LotFox Privacy Policy
This policy describes what LotFox collects about you, why, who handles it, and how to get it deleted. It is written to be read. Where a section references the Terms of Service, the Terms govern the contract; this policy governs the data.
1. The short version
- We collect your name, email address, and, if you give them, whether you are an agent and which brokerage you work with.
- We store a salted hash of your password, never the password.
- We record that you accepted the Terms, which version, and when.
- We log which functions of the Service are called and where the request came from, so we can secure the Service.
- We log anonymous usage events — what was searched and what came back, not who searched — so we can find where the Service fails.
- Photos and text you submit for analysis are sent to an AI provider to be processed and returned. We do not keep the photos, and we do not authorize the provider to train on them.
- We do not sell your information. We do not show advertising. We do not use tracking cookies.
- Email us to correct or delete your account.
2. What we collect and why
2.1 Account information you give us
At sign-up: first name, last name, email address, and a password. Optionally: whether you are a licensed agent, your brokerage, and an organization invite code.
Why: to create your account, sign you in, send you the emails described in section 4, and, if you tell us you are an agent, to understand who is using the Service. We may check a stated license against the Florida DBPR public lookup, as the Terms describe.
Your password is stored only as a salted cryptographic hash. We cannot read it and cannot recover it; if you forget it, the only path is a reset link sent to your email address.
2.2 Organization membership
Every account belongs to an organization. If you sign up without an invite code, we create an organization of one, named for you. If you sign up with an invite code, your account is attached to the organization that issued it, and that organization's administrator can see that you are a member.
2.3 Agreement records
When you accept the Terms of Service and this policy, we record the version you accepted and the date and time. If either document changes and you accept a new version, each acceptance is recorded separately. These records are how the contract between you and LotFox is proven, and they are kept for as long as that matters (section 7).
2.4 Sign-in and security records
- The date and time of your most recent sign-in, and of the email confirmation that activated your account.
- Failed sign-in attempts and link requests, counted per email address for a short window, so that repeated failures temporarily lock the address. These counts are used only for that purpose.
- One-time confirmation and reset links, stored as a hash of the link with an expiry of fifteen minutes and a record of when the link was used.
- A record of requests that reach the Service's functions from a web origin we do not recognise: the origin, which function was called, the first and last time it was seen, a count, and whether a session token was present. Ordinary requests from thelotfox.com are not recorded here; this exists to detect the Service being called from somewhere it should not be.
Why: to keep the Service secure, to detect and stop abuse, and to enforce the Terms.
2.5 Anonymous usage events
We log events describing how the Service is used: the address that was searched, whether it resolved to one parcel, several, or none; whether a flip flag was raised; and when. These events carry no account, session, or device identifier. They exist so we can find addresses the Service cannot match and reads it gets wrong, and fix them.
2.6 Content you submit for analysis
If you upload a photo or enter a list price, notes, or other text for the Service to analyze, that content is sent to our AI provider (section 5) to be processed, and the result is returned to you. We do not retain uploaded photos after the result is returned. Photos may show the interior or exterior of a property. Do not upload photos that identify a person without that person's consent.
2.7 Feedback
If you use the in-page feedback control, we keep what you send together with the address it concerns and your account, so we can follow up with you. If you email us, we keep the email.
2.8 What we do not collect
We do not collect payment information (the Service is currently free), government identification numbers, your real estate license number unless you choose to enter it, your location, or any data from your device beyond what a web browser ordinarily sends with a request.
3. Information stored in your browser
LotFox does not use cookies. It uses your browser's local storage to keep:
- your session token, which is what keeps you signed in for up to thirty days on that device; and
- the profile details shown on exports that carry your name — your name, brokerage, and license as held on your account, plus a phone number if you enter one. The phone number is stored only in your browser and is not sent to us.
Clearing your browser's site data removes both and signs you out on that device.
4. Emails we send
We send email to operate your account: a one-time link to confirm your address when you sign up, a one-time link when you ask to reset your password, and notices required by the Terms, such as a material change to the Terms or this policy. Those cannot be opted out of while you hold an account.
We may also send occasional product updates about the Service, such as new counties coming online. Every such email carries an opt-out link, and you can also opt out by emailing us. Opting out does not affect the notices above.
Emails are delivered by the provider named in section 5. Replies go to the address in section 10.
5. Who processes your information
LotFox runs on third-party infrastructure. Each provider below processes data only to provide its service to us, under its own terms and security commitments.
| Provider | What it does | What it handles |
|---|---|---|
| Netlify | Hosts the Service, runs its server functions, manages the domain and TLS certificate | All traffic to the Service, including the web request data any host sees (such as IP address) in its operational logs |
| Turso | The Service's database | Account information, organization membership, agreement records, security records, usage events, feedback |
| Anthropic | AI model provider for photo analysis and narrative reads | Photos and text you submit for analysis, and the property data sent alongside them to produce the read. We use the provider's commercial API, under which your content is not used to train its models. |
| Resend | Sends the emails in section 4 | Your email address and the content of those emails |
| Microsoft (Outlook) | Our support mailbox | Anything you email us |
Our source code is kept on GitHub. It contains no user data.
We do not share your information with anyone else, except: with your organization's administrator, as section 2.2 describes; when the law requires it, in which case we will tell you unless the law forbids it; or in connection with a merger, sale, or reorganization of LOTFOX LLC, in which case this policy continues to apply to the information transferred.
We do not sell personal information. We do not share it for advertising. We do not use third-party analytics or tracking scripts.
6. Property records and property owners
The Service works on public property records published by Florida counties and the Florida Department of Revenue. Those records are about parcels, not about you.
By design, LotFox does not load property owner names, owner mailing addresses, or any other personal identifying field those records contain. The Service shows what a parcel is, what it sold for, and what was built or permitted on it — not who owns it. If you are a property owner and believe a public record about your parcel is wrong, the county that published it is the place to correct it; we cannot change it.
7. How long we keep information
| Information | Kept until |
|---|---|
| Account information, organization membership | You close your account (section 8), plus up to 30 days in routine backups |
| Agreement records | 5 years after the account is closed, as the record of the contract |
| Sign-in and link-request counts | 24 hours |
| One-time link records | 7 days after expiry or use |
| Unrecognised-origin record | Indefinitely; it identifies no one |
| Anonymous usage events | Indefinitely; they identify no one |
| Photos submitted for analysis | Not retained after the result is returned |
| Feedback and support email | 2 years |
8. Your choices and rights
Correcting your information. Email us and we will correct your name, brokerage, or agent status.
Deleting your account. Email us from the address on the account and we will close it. We delete your account information and organization membership. We keep the agreement records described in section 7 as the record that a contract existed, and anonymous usage events, which cannot be tied to you. Copies in routine backups expire on the schedule above.
Seeing what we hold. Email us and we will send you the account information, organization membership, agreement records, and feedback we hold about you.
Withdrawing from an organization. Ask your organization's administrator, or email us.
We will respond to any of these within 30 days. We ask only that the request come from the email address on the account.
9. Security, breaches, children, and changes
Security. Passwords are stored as salted hashes. Every function that reaches the database verifies a signed session token before it runs. Credentials for our providers are held in the hosting environment, not in code. No system is perfectly secure, and we do not promise that ours is.
Breach notice. If a breach of security affects your personal information, we will notify you as the Florida Information Protection Act requires, at the email address on your account.
Children. The Service is for adults. We do not knowingly collect information from anyone under 18. If we learn we have, we will delete it.
Outside Florida. The Service is built for Florida real estate practice and its providers operate in the United States. If you use it from elsewhere, your information is processed in the United States.
Changes to this policy. We will post a new version with a new version string and effective date, and we will ask you to accept it on the agreement screen before you continue using the Service. That acceptance is recorded against your account. The version you accepted is the version that applies until you accept a later one.
10. Contact
LOTFOX LLC 619 32nd Avenue West Palmetto, Florida 34221 lotfoxtalk@outlook.com
For deletion, correction, or access requests, put "Privacy request" in the subject line.