Landlord Subscriber Agreement.

Effective on the date Subscriber accepts this Agreement.

IMPORTANT — READ CAREFULLY. This Landlord Subscriber Agreement (this "Agreement") is a binding legal contract between Lotly Software LLC, a Nevada limited liability company that operates RentalApplication.ai ("Lotly," "we," "us," or "our"), and you, the individual or entity identified on the signature page or accepting this Agreement electronically through the RentalApplication.ai onboarding flow ("Subscriber," "Landlord," "you," or "your"). By clicking "I Agree," signing electronically, or accessing or using the Services, you represent that you have read, understood, and agree to be bound by this Agreement and that you have authority to bind the entity, if any, on whose behalf you act.

THIS AGREEMENT INVOLVES FEDERALLY REGULATED CONSUMER REPORTING DATA. The Services include consumer reports regulated by the federal Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (the "FCRA"), and analogous state laws. Misuse of consumer reports may result in civil penalties, statutory damages, attorneys' fees, and criminal liability under 18 U.S.C. § 1681q.

Background

A. Lotly operates the RentalApplication.ai platform (the "Platform"), which provides landlords, property owners, property managers, and authorized agents with access to tenant screening services, including consumer credit reports, criminal-history reports, housing-records reports, SSN trace (on tiers that include TLO data), income and employment verification reports, document authentication on tiers that include it (performed by Pinwheel CRA Co. and furnished to Lotly as consumer-report content), AI-assisted prior-landlord reference verification, and related ancillary services (collectively, the "Services"). For the avoidance of doubt, the Services do not currently include driver's license verification, selfie-to-ID matching, or facial-recognition technology. Document authentication, where included, is performed by Pinwheel CRA Co. on the submitted document itself; it does not match a face, does not compare the document against a selfie, and derives no biometric identifier from any person.

B. Lotly procures consumer report data from third-party consumer reporting agencies and authorized data providers, including TransUnion LLC, One Source Technology, LLC d/b/a Asurint, and Pinwheel CRA Co. (a consumer reporting agency affiliate of Underdog Technologies, Inc. d/b/a Pinwheel) (collectively, the "CRAs"), pursuant to written reseller and service agreements that require Lotly to impose specific obligations on its customers. This Agreement implements those flow-down obligations. Separately, Lotly engages a Reference-Call Service Provider (currently Vosy) that supplies telephony and AI conversational technology used to place AI-assisted reference calls on the Subscriber's behalf; the Reference-Call Service Provider is not a CRA and the resulting reference-call output is not a Consumer Report furnished by Lotly.

C. Subscriber desires to access the Services solely to evaluate prospective tenants for residential rental housing in compliance with the FCRA and all other applicable laws.

NOW, THEREFORE, in consideration of the mutual promises set forth in this Agreement, the parties agree as follows:

1. Definitions

"Adverse Action" has the meaning given in FCRA § 603(k), and includes any denial, increase in deposit or fees, requirement of a co-signer, or other action that adversely affects an Applicant's ability to lease residential real property.

"Applicant" means a natural person who applies, or whose information is submitted, for tenancy of residential real property and who is the subject of a Consumer Report procured through the Services.

"Authorization" means the written or electronic authorization signed by an Applicant under FCRA § 604(b)(2) and applicable state law, permitting the procurement of a Consumer Report concerning that Applicant.

"Consumer Report" has the meaning given in FCRA § 603(d) and, for purposes of this Agreement, includes any credit report, credit score, criminal-history report, housing-records report, identity-verification result, income or employment verification report, and document-authentication result furnished by a CRA through the Services. For clarity, the reference-call output produced through the AI Reference-Call Tool described in Terms §8 (recording, transcript, and AI-generated summary) is not a Consumer Report furnished by Lotly — it is data the Subscriber collects, with the Applicant's consent, using a tool Lotly and the Reference-Call Service Provider make available.

"Investigative Consumer Report" has the meaning given in FCRA § 603(e), 15 U.S.C. § 1681a(e), and California Civil Code § 1786.2. Subscriber acknowledges that the AI Reference-Call Tool described in Terms §8 is not furnished by Lotly as an Investigative Consumer Report (Lotly does not act as a consumer reporting agency in providing that tool); however, if Subscriber engages a separate human-conducted reference-verification service that constitutes an Investigative Consumer Report under federal or state law, the requirements of Section 4.5 apply.

"FCRA Required Notices" means, collectively, (i) the Consumer Financial Protection Bureau's "A Summary of Your Rights Under the Fair Credit Reporting Act," (ii) the "Notice to Users of Consumer Reports: Obligations of Users Under the FCRA," (iii) the "Remedying the Effects of Identity Theft" pamphlet, and (iv) any other notice required by the FCRA, FACTA, or state law to be furnished to an Applicant or End User.

"Permissible Purpose" means tenant screening in connection with the review of a prospective tenant's eligibility to rent residential real property, as authorized by FCRA § 604(a)(3)(F), and excludes any other purpose.

"Personnel" means Subscriber's employees, agents, contractors, leasing professionals, and other authorized representatives who access or use the Services on Subscriber's behalf.

"Property" means each residential real property owned, managed, or leased by Subscriber for which Subscriber procures Consumer Reports through the Services.

"Score" means any credit, risk, or ranking score, including any FICO Score, TransUnion-developed score, or third-party score furnished as part of a Consumer Report.

"Security Incident" means any actual, suspected, or threatened (i) loss, theft, unauthorized acquisition, unauthorized access, unauthorized use, or unauthorized disclosure of any Consumer Report or related Applicant data, or (ii) compromise of the confidentiality, integrity, or availability of systems used by Subscriber to receive, store, transmit, or process Consumer Reports.

2. Grant of Access; Permitted Use

2.1 Limited License

Subject to Subscriber's continuing compliance with this Agreement, Lotly grants Subscriber a limited, non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Services solely for the Permissible Purpose, solely with respect to Properties owned or managed by Subscriber, and solely through the credentialed account established for Subscriber on the Platform.

2.2 Account Credentialing

Before access is granted, Subscriber shall complete Lotly's credentialing process, which may include verification of business documentation, ownership of or management authority over the relevant Property, government-issued identification, physical-location verification, professional licensing review, secretary of state registration review, and review of third-party business listings. Subscriber agrees to provide accurate, complete, and current information and to update it promptly. Lotly may, at any time and in its discretion, require re-credentialing, request additional documentation, suspend access pending verification, or terminate the account if credentialing cannot be completed to Lotly's satisfaction or if a CRA so directs.

2.3 Permitted Users

Subscriber shall designate at least one primary administrator and shall ensure that only authorized Personnel access the Services. Subscriber is fully responsible for the acts and omissions of all Personnel and for any access or use of the Services under Subscriber's account, whether or not authorized. Subscriber shall not share login credentials, permit anonymous access, or grant access to any person located outside the United States without Lotly's prior written consent.

2.4 Geographic Restrictions; Excluded Jurisdictions

Excluded Jurisdictions. Lotly does not currently offer the Services in, and Subscriber may not use the Services in connection with, any Property located in the States of Vermont, Massachusetts, or New York (collectively, the "Excluded Jurisdictions"). Subscriber represents and warrants that Subscriber will not (a) sign up for the Services with respect to any Property located in an Excluded Jurisdiction, (b) submit, process, or attempt to submit or process any rental application, screening request, or Consumer Report for any Property located in an Excluded Jurisdiction through the Services, or (c) use the Services to evaluate any Applicant in connection with any Property located in an Excluded Jurisdiction. Lotly may, in its sole discretion and without prior notice, block, reject, suspend, or terminate any account, registration, or transaction that violates or appears to violate this Section 2.4.

Capped-Fee Jurisdictions. In the jurisdictions listed below (collectively, the "Capped-Fee Jurisdictions"), the total per-applicant fee charged to an Applicant for a screening or rental application processed through the Services—whether under a packaged plan, an à la carte selection, or any combination thereof—may not exceed the maximum amount set forth opposite that jurisdiction:

• State of Wisconsin: Twenty-Five Dollars ($25.00) per Applicant.
• State of Virginia: Fifty Dollars ($50.00) per Applicant.
• City of Philadelphia, Pennsylvania: Fifty Dollars ($50.00) per Applicant.
• District of Columbia: Fifty Dollars ($50.00) per Applicant.

Subscriber acknowledges and agrees that the Platform will automatically prevent selection of any plan, à la carte combination, or other configuration that would result in a per-applicant fee exceeding the applicable maximum for a Property located in a Capped-Fee Jurisdiction, and Subscriber shall not attempt to circumvent that limitation. The cap applies to the aggregate per-applicant charge regardless of how it is described, itemized, or labeled (for example, as an "application fee," "screening fee," "background check fee," or "administrative fee").

Onboarding Notice. When Subscriber signs up for the Services with respect to a Property located in a Capped-Fee Jurisdiction, the Platform will display a notice during onboarding identifying the applicable jurisdiction, the underlying state or local law, and the resulting plan and pricing restrictions. Subscriber shall review and acknowledge this notice before completing onboarding for the affected Property.

Reason for Restrictions. The Excluded Jurisdictions and Capped-Fee Jurisdictions are designated based on state and local laws governing rental application and tenant-screening fees, including without limitation 9 V.S.A. § 4456a (Vermont), Massachusetts General Laws c. 186 § 15B and related case law, New York Real Property Law § 238-a, Wisconsin Statutes § 704.17 and Wisconsin Administrative Code ATCP 134.05, Virginia Code § 55.1-1203, Philadelphia Bill No. 250045 (2025), and District of Columbia Code § 42-3502.

Subscriber's Independent Compliance Obligation. The Excluded Jurisdictions and Capped-Fee Jurisdictions identified in this Section 2.4 reflect Lotly's good-faith assessment of certain state and local rental-application-fee laws as of the Effective Date. Subscriber acknowledges and agrees that: (a) federal, state, county, and municipal laws governing rental applications, tenant screening, application fees, screening fees, fair-chance housing, source-of-income discrimination, housing-records reporting, fair housing, and related matters are extensive, vary by jurisdiction, and change frequently; (b) Lotly's designation of Excluded Jurisdictions and Capped-Fee Jurisdictions is not a comprehensive legal opinion and does not constitute legal advice; (c) the absence of a jurisdiction from the Excluded Jurisdictions or Capped-Fee Jurisdictions list does not mean that there are no applicable laws governing Subscriber's use of the Services in that jurisdiction; (d) Subscriber is solely and independently responsible for identifying, investigating, monitoring, and complying with all federal, state, county, and municipal laws applicable to Subscriber's use of the Services, the rental of Subscriber's Properties, and Subscriber's evaluation of Applicants, including without limitation any laws not specifically referenced in this Agreement; (e) Subscriber should consult with qualified legal counsel of Subscriber's own choosing regarding compliance obligations applicable to Subscriber's business; and (f) Subscriber's reliance on Lotly's Excluded Jurisdictions or Capped-Fee Jurisdictions designations does not relieve Subscriber of, or transfer to Lotly, any compliance obligation imposed on Subscriber by applicable law.

Updates to Restrictions. Lotly may, in its sole discretion and from time to time, add, remove, or modify the list of Excluded Jurisdictions and Capped-Fee Jurisdictions, including in response to changes in applicable law, the addition of new jurisdictions to the list, or business considerations. The current list will be maintained on the Platform and posted at the URL designated by Lotly. Continued use of the Services after the effective date of any such update constitutes acceptance of the updated restrictions.

Property Location Determines Applicability. For purposes of this Section 2.4, the location of the Property determines whether an Excluded Jurisdiction or Capped-Fee Jurisdiction restriction applies, regardless of the location of Subscriber, Applicant, or any other party. Subscriber is solely responsible for accurately identifying the location of each Property in the Platform and shall not enter false, incomplete, or misleading Property location information.

3. Subscriber Certifications and Representations

Subscriber makes each of the following certifications and representations as of the Effective Date and again each time Subscriber requests a Consumer Report through the Services. These certifications are material; any breach is grounds for immediate suspension or termination.

3.1 Permissible Purpose

Subscriber will request and use Consumer Reports only for the Permissible Purpose and for no other purpose. Subscriber will not procure a Consumer Report for any employment, credit-extension (other than tenancy), insurance, marketing, prescreening, debt-collection, locate, skip-trace, surveillance, investigative, litigation-support, or other non-tenancy purpose, and will not procure a Consumer Report for use in evaluating any person who is not a bona fide Applicant for tenancy at a Property.

3.2 Per-Transaction Certification

Subscriber acknowledges that each request for a Consumer Report constitutes a separate certification under FCRA § 604 that (a) the Permissible Purpose stated is true and accurate, (b) the Consumer Report will be used only for that Permissible Purpose, (c) Subscriber has obtained a valid Authorization from the Applicant, and (d) the Consumer Report will be used one time only. Subscriber will record the per-transaction certification through the Platform and shall retain proof of the Authorization for not less than five (5) years. For its part, Lotly will record each per-transaction certification in an append-only audit log capturing at minimum the timestamp, the Applicant's identity, the Property, the stated Permissible Purpose, and the identity of the Subscriber user submitting the certification, and will retain such records for not less than five (5) years and make them available for audit by the CRAs, the Consumer Financial Protection Bureau, the Federal Trade Commission, and other authorized state and federal authorities.

3.3 No Resale, Redisclosure, or Database Use

Subscriber shall not sell, resell, sublicense, transfer, or otherwise redisclose any Consumer Report or any data derived from a Consumer Report to any third party, except: (a) to the Applicant who is the subject of the report, solely as required by FCRA §§ 609, 611, and 613; (b) to Subscriber's Personnel with a documented need to know for the Permissible Purpose; or (c) as required by valid legal process, in which case Subscriber shall (where lawful) provide Lotly with prior written notice. Subscriber shall not use any Consumer Report or any portion thereof to create, augment, train, validate, or maintain any database, model, score, statistical compilation, machine-learning model, or other compilation of consumer information for any purpose.

3.4 No Direct-to-Consumer Activity

Subscriber shall not sell, offer, or furnish any Service or Consumer Report directly to consumers. Subscriber shall not disclose any Score to any third party, except as expressly required by law or as expressly authorized in advance and in writing by Lotly. This restriction does not apply to disclosure to the Applicant who is the subject of the Score where that disclosure is required by FCRA section 1681m(a)(2)(B) in an adverse-action notice, or by any state law entitling the Applicant to a copy of the Score or of the Consumer Report.

3.5 No Commingling

Subscriber shall not merge, commingle, or combine criminal-history or housing-records information furnished through the Services with criminal-history or housing-records information obtained from any other consumer reporting agency or third-party data source, and shall not use any other source to modify, supplement, or override the criminal-history or housing-records information furnished through the Services.

3.6 No Reverse Engineering or Model Use

Subscriber shall not reverse engineer, decompile, disassemble, or attempt to derive the source, formula, weights, or methodology of any Score or model. Subscriber shall not use any Consumer Report or Score for model development, model validation, model calibration, benchmarking, or research, and shall not publicly disseminate any validation results, comparisons, or analyses derived from Consumer Reports or Scores.

3.7 Truthful Identification

Subscriber will identify itself accurately and completely each time it requests a Consumer Report and will not use false pretenses, false statements, or another person's credentials to obtain a Consumer Report.

4. Applicant Disclosure and Authorization

4.1 Standalone Disclosure

Before requesting a Consumer Report on an Applicant, Subscriber shall ensure that the Applicant receives a clear and conspicuous written disclosure, in a document that consists solely of the disclosure (other than as permitted by FCRA case law), stating that a Consumer Report may be obtained for tenant-screening purposes. Subscriber shall not embed the disclosure in a rental application, lease, liability waiver, or other document.

4.2 Written Authorization

Subscriber shall obtain the Applicant's written or electronic Authorization before requesting any Consumer Report. Electronic Authorizations must comply with the federal Electronic Signatures in Global and National Commerce Act (E-SIGN), the Uniform Electronic Transactions Act (UETA), and any applicable state-law equivalents.

4.3 Required Notices

Subscriber shall furnish each Applicant with the FCRA Required Notices when and as required by law. Subscriber acknowledges receipt from Lotly of current copies of (a) the "Notice to Users of Consumer Reports: Obligations of Users Under the FCRA," (b) "A Summary of Your Rights Under the Fair Credit Reporting Act," and (c) "Remedying the Effects of Identity Theft," and agrees to deliver these to Applicants where required.

4.4 State-Specific Disclosures

Subscriber shall comply with all state and local consumer-reporting laws applicable to each Applicant and Property, including without limitation the California Investigative Consumer Reporting Agencies Act (Cal. Civ. Code §§ 1786 et seq.), the California Consumer Credit Reporting Agencies Act (Cal. Civ. Code §§ 1785.1 et seq.), New York General Business Law § 380, and analogous statutes in Massachusetts, Minnesota, New Jersey, Oklahoma, Vermont, Washington, and other jurisdictions. Subscriber is solely responsible for identifying and complying with applicable state-specific disclosure, authorization, and adverse-action requirements.

4.5 Reference Calls; Investigative Consumer Reports

AI Reference-Call Tool. The AI Reference-Call Tool described in Terms §8 is provided by Lotly with telephony and AI conversational technology supplied by a Reference-Call Service Provider (currently Vosy). It is a tool the Subscriber uses to place reference calls; the resulting recording, transcript, and AI-generated summary are not a Consumer Report or Investigative Consumer Report furnished by Lotly, and neither Lotly nor the Reference-Call Service Provider acts as a consumer reporting agency in providing this tool. The Subscriber's use of the AI Reference-Call Tool is governed by the Subscriber's own due-diligence and reference-collection responsibilities, including (a) obtaining the Applicant's prior consent to contact references and to record the call, (b) complying with applicable two-party / all-party call-recording laws (federal Wiretap Act, California Invasion of Privacy Act, Illinois Eavesdropping Statute, and analogous laws), and (c) any state-specific disclosure or copy-of-information requirements that apply to the Subscriber's own collection of reference information.

Other Investigative Consumer Reports. If Subscriber separately procures a human-conducted reference-verification service or any other report that constitutes an Investigative Consumer Report under federal or state law (whether through Lotly or otherwise), Subscriber shall: (a) deliver to the Applicant a written disclosure, not later than three (3) days after the date the report is first requested, stating that an Investigative Consumer Report is being or may be obtained and informing the Applicant of the right to request additional information about the nature and scope of the investigation; (b) upon any written request from the Applicant for the nature and scope of the investigation, deliver a complete and accurate written disclosure within five (5) days of the request or the date the report was first requested, whichever is later; (c) for Applicants in California, comply with all additional requirements of California Civil Code § 1786.16, including without limitation (i) providing the name, address, telephone number, and website of the investigative consumer reporting agency, (ii) providing a summary of the provisions of California Civil Code § 1786.22, and (iii) providing the Applicant with a check-the-box opportunity to receive a copy of the Investigative Consumer Report at no charge, and furnishing such copy when requested; and (d) comply with the analogous Investigative Consumer Report disclosure requirements of any other state with jurisdiction over the Applicant or the Property. Subscriber shall not use any Investigative Consumer Report to make a tenancy decision based on information that the Applicant did not have a reasonable opportunity to dispute.

5. Adverse Action Procedures

5.0 Roles; Lotly as Service-Provider for Notice Generation and Delivery

The parties acknowledge and agree that Subscriber, not Lotly, is the "user" of the Consumer Report within the meaning of FCRA § 615(a) and is at all times the decision-maker with respect to any Adverse Action. As a matter of operational convenience, Lotly will generate and deliver Adverse Action notices to Applicants on Subscriber's behalf using (a) the Consumer Report data furnished through the Services and (b) the decisioning factors Subscriber selects, indicates, or confirms through the Platform. Lotly acts as a service provider for notice generation and delivery only; Subscriber remains solely responsible for the tenancy decision itself, for confirming that each notice accurately reflects Subscriber's decisioning factors before it is dispatched to the Applicant when the Platform gives Subscriber that opportunity, and for any state-specific or fair-chance requirements that layer on top of federal FCRA § 615(a). Lotly, for its part, is responsible for the technical content and delivery of the notice consistent with the templates and procedures Lotly maintains, and each party bears responsibility for its own respective statutory obligations. Nothing in this Section 5.0 is intended to shift, waive, or reallocate any statutory duty imposed directly on either party by applicable law.

5.1 Adverse Action Notice

If Subscriber takes Adverse Action against an Applicant based, in whole or in part, on information contained in a Consumer Report, Subscriber shall, when or promptly after taking the Adverse Action, cause the Applicant to receive a written Adverse Action notice that complies with FCRA § 615 (15 U.S.C. § 1681m) and applicable state law, and that contains, at a minimum: (a) the name, address, and toll-free telephone number of the consumer reporting agency that furnished the Consumer Report (which, for Pinwheel-sourced information, means Pinwheel CRA Co.); (b) a statement that the consumer reporting agency did not make the decision and is unable to provide the specific reasons for it; (c) notice of the Applicant's right to obtain a free copy of the Consumer Report from the agency within sixty (60) days; and (d) notice of the Applicant's right to dispute the accuracy or completeness of the Consumer Report; (e) where a credit score was used in taking the adverse action, the numerical credit score, the range of possible scores under the model used, up to four key factors that adversely affected the score (up to five where one of them is the number of inquiries), the date the score was created, and the name of the entity that provided the score, as FCRA section 1681m(a)(2)(B) requires; together with a copy of "A Summary of Your Rights Under the Fair Credit Reporting Act." Where Subscriber uses the Platform's notice-generation and delivery workflow, Lotly will generate and dispatch this notice on Subscriber's behalf pursuant to Section 5.0 using the standard template and procedures Lotly maintains; where Subscriber elects to deliver Adverse Action notices outside the Platform, Subscriber is solely responsible for FCRA § 615 compliance in doing so.

5.2 State and Local Adverse Action Requirements

Subscriber shall comply with all additional adverse-action and "fair chance" requirements imposed by state and local law, including without limitation the New Jersey Fair Chance in Housing Act (N.J.S.A. 46:8-52 et seq.), the Seattle Fair Chance Housing Ordinance, the Cook County Just Housing Amendment, the Oakland Fair Chance Housing Ordinance, the Berkeley Fair Chance Access to Housing Ordinance, the San Francisco Fair Chance Ordinance for Housing, and any state or local source-of-income, criminal-record, or housing-record restrictions, as each may be amended from time to time.

5.3 Platform Tools Are Aids, Not Counsel

Lotly may make available templates, automation, and workflow tools to assist Subscriber with adverse-action compliance. Such tools are provided as conveniences only and do not constitute legal advice. Subscriber remains solely responsible for compliance with all FCRA, state, and local adverse-action obligations and shall obtain independent legal advice as appropriate.

6. Information Security and Disposal

6.1 Safeguards

Subscriber shall implement and maintain reasonable administrative, technical, and physical safeguards to protect Consumer Reports and Applicant data from unauthorized access, use, disclosure, alteration, or destruction. Such safeguards shall, at a minimum, include: (a) restriction of access to Personnel with a need to know for the Permissible Purpose; (b) unique user credentials and strong passwords for each user; (c) prompt removal of access upon termination of an individual's employment or engagement; (d) encryption of Consumer Reports at rest and in transit, where commercially reasonable; (e) up-to-date anti-malware and firewall protections; (f) secure storage of any printed copies; and (g) prohibition of storage of Consumer Reports on personal or unmanaged devices.

6.2 Disposal

Subscriber shall comply with the FTC Disposal Rule, 16 C.F.R. Part 682, and shall dispose of Consumer Reports and information derived therefrom by means designed to render the information unreadable and irretrievable, including burning, pulverizing, or shredding paper records and using software or hardware-based wiping that meets industry standards (e.g., NIST Special Publication 800-88) for electronic records.

6.3 No Offshore Storage or Access

Subscriber shall not store, transmit, process, or permit access to Consumer Reports outside of the United States without Lotly's prior written consent.

6.4 Security Incident Notification

Subscriber shall notify Lotly of any Security Incident as soon as reasonably possible, and in no event more than twenty-four (24) hours after Subscriber's discovery or reasonable suspicion of the Security Incident, by email to Contact@RentalApplication.ai. Subscriber shall (a) promptly investigate and mitigate the incident; (b) cooperate fully with Lotly and the CRAs in any investigation, remediation, and notification activities; (c) provide all reasonably requested information; (d) not make any public disclosure regarding the incident without Lotly's prior written consent (which shall not be unreasonably withheld); and (e) bear the costs of remediation and any required notifications to the extent the Security Incident arose from Subscriber's acts, omissions, or breach of this Agreement.

Upon receipt of a Security Incident notice from Subscriber or upon Lotly's own discovery of an actual, suspected, or threatened Security Incident affecting Consumer Reports furnished through the Services, Lotly will (i) notify the affected CRAs (TransUnion LLC, One Source Technology, LLC d/b/a Asurint, Pinwheel CRA Co., and any other CRA whose data is implicated) in accordance with the timelines and procedures required under Lotly's reseller and service agreements with those CRAs (typically within seventy-two (72) hours); (ii) evaluate whether individual notification to affected Applicants is required under applicable data-breach-notification laws (including Cal. Civ. Code § 1798.82 and analogous state statutes), coordinate with Subscriber on the content and timing of any such notifications, and provide notifications within the timelines those laws require; and (iii) cooperate with Subscriber in preparing regulator notifications where jointly required.

7. Applicant Disputes and Reinvestigation

7.1 Receipt and Forwarding of Disputes

Applicants may submit disputes directly to Lotly at the web portal, email address, mailing address, and (where activated) toll-free number identified on their Adverse Action Notice or file-disclosure materials. If Subscriber receives a notice from any Applicant, attorney, or governmental authority disputing the accuracy or completeness of any item in a Consumer Report, Subscriber shall (a) acknowledge receipt to the Applicant within five (5) business days; (b) forward the dispute, together with all related materials, to Lotly through the Platform's dispute-handling workflow (or to disputes@lotly.ai) within five (5) business days; (c) cooperate fully and promptly with Lotly and the CRAs in any reinvestigation; and (d) implement any corrected information furnished as a result of the reinvestigation. Subscriber's failure to forward a dispute to Lotly within five (5) business days of receipt is a material breach of this Agreement and grounds for immediate suspension under Section 11.1.

Lotly's Downstream Handling. Upon receipt of a dispute (whether from the Applicant directly or forwarded by Subscriber), Lotly will (i) forward the dispute to the applicable upstream CRA within five (5) business days of Lotly's receipt in accordance with FCRA § 1681i(f)(2), and, for disputes concerning information furnished by Pinwheel CRA Co., Lotly will both forward the dispute to Pinwheel and give the Applicant Pinwheel's dispute-portal address, the referral alone being insufficient to discharge Lotly's obligation under § 5.1.D of the CRA Addendum to Lotly's reseller agreement with Pinwheel dated June 24, 2026, which cannot reduce a duty owed to a consumer under the FCRA; (ii) retry any failed forwarding using commercially reasonable exponential-backoff logic before escalating the dispute to manual handling; (iii) notify Subscriber of any forwarding failure or manual escalation; and (iv) audit-log each forwarding attempt for regulatory examination.

7.2 Identity Theft

If an Applicant claims to be a victim of identity theft, Subscriber shall promptly furnish the Applicant with the "Remedying the Effects of Identity Theft" pamphlet and shall coordinate with Lotly regarding any further response.

7.3 No Re-Use of Outdated Reports

Subscriber shall obtain a new Consumer Report each time it has a Permissible Purpose and shall not redeliver a previously furnished Consumer Report to any party except as required by law in response to a consumer-initiated investigation or court order, in which case Subscriber shall promptly notify Lotly.

8. Compliance with Laws

Subscriber shall comply with all federal, state, and local laws applicable to its use of the Services, including without limitation: (a) the FCRA and the Fair and Accurate Credit Transactions Act ("FACTA"); (b) the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq., and the FTC Safeguards Rule, 16 C.F.R. Part 314, to the extent applicable; (c) the federal Fair Housing Act and analogous state and local fair-housing laws; (d) the Americans with Disabilities Act; (e) U.S. Department of Housing and Urban Development guidance regarding the use of criminal records in housing decisions, including the April 4, 2016 Office of General Counsel Guidance on Application of Fair Housing Act Standards to the Use of Criminal Records by Providers of Housing and Real Estate-Related Transactions; (f) all state and local "ban-the-box," "fair chance housing," source-of-income discrimination, and housing-record-sealing laws; (g) the California Consumer Privacy Act / California Privacy Rights Act and analogous state privacy laws to the extent applicable; and (h) all U.S. economic-sanctions laws, including those administered by the U.S. Department of the Treasury's Office of Foreign Assets Control.

9. Additional Representations and Warranties

Subscriber represents, warrants, and certifies, on the Effective Date and continuously thereafter, that: (a) Subscriber is a legitimate business or natural person engaged in the ownership or management of residential rental real estate, with a verifiable physical location and identity; (b) Subscriber has full power and authority to enter into and perform under this Agreement; (c) Subscriber has not been the subject of any conviction, consent decree, settlement, regulatory action, or pending investigation involving identity theft, financial fraud, consumer-reporting violations, fair-housing violations, or other crimes of dishonesty; (d) neither Subscriber, nor any owner of more than fifty percent (50%) of Subscriber's equity, nor any officer, director, or principal of Subscriber, is an individual or entity subject to U.S. economic sanctions or appearing on any prohibited-persons list, including the OFAC Specially Designated Nationals List; and (e) all information Subscriber provides to Lotly during credentialing and use of the Services is true, accurate, and complete.

10. Audit and Cooperation

Subscriber shall maintain accurate records of its use of the Services, including Authorizations, dispute correspondence, adverse-action notices, security policies, records of use of the AI Reference-Call Tool (including Applicant consent to contact references and to record calls, applicable-state call-recording compliance evidence, and any disclosures delivered), and reference-call recordings and transcripts, for not less than five (5) years. Lotly may, upon not less than ten (10) days' prior written notice (or with no notice if Lotly reasonably suspects a breach or has been directed by a CRA), audit Subscriber's compliance with this Agreement, including by inspecting records, systems (configuration and security controls only), and policies. For the avoidance of doubt, Lotly's audit rights extend to Subscriber's use of the AI Reference-Call Tool, including inspection of consent records, call recordings, and state-law compliance evidence; misuse of the AI Reference-Call Tool identified through an audit is a material breach of this Agreement. Subscriber shall cooperate fully with such audits and with any audits, inquiries, or supervisory examinations conducted by a CRA, the Consumer Financial Protection Bureau, the Federal Trade Commission, a state attorney general, or any other authorized governmental authority.

11. Suspension and Termination

11.1 Suspension

Lotly may immediately suspend Subscriber's access to the Services, in whole or in part, with or without notice, if Lotly reasonably believes that (a) Subscriber has breached this Agreement; (b) Subscriber's account has been compromised; (c) Subscriber is the subject of a regulatory or law-enforcement inquiry; (d) a CRA has directed Lotly to suspend or terminate Subscriber; (e) Subscriber's continued access poses a risk to consumers, the CRAs, or Lotly; or (f) Lotly is required to suspend access by law or by contract.

11.2 Termination

Either party may terminate this Agreement for any reason on thirty (30) days' written notice. Lotly may terminate immediately for material breach by Subscriber, including any breach of Section 3 (Certifications), Section 4 (Applicant Disclosure and Authorization), Section 5 (Adverse Action), Section 6 (Information Security and Disposal), or Section 8 (Compliance with Laws).

11.3 Effect of Termination

Upon termination or expiration, Subscriber's right to access and use the Services shall cease, and Subscriber shall (a) cease all use of the Services and Consumer Reports; (b) within thirty (30) days, securely destroy all Consumer Reports in Subscriber's possession or control, except as required to be retained for legal, regulatory, audit, or dispute-resolution purposes (in which case retained Consumer Reports shall remain subject to this Agreement); and (c) certify destruction in writing upon Lotly's request. Sections 3.3, 6, 7, 12, 13, 14, 15, 16, and 18 through 24 shall survive termination.

12. Fees and Payment

The Services are provided on a pay-as-you-go and à la carte basis, with no minimum monthly commitment unless otherwise agreed in writing. Subscriber shall pay all fees for the Services in accordance with the pricing schedule posted on the Platform or otherwise communicated to Subscriber in writing, as such pricing may be updated from time to time on not less than thirty (30) days' notice. Each Consumer Report and ancillary Service is billed individually based on the Service requested. All fees are non-refundable except as expressly stated. Subscriber authorizes Lotly to charge the payment method on file for all amounts owed at the time of each transaction. Past-due amounts accrue interest at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by law. Subscriber is responsible for all taxes (other than taxes on Lotly's net income), and for all costs of collection of past-due amounts, including reasonable attorneys' fees.

13. Confidentiality

Subscriber acknowledges that the Services, the Platform, the pricing, and all data, materials, software, and processes furnished by Lotly or sourced from the CRAs are confidential and proprietary ("Confidential Information"). Subscriber shall (a) hold all Confidential Information in strict confidence; (b) use it only for the Permissible Purpose; (c) protect it with at least the same degree of care it uses to protect its own confidential information of similar sensitivity, and in no event less than reasonable care; and (d) not disclose it to any third party except to Personnel with a need to know who are bound by confidentiality obligations no less protective than those in this Agreement. Subscriber shall not remove any confidentiality, copyright, or proprietary notice from any Consumer Report or other materials.

14. Indemnification

Subscriber shall defend, indemnify, and hold harmless Lotly, its affiliates, and each of their respective officers, directors, employees, agents, and the CRAs (as third-party beneficiaries) from and against all third-party claims, demands, actions, losses, liabilities, damages, fines, penalties, costs, and expenses (including reasonable attorneys' fees) arising out of or related to: (a) Subscriber's breach of this Agreement; (b) Subscriber's access to or use of the Services or Consumer Reports; (c) any Adverse Action, application decision, or other tenancy decision made by Subscriber; (d) Subscriber's violation of any law; (e) Subscriber's gross negligence, willful misconduct, or fraud; or (f) any Security Incident caused by Subscriber. Lotly may, at its option and at Subscriber's expense, assume control of the defense of any indemnified claim.

Carve-Out for Lotly's Own Statutory Duties. Notwithstanding the foregoing, Subscriber's indemnification obligations under this Section 14 do not extend to claims arising directly from (i) Lotly's negligent or willful breach of Lotly's own operational duties under Section 5 (Adverse Action Procedures) or Section 7 (Applicant Disputes and Reinvestigation), where Lotly is generating or delivering notices, forwarding disputes, or maintaining audit-log records under Sections 3.2, 5.0, or 7.1; (ii) Lotly's breach of the statutory obligations imposed directly on Lotly as a reseller of consumer reports under the FCRA or applicable state law; or (iii) Lotly's own violation of the CRAs' flow-down security or dispute-handling requirements to the extent that violation was not caused by Subscriber's acts or omissions. Lotly shall be responsible for such claims to the extent permitted by law, and this carve-out preserves each party's rights and remedies at law and in equity.

15. Disclaimer of Warranties

THE SERVICES AND CONSUMER REPORTS ARE PROVIDED "AS IS" AND "AS AVAILABLE." LOTLY AND THE CRAs DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, OR UNINTERRUPTED OPERATION. CONSUMER REPORTS ARE COMPILED FROM THIRD-PARTY AND PUBLIC-RECORD SOURCES AND ARE NOT GUARANTEED TO BE ACCURATE, COMPLETE, OR CURRENT. SUBSCRIBER IS SOLELY RESPONSIBLE FOR ALL DECISIONS MADE IN RELIANCE ON CONSUMER REPORTS.

16. Limitation of Liability

EXCEPT FOR SUBSCRIBER'S INDEMNIFICATION OBLIGATIONS, BREACH OF SECTION 3 (CERTIFICATIONS), BREACH OF SECTION 6 (SECURITY), BREACH OF SECTION 13 (CONFIDENTIALITY), OR INFRINGEMENT OF LOTLY'S OR ANY CRA'S INTELLECTUAL PROPERTY: (A) IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR DATA, ARISING OUT OF OR RELATED TO THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; AND (B) LOTLY'S TOTAL AGGREGATE LIABILITY UNDER THIS AGREEMENT SHALL NOT EXCEED THE GREATER OF (I) THE AMOUNT PAID BY SUBSCRIBER TO LOTLY UNDER THIS AGREEMENT IN THE SIX (6) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY OR (II) FIVE HUNDRED DOLLARS ($500). THE FOREGOING LIMITATIONS APPLY NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY.

Statutory Damages Carve-Out. Nothing in this Section 16 limits, caps, or waives (i) any statutory damages or civil penalties imposed by law on either party (including without limitation statutory damages available to consumers under FCRA §§ 1681n or 1681o), (ii) either party's liability for willful or reckless noncompliance with a statutory duty imposed directly by law, or (iii) either party's liability for gross negligence, willful misconduct, or fraud. The limitations in this Section 16 apply only to contractual damages, lost profits, and indirect damages between Lotly and Subscriber; they do not, and are not intended to, override statutory minimums, statutory rights, or any consumer's private right of action under applicable law.

17. Insurance

If Subscriber (a) manages twenty-five (25) or more residential units, or (b) processes more than twenty-five (25) tenant-screening applications through the Services in any given calendar month, Subscriber shall maintain, at its sole expense, throughout the Term: (i) commercial general liability insurance with limits of not less than One Million Dollars ($1,000,000) per occurrence; and (ii) cyber liability / network security and privacy liability insurance with limits of not less than One Million Dollars ($1,000,000) per claim. Upon request, Subscriber shall furnish Lotly with certificates of insurance evidencing the foregoing coverages. Subscribers below both thresholds are encouraged but not required to maintain such coverage.

18. Term

This Agreement begins on the Effective Date (the date Subscriber first accepts this Agreement) and continues until terminated as provided in Section 11 (the "Term").

19. Notices

All notices to Lotly shall be in writing and sent to: Lotly Software LLC, Attn: Legal — RentalApplication.ai, 5754 Lonetree Blvd, Rocklin, CA 95765, with a copy by email to Contact@RentalApplication.ai. Notices to Subscriber may be delivered to the email address or postal address on file in Subscriber's account. Notices are deemed given upon delivery, and in the case of email, upon transmission absent a bounce-back.

20. Governing Law; Dispute Resolution

20.1 Governing Law

This Agreement is governed by the laws of the State of California, without regard to its conflict-of-laws principles. The U.N. Convention on Contracts for the International Sale of Goods does not apply.

20.2 Binding Arbitration

READ THIS SECTION CAREFULLY. IT REQUIRES BINDING INDIVIDUAL ARBITRATION OF DISPUTES AND WAIVES YOUR RIGHT TO A JURY TRIAL OR TO PARTICIPATE IN A CLASS ACTION. Any dispute, claim, or controversy arising out of or relating to this Agreement or the Services and between Lotly and Subscriber shall be resolved by binding arbitration administered by JAMS pursuant to its Streamlined Arbitration Rules. The arbitration shall be conducted by a single arbitrator. To minimize burden on Subscribers located in any U.S. state, the arbitration shall be conducted by videoconference unless both parties mutually agree in writing to in-person arbitration, in which case in-person arbitration shall be held in Sacramento, California, or another location mutually agreed in writing. The Federal Arbitration Act, 9 U.S.C. §§ 1–16, governs the interpretation and enforcement of this arbitration provision. Judgment on the award may be entered in any court of competent jurisdiction.

Scope; Applicant/Consumer Carve-Out. This arbitration provision is between Lotly and Subscriber only. It does not bind, and confers no rights upon, Applicants or other consumers who are not signatories to this Agreement, and no such person may compel arbitration under this Section or be compelled to arbitrate under it. Nothing in this Section 20 enlarges, restricts, or waives any right, claim, or defense that Lotly or any consumer may have against the other under the FCRA or any other law; those rights are governed by the Applicant Terms of Service and by statute. Nothing in this Section shall preclude either Lotly or Subscriber from bringing an action to compel a party to comply with a statutory notification, disclosure, or dispute-forwarding obligation.

20.3 Class Action Waiver

THE PARTIES (LOTLY AND SUBSCRIBER) WAIVE ANY RIGHT TO PARTICIPATE IN A CLASS, COLLECTIVE, OR REPRESENTATIVE PROCEEDING AGAINST ONE ANOTHER. All disputes between Lotly and Subscriber shall be resolved on an individual basis only. For the avoidance of doubt, this class-action waiver binds only Lotly and Subscriber and does not by itself bind Applicants or other consumers who are not signatories to this Agreement. The treatment of claims brought by Applicants against Lotly is governed exclusively by the Applicant Terms of Service and by statute, and nothing in this Agreement enlarges or restricts either party's rights or defenses with respect to those claims.

20.4 Equitable Relief

Notwithstanding the foregoing, either party may seek temporary or preliminary injunctive or equitable relief in any court of competent jurisdiction to protect its intellectual property, Confidential Information, or rights pending arbitration.

21. General Provisions

21.1 Independent Contractors

The parties are independent contractors. This Agreement does not create any agency, partnership, joint venture, or employment relationship.

21.2 Assignment

Subscriber may not assign or transfer this Agreement, by operation of law or otherwise, without Lotly's prior written consent. Lotly may assign this Agreement without consent in connection with a merger, acquisition, reorganization, or sale of substantially all of its assets. Any attempted assignment in violation of this section is void.

21.3 Force Majeure

Neither party is liable for any failure or delay caused by events beyond its reasonable control, including acts of God, natural disasters, governmental actions, war, terrorism, civil unrest, labor disputes, internet or utility outages, or pandemics.

21.4 Multi-State Enforceability; Severability; Waiver

Lotly markets and provides the Services to Subscribers throughout the United States. This Agreement is intended to be valid, binding, and enforceable in every U.S. state, U.S. territory, and the District of Columbia, and Subscriber acknowledges that the geographic location of Subscriber, of any Property, or of any Applicant does not affect the enforceability of this Agreement. If any provision of this Agreement, with respect to any particular jurisdiction, is held by a court or arbitrator of competent jurisdiction to be invalid, illegal, or unenforceable, that provision shall, to the extent permitted, be reformed within that jurisdiction to the minimum extent necessary to make it enforceable while preserving the parties' intent, and shall otherwise remain in full force in all other jurisdictions and as to all other matters. Where the law of an Applicant's state, the state of a Property, or any other state with mandatory jurisdiction over the matter requires the application of that state's substantive law to a particular issue (including without limitation requirements relating to consumer-report disclosures, fair-housing, fair-chance housing, housing-record reporting, application-fee caps, breach notification, or applicant data sharing), that state's law shall govern that particular issue, notwithstanding the choice-of-law provision in Section 20.1, but shall not displace the choice-of-law provision as to other matters. No waiver of any provision is effective unless in writing and signed by the waiving party, and the failure of either party to enforce any provision shall not constitute a waiver of that provision or any other provision.

21.5 Updates

Lotly may update this Agreement from time to time. Material changes will be communicated to Subscriber by email or in-Platform notice not less than thirty (30) days before they take effect. Continued use of the Services after the effective date constitutes acceptance of the updated Agreement.

21.6 Third-Party Beneficiaries

The CRAs are intended third-party beneficiaries of Sections 3, 4, 5, 6, 7, 8, 13, and 14, and may enforce those provisions directly against Subscriber.

21.7 Entire Agreement

This Agreement, together with the Privacy Policy and any pricing schedule or order form referenced herein, constitutes the entire agreement between the parties regarding the Services and supersedes all prior or contemporaneous understandings.

22. FCRA Penalty Notice

FEDERAL LAW WARNING. Pursuant to 18 U.S.C. § 1681q, any person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses shall be fined under Title 18 of the United States Code, imprisoned for not more than two years, or both.

23. Acceptance; Electronic Signature

23.1 Acceptance by Subscriber

By clicking "I Agree," typing or providing an electronic signature, checking an acceptance box, or otherwise accepting this Agreement through the RentalApplication.ai onboarding flow or any successor flow, Subscriber: (a) acknowledges that Subscriber has read, understood, and agreed to be bound by this Agreement in its entirety, including without limitation the FCRA certifications in Section 3, the Applicant disclosure and authorization obligations in Section 4 (including the Investigative Consumer Report obligations in Section 4.5), the adverse-action obligations in Section 5, the binding arbitration and class-action-waiver provisions in Section 20, and the FCRA penalty notice in Section 22; (b) represents and warrants that all information provided to Lotly during credentialing is true, accurate, and complete; and (c) consents to transact electronically with Lotly under the federal Electronic Signatures in Global and National Commerce Act ("E-SIGN") and the Uniform Electronic Transactions Act ("UETA"), and agrees that this Agreement and all related notices, disclosures, certifications, and records may be provided, executed, and retained electronically.

23.2 Acceptance by Lotly; No Countersignature Required

Lotly's acceptance of this Agreement is manifested by Lotly making the Services available to Subscriber following Subscriber's electronic acceptance. No countersignature, physical signature, or other written acceptance by Lotly is required for this Agreement to be valid, binding, and enforceable on either party. The parties intend that this Agreement be enforceable as a unilaterally-accepted clickwrap agreement under applicable law in every U.S. state, U.S. territory, and the District of Columbia, and Subscriber waives any defense to enforcement based on the absence of a Lotly signature.