording, any custom domain, and the contact details of your administrators.
• Property authorization letter (earlier signups only): signup no longer asks for a letter. If you signed up under an earlier version of signup, the letter you uploaded from a property owner or manager, which may include the names, titles, signatures and contact details of the people who wrote and received it.
• Electronic signature records: the full name and title you type, the date and time, your IP address and browser information, your verified email address, the exact text you accepted and its SHA-256 hash, your confirmation, by ticking a box, that your business has written authorization for every lot it will enforce with Lotably, and our countersignature.
• Technical information: the IP address and browser information of the device you used to submit your application.
• Setup assistant content: documents you provide, such as fee schedules and sample tickets, and the content of the website you point us to, which may contain personal information.
• Our reviews: if we review your account, before or after it goes live, our notes and decisions, and any additional information or documents we ask for.
• New account milestones: if you allowed analytics cookies when you signed up, the Google Analytics ID of the browser you signed up with, which we keep with the account. We use it to tell Google Analytics when the new account reaches certain milestones, such as going live, adding a payment method, connecting Stripe, adding its first lot, issuing its first ticket, taking its first online payment or changing its plan, together with the account’s plan. We do not send names, contact details, business or site names, plates or amounts, and these milestones are not used for advertising.

Business users

Your name, email address, phone number, role and permissions, sign-in credentials (passwords are stored only in hashed form), sign-in records, records of the actions you take in the Services (audit logs), your support messages, and information about your device and browser.

Billing contacts

Your name, email address, billing address, tax registration numbers, invoices and payment history, and limited details of the payment method on file, such as the card brand, last four digits and expiry date. Full payment details are held by Stripe, not by us. When an Operator connects its Stripe account, Stripe verifies the identity of the people responsible for that account, and we receive information about the account’s status rather than copies of identity documents.

Driver Data (processed for Operators)

Depending on the features an Operator uses, Driver Data can include:

• license plate numbers and the issuing state or province, and vehicle make, model and color;
• photos of vehicles, which may incidentally show people or surroundings, and officers’ notes;
• the location, date and time of an observation, and citation, warning, boot and tow records;
• payment records, such as the amount, date and Stripe payment reference, and limited details that Stripe provides about the payment, such as the payer’s name, email address, phone number, billing address or postal code, card brand, last four digits and expiry date (full card numbers are handled only by Stripe);
• pass, permit and monthly parking details, including names, email addresses, phone numbers, vehicles and units;
• resident guest passes, such as the guest’s plate and dates;
• dispute statements, evidence and contact details;
• email addresses and phone numbers given for receipts and notices;
• parker portal sign-in records, and the IP address and device information recorded with a payment, dispute or other submission on an Operator’s pages;
• USDOT numbers and the related carrier’s business information from the Federal Motor Carrier Safety Administration (FMCSA), for commercial vehicles; and
• information from parking-session providers that an Operator connects, such as whether a plate has a paid parking session.

3. Where we get information

• From you, when you use the Services, sign up for an account, register for our live demo, contact us or submit information on an Operator’s page.
• From your organization, for example when an Operator adds you as a business user or lists you to receive property reports.
• Automatically, from your device and browser when you use the Services.
• From service providers, such as Stripe (payment and account status) and our email and text-message providers (delivery status).
• From advertising and analytics partners, such as Google and Meta, which give us reports about how visitors use our marketing pages and how our ads perform, generally in aggregated form.
• From public sources, such as the business website you ask our setup assistant to read, and FMCSA carrier data.
• From Operators, for Driver Data.

4. How we use information

4.1 Information we control. We use the information we control to:

• provide, operate and maintain the Services, and create and manage accounts;
• verify email addresses, activate accounts, and review accounts, before or after they go live, to assess risk and decide whether to keep providing the Services, including by reviewing any property authorization letter uploaded under an earlier version of signup and any documents we ask for;
• form, record and prove agreements, using electronic signature records;
• bill and collect our fees and taxes, and keep accounting records;
• provide support and respond to inquiries and demo requests;
• provide the live demo, including confirming your email address, creating your sandbox and signing you in to it, deleting it after 24 hours, and limiting abuse, such as too many sandboxes for one email or IP address;
• follow up by email with people who register for the live demo about the demo and about using Lotably, and send Lotably product news only to those who ticked “Email me Lotably product news” (every marketing email has an unsubscribe link, and Section 5 explains the consent we rely on in Canada);
• send service messages, such as security alerts, account and billing notices and notices of changes to our terms;
• send business contacts information about Lotably’s products, where the law allows and with consent where it is required (you can opt out at any time);
• keep the Services secure and detect and prevent fraud, abuse, spam and enforcement without authority, including through rate limiting, logs and error monitoring;
• improve and develop the Services, using de-identified or aggregated information where practical;
• understand how visitors find and use our marketing pages and how new accounts get started, and measure and improve our advertising, including by showing our ads to people who have visited our marketing pages, as described in Sections 7 and 9;
• comply with legal obligations and respond to lawful requests;
• establish, exercise or defend legal claims, and enforce our agreements, Terms of Use and Acceptable Use Policy; and
• for any other purpose we describe when we collect the information, or with your consent.

4.2 Driver Data. We use Driver Data only to provide the Services to the Operator and as our contract with the Operator permits, such as to keep the Services secure, to improve them, and to create de-identified information. We do not use Driver Data for our own marketing, we do not sell it, and we do not use it for advertising. We do not use analytics or advertising cookies in our apps after you sign in or on the Operator websites we host.

4.3 AI and automated tools. Some features use service providers to process information automatically:

• Setup assistant: when we or an Operator use the setup assistant, the documents and website content provided are sent to OpenAI to draft the account’s settings, which a person then reviews.
• Dispute review: when an Operator’s staff ask for an AI review of a dispute, the citation evidence (including officers’ photos and notes), the driver’s statement, and related payment and permit records for that plate are sent to OpenAI to prepare a recommendation. A person at the Operator makes the decision.
• Plate reading: photos that officers take to read a plate are sent to Plate Recognizer, which returns the plate text.

We do not make decisions that have legal or similarly significant effects on individuals solely by automated means. Operators’ staff decide citations and disputes.

5. Consent (Canada)

If you are in Canada, we collect, use and disclose your personal information with your consent, or as the law permits or requires. Depending on how sensitive the information is and what you would reasonably expect, your consent may be express or implied. By giving us information, or by continuing to use the Services after being told about the purposes in this policy, you consent to those purposes, including the transfer of your information to service providers outside Canada described in Sections 6 and 8. You may withdraw your consent at any time on reasonable notice, subject to legal and contractual restrictions. If you do, we may not be able to provide some Services; for example, we cannot keep an account open without contact details, and we must keep certain records, such as signature and tax records, for the periods in Section 10. We will explain the consequences when you ask. For analytics and advertising cookies on our marketing pages, we ask for your express consent first, as described in Section 9. For Driver Data, the Operator is responsible for obtaining any consent required.

Live demo emails. If you are in Canada and register for our live demo, we email you about the demo and about using Lotably on the basis of your implied consent, which comes from your inquiry and lasts for 6 months after you register, as Canada’s Anti-Spam Legislation (CASL) allows. We send you product news only if you ticked “Email me Lotably product news”: that is your express consent, and it lasts until you withdraw it. Each of these emails identifies us and has an unsubscribe link, and we stop sending them within 10 business days after you unsubscribe.

6. How we disclose information

Service providers

We use the following service providers, which may use personal information only to provide their services to us:

• Vercel: hosting of our websites and applications, in the United States.
• Neon: database hosting, in the United States.
• Stripe: payment processing, identity verification of Operators’ connected Stripe accounts, and billing of our fees. For payments to an Operator, Stripe also provides payment services to the Operator under the Operator’s own agreement with Stripe, and uses payment information as described in its privacy policy.
• Resend: delivery of transactional email.
• Twilio: delivery of text messages, only where an Operator has enabled them.
• Sentry: error monitoring, with session replay turned off.
• Cloudinary: storage and delivery of images, such as logos and photos.
• OpenAI: AI features, namely the setup assistant and AI review of disputes.
• Plate Recognizer: reading license plates from photos.
• Upstash: rate limiting to protect the Services, which processes IP addresses.

We will update this list before we add or replace a service provider that processes personal information and, for service providers that process Operators’ data, at least 15 days before, as our agreements with Operators require.

Operators

We make Driver Data available to the Operator it belongs to. An Operator can see the activity of its own business users in its account. If you contact us about an Operator’s citation or charge, or report an Operator under our Acceptable Use Policy, we may share your message with that Operator.

Integrations an Operator chooses

If an Operator turns on an integration, we exchange the relevant information with that provider. For example, we exchange plate and session information with Parking BOXX or another parking-session provider to check whether a vehicle has paid, and we send a USDOT number to the FMCSA, a United States government agency, to look up carrier information. These providers are not our service providers, and their own privacy policies apply.

Advertising and analytics partners (marketing pages only)

On our marketing pages, and only as described in Section 9, we use Google Tag Manager, Google Analytics and Google Ads, provided by Google, and the Meta Pixel, provided by Meta Platforms. Through their cookies and similar technologies, these partners receive the analytics and advertising information described in Section 2. Google Analytics helps us understand how our marketing pages are used and, through the new account milestones described in Section 2, how new accounts get started. Google Ads and Meta use the information to measure our ads and to show our ads to people who have visited our marketing pages, and they may also use it for their own purposes, such as improving their advertising services, under their own privacy policies: Google’s and Meta’s. Some US state laws treat this as a “sale” or “sharing” of personal information, or as “targeted advertising”; Section 7 explains how to opt out. These partners do not receive information from our apps after you sign in, other than the new account milestones sent to Google Analytics, or from the Operator websites we host.

Legal requirements and safety

We may disclose information where we believe in good faith that it is required by law, a subpoena, a court order or another lawful request by a public authority, including to meet national security or law enforcement requirements; to protect the rights, safety or property of any person; to investigate fraud, enforcement without authority or breaches of our Acceptable Use Policy; or where Stripe or a card network requires it. Where we receive a legal demand for Driver Data, we will try to redirect it to the Operator and notify the Operator unless the law prohibits it.

Professional advisers

We may disclose information to our lawyers, accountants, auditors and insurers, who are bound by confidentiality obligations.

Business transfers

If we are involved in a merger, acquisition, financing, reorganization, sale of assets or insolvency, information may be disclosed to the other parties and their advisers and transferred as part of that transaction, subject to this policy or protections at least as strong.

With your consent, and de-identified information

We may disclose information with your consent or at your direction. We may also share de-identified or aggregated information that does not identify any person, property or Operator.

7. Selling, sharing and targeted advertising

We do not sell personal information for money. We do not sell or share Driver Data, or any information collected in our apps after you sign in or on the Operator websites we host, and we do not use it for targeted advertising.

On our marketing pages, our advertising partners Google and Meta receive identifiers, such as cookie and advertising IDs and IP addresses, and information about your activity on those pages, as described in Sections 6 and 9, so that we can measure our ads and show them to people who have visited them. Some US state laws, including California’s, may treat this as a “sale” of personal information, as “sharing” it for cross-context behavioral advertising, or as “targeted advertising”.

How to opt out. Select “Your privacy choices” at the bottom of any marketing page and turn off advertising cookies, or turn on Global Privacy Control in your browser. We treat a Global Privacy Control signal as a valid request to opt out of the sale and sharing of your personal information and of targeted advertising, and we keep advertising cookies off for that browser. Because these cookies do not tell us who you are, your choice applies to the browser and device you use; if you clear your cookies or use another browser or device, please make your choice again there. You can also contact our Privacy Officer (Section 14).

We do not knowingly sell or share the personal information of anyone under 16. We do not disclose personal information to third parties for their own direct marketing purposes. Where we keep de-identified information, we will keep it in de-identified form and will not attempt to re-identify it, and we require anyone we share it with to do the same.

8. International transfers

We are based in the United States, and the Services are hosted in the United States. Some of our service providers, and the advertising and analytics partners described in Section 6, may also process information in other countries where they or their own providers operate. If you are in Canada or elsewhere outside the United States, your information will be transferred to, stored in and processed in the United States and those other countries. While it is there, it is subject to the laws of those countries and may be accessible to their courts, law enforcement and national security authorities. We protect information that we transfer with contracts and the safeguards described in this policy. You can ask our Privacy Officer about our practices for service providers outside Canada using the details in Section 14.

9. Cookies and similar technologies

Our apps and the Operator websites we host

In our administration and officer apps, on app.lotably.com other than the signup pages, and on the Operator websites we host, we use only cookies that are strictly necessary for the Services to work:

• sign-in session cookie: keeps business users signed in to the administration and officer apps, together with related security cookies that the sign-in process uses, for example to protect against cross-site request forgery; and
• parker portal session cookie: keeps parkers signed in to an Operator’s parker portal.

The officer and administration apps also save a few preferences in your browser’s local storage, such as your printer paper size and printing method, the last lot you worked in and your display theme. During a patrol, the officer app keeps the plate being checked and its result in your browser’s session storage, and the setup assistant keeps its form and draft there, until the browser tab is closed. These stay on your device and are not used to track you.

We do not use analytics or advertising cookies there.

Our marketing pages: lotably.com and the signup pages

On lotably.com and on the signup pages at app.lotably.com we use three kinds of cookies and similar technologies:

• Strictly necessary, which are always on: on lotably.com, a cookie that records the country your visit comes from, and for the United States the state, worked out from your IP address, so that we know which privacy choices to show you, and which is deleted when you close your browser (lotably_region; the signup pages work out the same without a cookie); a cookie that remembers your privacy choices for 6 months, shared by lotably.com and the signup pages (lotably_consent); and, on the signup pages, a signup cookie that keeps your place while you complete a signup application and expires after 7 days.
• Analytics: Google Analytics cookies, such as _ga and _ga_ followed by an ID, which last up to 2 years and tell us how visitors use our marketing pages, such as which pages they view, how they arrived, including from search engines and AI assistants, which links they click and which signup steps they complete. These cookies are set for lotably.com and its subdomains, so the same visit can be followed from lotably.com to the signup pages; nothing reads them in our apps after sign-in or on the Operator websites we host.
• Advertising: cookies from Google Ads, such as _gcl_au, and from Meta, such as _fbp and _fbc, which last up to 90 days and let us measure whether our ads lead to messages and signups and show our ads to people who have visited our marketing pages. Google and Meta may also read cookies they set on their own websites, for example if you are signed in to them.

Your choices. If you visit from California, from outside the United States, or from somewhere we cannot determine, we do not load our analytics or advertising partners’ tools or use their cookies unless you accept them in the banner we show on your first visit, and rejecting them is as easy as accepting them. If you visit from elsewhere in the United States, analytics and advertising cookies are on by default and you can turn either kind off. Wherever you are, you can change your choices at any time by selecting “Your privacy choices” at the bottom of any marketing page; a choice made on lotably.com also applies to the signup pages, and the other way around. If your browser sends a Global Privacy Control signal, we keep advertising cookies off for that browser. You can also opt out of Google Analytics with Google’s browser add-on, and manage the ads you see from Google and Meta.

Everywhere

Our fonts are hosted by us, so your browser does not request them from third parties such as Google. You can block or delete cookies in your browser settings, but sign-in to our apps will not work without strictly necessary cookies.

10. How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy, unless the law requires or permits us to keep it longer. In particular:

• Signup applications that are not completed: deleted 90 days after the last activity on the application.
• Declined or withdrawn applications, including any property authorization letter uploaded under an earlier version of signup: kept for 12 months after our decision or your withdrawal, then deleted.
• Applications for accounts that go live, and property authorization letters uploaded under earlier versions of signup: kept for the life of the Operator’s agreement with us plus 7 years.
• Electronic signature records: for accounts that go live, kept for the life of the agreement plus 7 years; for declined or withdrawn applications, kept as for declined applications above.
• Account and business user information: kept while the account is active and for 7 years after the Operator’s agreement ends, then deleted.
• Billing and tax records: kept for 7 years after the transaction, or longer where tax law requires.
• Security and access logs, such as server and sign-in logs: kept for about 1 year. Audit logs of the actions taken in an Operator’s account are kept with the Operator’s account information and Driver Data.
• Error monitoring data: kept for up to 90 days.
• Website analytics data (marketing pages and new account milestones): Google Analytics keeps event data for 14 months; cookies last for the periods in Section 9. The Google Analytics ID kept with a new account is deleted with the account’s other records.
• Rate-limiting data: counters expire automatically, generally within minutes to hours.
• Demo requests and inquiries: kept for up to 2 years after our last contact with you, unless you become a customer.
• Live demo registrations: kept for 24 months after you register, or until you ask us to remove yours, if that is sooner.
• Demo sandboxes: deleted, with everything in them, 24 hours after they are created.
• Marketing opt-outs: kept for as long as needed to honor your choice.
• Driver Data: kept as the Operator instructs and as our agreement with the Operator provides. When an Operator’s agreement ends, we keep its Driver Data for 7 years, so that records stay available for later disputes, refunds, chargebacks and legal claims, and then delete it, unless the Operator directs us to delete it sooner, in which case we delete it within 90 days after the direction. Some of it is deleted sooner, as that agreement provides: parker portal accounts when the agreement ends, monthly parker details 90 days after, and caches and raw payment-event logs on their normal cycles.

Copies in backups are deleted on our normal backup cycle. We may keep information for longer where it is subject to a legal hold or needed to establish, exercise or defend legal claims.

11. Security

We use reasonable administrative, technical and physical safeguards to protect personal information, including encryption in transit, encryption at rest provided by our hosting and database providers, access controls that limit our staff’s access to those who need it, logging of administrative access to customer accounts, hashing of passwords and one-time codes, and single-use sign-in links that expire after a short time. Payment card details are handled by Stripe. Our staff and service providers are bound by confidentiality obligations. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you and the relevant regulators where the law requires; for Driver Data, we will notify the Operator so that it can notify you. Please keep your password and sign-in links private.

12. Children

The Services are not directed to children under 16, and we do not knowingly collect personal information from children under 16 for our own purposes. If you believe a child under 16 has given us personal information, please contact us and we will delete it or, for Driver Data, refer the request to the Operator. Driver Data about a vehicle that a young person drives is controlled by the Operator.

13. Your rights and choices

Everyone

You can update much of your account information in the Services, unsubscribe from our marketing emails using the link in each email, and contact us at any time with questions or requests.

Drivers and parkers

Please send requests about Driver Data to the Operator, as explained in Section 1.4. We will help the Operator respond.

People who register for the live demo

Product news is off unless you tick “Email me Lotably product news” when you register. You can stop our demo follow-up emails, or product news, at any time with the unsubscribe link in any of them, and you can ask us to remove your registration by emailing cody@lotably.com. Your sandbox is deleted after 24 hours in any case.

United States residents

Depending on the state where you live, such as California, Colorado, Connecticut, Virginia or another state with a comprehensive consumer privacy law, and subject to the exceptions in those laws and to whether they apply to us, you may have the right to:

• know what personal information we have collected about you, including the categories and specific pieces of information, its sources, the purposes for which we use it and the categories of people to whom we disclose it, and to get a copy of it in a portable format;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale or sharing of personal information and of targeted advertising, which apply only to visitors to our marketing pages (Section 7 explains how to opt out yourself, under “Your privacy choices” or with Global Privacy Control), and opt out of profiling that produces legal or similarly significant effects (we do not do this);
• limit the use of sensitive personal information (we use it only for purposes the law allows, such as using account log-in credentials to give you secure access, so we do not offer this choice); and
• not be discriminated against for exercising your rights.

To make a request, email cody@lotably.com. We will verify your request, usually by confirming that you control the email address in our records, and may ask for more information if needed. You may use an authorized agent, who must provide your written permission, and we may ask you to verify your identity directly. We will respond within 45 days, or within any extension the law allows, in which case we will tell you. If we decline your request, you may appeal by replying to our decision with “Appeal” in the subject line, and we will respond within the time the law requires. If your appeal is denied, you may contact your state attorney general.

California notice. In the past 12 months we have collected the following categories of personal information, from the sources described in Section 3, for the purposes described in Section 4, and have disclosed each of them for business purposes to the service providers and other recipients described in Section 6, such as the Operator whose account you use and our professional advisers:

• identifiers, such as name, email address, phone number, IP address and account name;
• customer records, such as name, address, phone number, signature and billing information;
• commercial information, such as plans, fees and transaction records;
• internet or other electronic network activity, such as log data and how you use the Services;
• professional information, such as your organization, title and role;
• images and documents you upload, such as logos and, for earlier signups, property authorization letters; and
• sensitive personal information, limited to account log-in credentials, which we use only to give you secure access.

We keep each category for the periods described in Section 10. For visitors to our marketing pages, we sell or share, as California law defines those terms, identifiers and internet or other electronic network activity with advertising partners such as Google and Meta, as described in Section 7, and you can opt out at any time. We do not sell or share any other category, or any information from our apps after you sign in or the Operator websites we host.

Canada residents

You may ask to access the personal information we hold about you and ask us to correct it, withdraw your consent as described in Section 5 (including your consent to analytics and advertising cookies on our marketing pages, under “Your privacy choices”), and ask about our use of service providers outside Canada. We will respond within 30 days, or within any extension the law allows, in which case we will tell you, and we will not charge you for a request. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or, where their laws apply, to the Office of the Information and Privacy Commissioner of Alberta or the Office of the Information and Privacy Commissioner for British Columbia. We encourage you to contact our Privacy Officer first so that we can try to resolve your concern.

Elsewhere

If you live elsewhere and have a question or request, please contact us and we will consider it in light of the laws that apply.

14. Contact our Privacy Officer

Privacy Officer, Intake Scout LLC d/b/a Lotably, 1142 Carney Street, Cincinnati, Ohio 45202. Email: cody@lotably.com. Phone: +1 (513) 348-3049.

15. Changes to this policy

We may update this policy from time to time. We will post the updated policy with a new version date and, if we make a material change, we will take reasonable steps to let you know, for example by email to account holders or by a prominent notice in the Services. The changes apply from the date we post them, or any later date we state.