PRIVACY POLICY

1. PERSONAL INFORMATION WE COLLECT

1.1 Account Information. The email address associated with your Account; records of sign-ins and sessions; and a record of your Sign-Up Acceptance, including its time, the versions of the Terms and this Privacy Policy that you accepted, and the IP address and browser used. We obtain this information from you and from our sign-in provider.

1.2 Invitations and Sign-In Requests. If we invite you, or you ask us for access, we retain your email address even if you never create an Account. If you request a sign-in code, we retain a record of that request, including the email address you provided, to protect sign-in from abuse.

1.3 Property and Analysis Information. Addresses and lots that you search for or select, joined lots, Reports that you request and options that you view.

1.4 Answers. Your answers to our questions about a property, such as existing homes, tenants, plans and goals, including any answer that you confirm after we read it from a document that you upload.

1.5 Uploaded Documents. Documents and images that you upload, such as permits, plans, rent rolls and title reports, and the information that we read from them. They may contain Personal Information about other persons.

1.6 Ask Information. The questions that you submit to Ask and the answers returned, including answers generated through our artificial intelligence providers.

1.7 Communications. Emails, consulting inquiries, help requests, problem reports, feedback (including any screenshot that you attach), survey responses and ratings.

1.8 Device, Usage and Log Information. Your IP address; browser, device and operating system information; Approximate Location; the pages that you visit, the address of the page from which you arrived and the campaign link that brought you to the Service; the organization associated with your IP address; your clicks, taps and scrolling, including the text and labels of the elements that you click; clicks that produce no response and repeated clicks; page performance; time on page and active time; and errors. Our servers collect part of this information automatically (Section 4.5), and the Analytics Provider collects the remainder after the consent described in Section 4.2, including through cookies and similar technology.

1.9 Property Records. Parcel, zoning, permit, assessor and ownership records, which may include the names of owners or applicants, obtained from governmental agencies, public records and data providers.

Information that we obtain from data providers, combine with public records or infer through the Service may constitute Personal Information, and we treat it as Personal Information where the law requires. Please do not upload government identification numbers, bank or card numbers or health information.

2. HOW WE USE PERSONAL INFORMATION

2.1 To provide the Service: to create and secure Accounts, run analyses, generate Reports, answer Ask questions, store the Reports that you request and apply usage limits.

2.2 To improve and develop the Service: to understand how the Service is used, correct errors, review and measure Report quality, and develop, train, test and evaluate Lotta's own software and artificial intelligence models using answers, uploaded documents, Ask information, Reports and usage information, to the extent the law permits. Where the law requires separate consent for a new use, we will obtain it first.

2.3 For analytics, as described in Section 4.

2.4 To communicate with you: sign-in codes, invitations, service and security notices, responses to your messages and, where permitted, news and offers.

2.5 To create aggregated or de-identified information, such as market and permitting trends, which we may use and disclose for any lawful purpose. We take reasonable measures to ensure that such information cannot be associated with a particular individual or household, maintain and use it only in that form, do not attempt to re-identify it except to test our methods, and contractually require each recipient to do the same.

2.6 For safety and legal purposes: to prevent fraud and abuse, enforce the Terms, comply with law, and protect the rights and safety of Lotta, our users and others.

2.7 In connection with any actual or proposed financing, investment, strategic partnership, joint venture, merger, acquisition, reorganization, bankruptcy or sale of all or any part of our business or assets, including data assets, and the due diligence for any of them.

2.8 Artificial Intelligence Providers. To answer questions and generate Reports, we transmit relevant portions of Personal Information to artificial intelligence model providers. Our agreements with those providers prohibit them from training their own models on that information.

2.9 Staff Access. Lotta personnel may access Account information and activity, including Reports, answers, uploaded documents, Ask questions and answers, usage records and Analytics Data, to support Account Holders, review quality, correct problems and prevent abuse.

3. HOW WE DISCLOSE PERSONAL INFORMATION

3.1 To service providers that operate the Service on our behalf under written contracts, in the following categories: cloud hosting and backup; sign-in and email delivery; artificial intelligence models; analytics (the Analytics Provider); identification of the organization associated with an IP address; email; and maps and property data (which receive the address or location analyzed). Certain of them, such as map providers, also process information under their own privacy policies.

3.2 To governmental map and records services, which receive the address or parcel that you search for so that we can locate it.

3.3 To providers of maps, fonts and code that your browser loads directly from them, as described in Section 4.6.

3.4 To professional advisors, such as attorneys, accountants, insurers and auditors.

3.5 To governmental authorities, where we believe in good faith that the law requires it, or to protect rights and safety.

3.6 To actual or prospective investors, lenders, partners, acquirers and successors, and their advisors, in connection with a transaction described in Section 2.7, under obligations of confidentiality. A person that acquires control of all or any part of our business or assets, including data assets, may use the Personal Information that it acquires only as this Privacy Policy describes, unless it provides any notice and obtains any consent that the law requires.

3.7 Aggregated or de-identified information, to any person, as described in Section 2.5.

3.8 To any other person at your direction.

Portions of the Service use Google Maps, and Google's Privacy Policy (https://policies.google.com/privacy) applies to that use. We do not sell Personal Information, and we do not share Personal Information for cross-context behavioral advertising.

4. COOKIES, ANALYTICS, LOCATION AND SESSION RECORDING

4.1 Necessary Cookies. We set the following cookies when the related features require them; the analytics choice does not enable or disable them: - a sign-in cookie, which keeps you signed in on the device for up to thirty (30) days or until you sign out; - a sign-in verification cookie, which ties a sign-in code to the browser that requested it and expires after ten (10) minutes; - an Ask cookie, which keeps an Ask conversation together for up to seven (7) days; and - a choice cookie, which records a Visitor's acceptance or refusal on the Cookie Banner and lasts for up to one (1) year.

4.2 ANALYTICS AND LOCATION CONSENT.

4.2.1 SCOPE. EACH ACCOUNT HOLDER, BY SIGN-UP ACCEPTANCE, AND EACH VISITOR, BY CLICKING "ACCEPT" ON THE COOKIE BANNER, EXPRESSLY CONSENTS TO THE FOLLOWING COLLECTION BY LOTTA AND THE ANALYTICS PROVIDER, FOR THE PURPOSES OF FINDING AND CORRECTING PROBLEMS WITH, IMPROVING AND MEASURING THE USE OF THE SERVICE, AND UNDERSTANDING WHICH ORGANIZATIONS USE IT:

(a) Analytics Data. A record of how the Service is used, consisting of: the pages visited; the address of the page from which the user arrived and the campaign parameters described in Section 4.4, subject to that Section; clicks, taps and scrolling, including the text, labels and page attributes of the elements clicked, which may include property addresses, answers displayed on the page and names drawn from public records, including the user's own name; clicks that produce no response and repeated clicks; heatmaps of clicks and scrolling; page performance; time on page and active time; errors; and device, browser and operating system information.

(b) Approximate Location. Lotta's server transmits the user's IP address to the Analytics Provider, which uses it to estimate the user's Approximate Location and is configured not to store the IP address with the Analytics Data.

(c) Persistent Identifier. The Analytics Provider stores an identifier in a cookie or in the browser's local storage, for up to one (1) year, to recognize the browser on later visits. For Account Holders, Analytics Data is linked to the Account through a code derived from the Account number, which allows Lotta to associate Analytics Data with the Account. If a Visitor who accepted the Cookie Banner later creates an Account on the same browser, Analytics Data collected before Sign-Up Acceptance is linked to the Account. The Analytics Provider does not receive the user's email address.

(d) Session Recording. Session Recording is not active as of the Effective Date of this Privacy Policy. Lotta intends to activate it, after completing security testing, for Account Holders and for Visitors who accept the Cookie Banner. Lotta will notify Account Holders by email or in the Service before it begins, and the Cookie Banner will describe Session Recording before it applies to Visitors. When active, Session Recording will record and replay a user's use of the Service, including what appears on the screen and its text, and mouse movements, clicks, taps and scrolling, subject to Section 4.4. Session Recording will not operate on the sign-in and sign-up screens, and recordings will be retained for up to five (5) years.

(e) Organization Lookup. A service provider acting on Lotta's behalf may use the IP address to identify the organization, such as a company, associated with the network from which the Service is accessed. Lotta uses this lookup to understand which organizations use the Service and does not use it to identify individuals.

4.2.2 Recipient. The Analytics Provider receives this information as Lotta's service provider under a written contract.

4.2.3 Timing. No code of the Analytics Provider loads, and no information is transmitted to the Analytics Provider, before the applicable consent: Sign-Up Acceptance for an Account Holder, and acceptance of the Cookie Banner for a Visitor. Analytics does not operate on the sign-in and sign-up screens.

4.2.4 Condition; Refusal; Withdrawal. For an Account Holder, this consent is a condition of holding an Account, except where applicable law requires otherwise, and may be withdrawn only by closing the Account under Section 9.3. A Visitor may decline on the Cookie Banner. Declining is offered on equal terms with accepting, and the Service functions the same either way. A Visitor may change that choice at any time through the link at the bottom of each page.

4.2.5 Effect; Record; Changes. This consent takes effect upon Sign-Up Acceptance or acceptance of the Cookie Banner, as applicable. Lotta keeps a record of the versions of the Terms and this Privacy Policy that each Account Holder accepted. The activation of Session Recording described in Section 4.2.1(d) is within the scope of this consent and requires only the advance notice described there. Any other material change to this Section 4.2 will be presented to Account Holders for acceptance under Section 10.

4.3 Cookie Banner. The Cookie Banner is presented only to Visitors. An Account Holder's consent to analytics, including Approximate Location, is given by Sign-Up Acceptance and applies whenever the Account Holder is signed in.

4.4 Excluded Data. Before any information is transmitted to the Analytics Provider, Lotta removes the following in the user's browser, for the reasons stated: - values captured directly from form fields, including sign-in codes, and any password, payment information or other secret wherever it appears (reason: security); - report numbers, email addresses and any query string or fragment in page addresses and links, other than standard campaign parameters (such as utm_source, utm_medium, utm_campaign, utm_term and utm_content) and referral codes, which are recorded, and email addresses displayed anywhere on the page, including the Account email address (reason: security, because they can function as keys to private pages or to sign-in); - the contents and file names of uploaded documents, and rows copied from them onto the page, such as rent roll rows (reason: security, because they may contain other persons' private information); - money figures and Lotta's assumption values, wherever displayed (reason: some derive from licensed data that Lotta may not redistribute); and - the words of Ask questions and answers, wherever displayed (reason: they are private conversations).

The Analytics Provider may record that an excluded element was clicked or used, without its content. Addresses and answers displayed elsewhere on the page are not Excluded Data and may be recorded as described in Section 4.2.1(a), and an answer that you confirm after we read it from a document is treated as an answer under Section 1.4. The exclusion of Excluded Data from Analytics Data and Session Recording does not limit Lotta's processing of the same information to provide the Service under Section 2.

4.5 Server Logs and First-Party Measurement. Lotta's servers record each request, including the IP address, browser details, the page or feature requested, the address of the referring page, campaign parameters, the time and the result, and record errors. Lotta uses these records for every user, including Visitors who decline the Cookie Banner, to operate, secure, measure and improve the Service, including by counting visits and their sources and by estimating Approximate Location on Lotta's own systems. This measurement does not involve the Analytics Provider.

4.6 Content from Other Providers. Certain pages load maps, fonts or code directly from other providers, such as Google Maps. To do so, your browser connects to those providers when the page opens, regardless of any choice on the Cookie Banner, and they receive your IP address, browser details and the address of the page requesting their content. They process that information under their own privacy policies and may be able to recognize your browser on other websites that use them. Apart from those providers, we do not permit other companies, such as advertising networks, to collect information about your online activities over time and across different websites through the Service.

4.7 Do Not Track and Global Privacy Control. Lotta does not respond to Do Not Track or Global Privacy Control browser signals. For Visitors, the Analytics Provider and the organization lookup described in Section 4.2.1(e) operate only upon acceptance of the Cookie Banner.

5. RETENTION

We retain each category of Personal Information for as long as reasonably necessary for the purposes described in this Privacy Policy, or as the law requires or permits, according to the criteria below, and we review these criteria at least annually. Closing an Account does not, of itself, delete uploaded documents, Reports or other information.

- Account information and acceptance records: while the Account remains open and, after closing, for as long as needed for security, for records of acceptance and usage, and for legal claims. - Invitations, access requests and sign-in requests of persons without an Account: for as long as needed to send the invitation, respond to the request and protect sign-in from abuse. - Analyses, answers, uploaded documents, Ask information and Reports: for as long as needed to store the Reports that you request, review quality, reproduce results, and develop, train and test Lotta's own software and models, and for legal and security purposes. If you remove an uploaded document, information that a Report already uses remains in that Report. - Analytics Data: the Analytics Provider retains events for up to five (5) years. Copies and counts that Lotta keeps for its own review are retained for as long as needed to find and correct problems and to measure changes to the Service. - Session recordings, once activated: up to five (5) years. - Server logs and error records: for as long as needed to operate, secure and correct the Service. - Communications: for as long as needed to resolve the request, conduct any resulting engagement and act on feedback. - Records of privacy requests: for as long as needed to demonstrate what was requested and what we did, and for legal claims. - Property records: for the life of the relevant property-data product, its update cycle and our rights from the source. - Backups: each backup is deleted twelve (12) months after it is made.

When no purpose remains, we delete or de-identify the information. De-identified and aggregated information is not Personal Information, and we may retain and use it as described in Section 2.5.

6. SECURITY

We maintain reasonable safeguards, and uploaded documents are stored encrypted. No system is completely secure. If a breach affects your Personal Information, we will provide the notices that the law requires.

7. CHILDREN

The Service is intended for adults eighteen (18) years of age and older and is not directed to children. We do not knowingly collect Personal Information from any person under eighteen (18) years of age, including any child under thirteen (13). If we learn that we have done so, we will take steps to delete it. If you believe that a child has provided Personal Information to us, please contact us at hello@lotta.land.

8. LOCATION OF PROCESSING

Lotta is based in California and processes Personal Information in the United States. Certain service providers may process it elsewhere.

9. YOUR CHOICES AND RIGHTS

9.1 Email Address. To change the email address associated with your Account, email hello@lotta.land from that address.

9.2 Marketing Email. You may opt out of marketing email through the unsubscribe link in any marketing email. Service and security messages will continue.

9.3 Closing Your Account. To close your Account, email hello@lotta.land from the email address associated with it. We will close the Account and cease collecting new activity from it, and we will retain information as Section 5 describes. Closing your Account does not terminate the license that you granted in Section 6.2 of the Terms.

9.4 Privacy Rights. We retain and use Personal Information as this Privacy Policy describes and as the law allows. Depending on where you live and whether a particular law applies to us, you may have rights, such as to know what Personal Information we collect and how we use and disclose it, to obtain a copy, to correct it or to have it deleted. If a law grants you such a right, you may exercise it by emailing hello@lotta.land with the subject "Privacy Request." You do not need an Account to do so; if you have one, please write from its email address. We verify each request in a manner appropriate to it, accept requests from authorized agents with your permission, respond within the time the law requires, and explain any denial and any available appeal where the law so provides. If we delete information under such a right, we will nevertheless retain the record of your Sign-Up Acceptance and of the request, de-identified copies, and backups until they expire under Section 5, and we will not retrain artificial intelligence models that we have already trained unless the law requires it. We do not sell Personal Information, do not share it for cross-context behavioral advertising, and do not use it for automated decisions that produce legal or similarly significant effects. We will not discriminate against you for exercising any right.

10. CHANGES TO THIS PRIVACY POLICY

We may amend this Privacy Policy and will post each amended version with its effective date. For a material change, we will notify Account Holders by email or in the Service before the change takes effect, and a material change to Section 4.2, other than the activation of Session Recording described in Section 4.2.5, will be presented to Account Holders for acceptance by checking a box or clicking a button. No amendment by itself permits us to use information that we already hold in a new manner that requires consent; where the law requires consent, we will obtain it first.

Where an organization has entered into a Separate Agreement with Lotta, as defined in Section 14.9 of the Terms, that agreement controls the handling of the information that it identifies to the extent of an express conflict with this Privacy Policy.

11. CONTACT

HOADU LLC, doing business as Lotta & Co., 231 Market Pl., Suite 601, San Ramon, CA 94583; hello@lotta.land.