FeaturesProductMarketPricingBlogHelp Center
Log inSign up

Privacy Policy

Last updated: November 1, 2026

What changed on November 1, 2026: section 6 says the content of a deleted account is deleted in stages, as each part of the account settles, and that LOTULIS keeps the account's record and its activity history, internal to LOTULIS. Earlier, on October 31, 2026: section 6 says what happens to data when an account is deleted in Settings, and what LOTULIS keeps after. Earlier, on October 27, 2026: Section 2 (Google User Data) now describes in full what LOTULIS reads from Google Calendar and Google Drive, names every service that stores files brought in from Google Drive, and says that disconnecting Google deletes everything copied from Google Calendar. Earlier, on October 26, 2026: LOTULIS is operated by LOTULIS L.L.C., a Wyoming limited liability company (the note at the end of this page). Earlier, on October 17, 2026: Stripe is now the only payment processor LOTULIS supports. Square and PayPal are no longer offered, and sections 1.5, 4.1 and 9 say so, with a note on payment records from before then. Earlier, on October 4, 2026, the description of who uses the platform was widened to cover photographers, artists and other small service businesses, not only real estate photography. The SMS section (added May 2026) is unchanged in substance.

LOTULIS ("we," "our," or "us") operates a multi-tenant SaaS platform for photographers, artists and other small service businesses. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at lotulis.com and related services.

By using LOTULIS, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this privacy policy, please do not access the platform.

1. Information We Collect

1.1 Account Information

When you register for an account, we collect:

  • Name and email address
  • Password (stored securely using bcrypt hashing)
  • Business name, address, and contact information
  • Profile photo (optional)
  • Timezone and language preferences

1.2 Client Data (For Businesses on the Platform)

If you run a business on our platform, you may store:

  • Client names, email addresses, and phone numbers
  • Client business information and addresses
  • Client profile photos
  • Communication history and notes

1.3 Property and Gallery Data

To provide our services, we collect and store:

  • Property addresses and location information
  • Property details (square footage, price, bedrooms, etc.)
  • Photos, videos, floor plans, and 3D tour embeds
  • Documents and contracts related to properties
  • MLS information and gallery status

1.4 Order and Transaction Data

  • Service orders and job details
  • Scheduling and appointment information
  • Invoices and payment records
  • Communication threads and revision requests

1.5 Payment Information

Payments made through LOTULIS are processed by Stripe, the one payment processor LOTULIS supports. Card, bank (ACH) and wallet payments such as Apple Pay are entered on Stripe's own payment pages, so complete card numbers and bank account numbers go to Stripe. We do not store complete credit card numbers on our servers. We may store:

  • Last four digits of payment cards (for display purposes)
  • Card brand and wallet type (for display purposes)
  • Billing addresses
  • Transaction history and receipts
  • The status of a bank payment while it clears
  • Payment processor customer IDs

A business on the platform can also record a payment it received outside LOTULIS, such as cash, a check, a bank transfer or another method the business names. LOTULIS does not process those payments. It stores the record the business enters: the amount, the date and the method.

Payment records created while LOTULIS also offered Square and PayPal (until October 2026) may include payments a business took through either one. Those records are kept as described in Section 6 (Data Retention).

1.6 Usage Data

We automatically collect certain information when you use our platform:

  • IP address and approximate location
  • Browser type and version
  • Device information and operating system
  • Pages visited and features used
  • Date and time of access
  • Referring website or source

1.7 Cookies and Tracking Technologies

We use cookies and similar technologies to:

  • Maintain your session and authentication state
  • Remember your preferences and settings
  • Analyze platform usage and performance
  • Provide security features

1.8 SMS / Text Messaging Data

If you opt into our SMS messaging program (described in Section 18 of our Terms of Service), we collect and store the following:

  • Your mobile phone number in canonical (E.164) format
  • Phone-ownership verification timestamp (the moment you successfully completed Twilio Verify code-check)
  • Affirmative SMS consent timestamp and consent source (e.g., explicit checkbox in Settings, double-opt-in YES reply)
  • An audit trail of every SMS sent and received, including the message template name, status (sent / delivered / failed / opted-out), and provider message identifiers, retained as compliance evidence under the U.S. Telephone Consumer Protection Act and CTIA Messaging Best Practices
  • If you reply STOP (or any opt-out keyword), the timestamp and the opted-out phone number, retained as evidence of honored opt-out

Our SMS messaging program sends transactional account notifications to LOTULIS account holders about their own account only. These include trial-ending reminders, payment-failure alerts, plan-change confirmations, and security alerts (such as a new device sign-in or a password change). We never send marketing, promotional, or third-party content through this program. Message frequency varies with your account activity; a typical user receives from 0 to 4 messages per month. Message and data rates may apply. Reply HELP for help or STOP to unsubscribe at any time.

Phone numbers and SMS-related data are used solely to deliver the transactional messages described in our Terms of Service Section 18 and to comply with applicable laws governing SMS messaging. Phone numbers are shared with Twilio (our SMS delivery provider) for the purpose of message delivery and phone-ownership verification, and are not sold or shared with third parties for their marketing purposes. You may revoke SMS consent at any time by replying STOP to any message we send, or by visiting your account settings.

No mobile information, including phone numbers, SMS opt-in records, and consent timestamps, will be shared with third parties or affiliates for marketing or promotional purposes. All sharing of mobile data with our service providers (currently Twilio) is solely for the purpose of operating the Messaging Program described in our Terms of Service Section 18.

2. Google User Data

LOTULIS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.1 Data We Access from Google

When you sign in with Google or connect your Google account, we may access:

  • Basic Profile Information: Your name, email address and profile photo, to sign you in and to show which Google account is connected
  • Google Calendar: The list of your calendars, so you can choose one; the events LOTULIS adds to the calendar you choose for your shoots, which it also updates and removes; and, only if you turn on "Bring Google events into LOTULIS", your upcoming events: their title, time, description, and the email address and reply of each guest. Events that have already ended are never brought in.
  • Google Drive: Only the files you pick in Google's file picker, and the files and folders LOTULIS creates in your Drive when you export to it. LOTULIS cannot see any other file in your Drive.

A client who saves delivered photos to their own Google Drive from a download page gives LOTULIS the same limited Drive access, only to create those files and folders.

2.2 How We Use Google Data

We use your Google data only for the following purposes:

  • Signing you in with Google and showing which Google account is connected
  • Adding your LOTULIS shoots to the Google Calendar you choose and keeping them up to date
  • Showing your upcoming Google events on your LOTULIS calendar and holding that time, so clients cannot book over it
  • Adding a meeting to a contact's timeline in your CRM when that contact's email address is a guest on one of your Google events
  • Copying the files you pick from Google Drive into your galleries
  • Saving galleries and delivered files to Google Drive when you or your client asks

2.3 What We Do NOT Do with Google Data

We will never:

  • Sell your Google data, or transfer it to advertising platforms, data brokers or information resellers
  • Use your Google data for advertising, including personalized, retargeted or interest-based advertising
  • Use your Google data to determine creditworthiness or for lending purposes
  • Use your Google data to train AI or machine learning models
  • Share your Google data with third parties except as necessary to provide the features described in Section 2.2
  • Let people read your Google data, unless you ask us to (for example in a support request), it is needed for security such as investigating abuse, or the law requires it
  • Store your Google data longer than necessary for the features you use

LOTULIS does not use Google Workspace APIs, or any data obtained through them, to develop, improve or train generalized or non-personalized AI or machine learning models.

2.4 Google Data Sharing

Your Google data may be shared only with:

  • Infrastructure Providers: Vercel (hosting) and Supabase (database), and, for files you bring in from Google Drive, Backblaze B2 (where the original files are stored) and Cloudflare R2 (where their previews are stored), only as necessary to operate the platform
  • AI Editing Providers: When you ask for an AI edit of a photo, including one brought in from Google Drive, that photo is sent to the service that makes the edit (Section 4.1)
  • You: Data you explicitly choose to share through gallery pages or with your clients

2.5 Google Data Storage and Security

  • Google OAuth tokens are encrypted using AES-256-GCM before storage
  • Access tokens expire after one hour and are renewed with the stored, encrypted refresh token
  • All data is transmitted over encrypted HTTPS (TLS) connections
  • Data is stored in secure, access-controlled databases with row-level security

2.6 Google Data Retention and Deletion

  • Google authentication data is retained only while your Google account is connected
  • You can disconnect Google at any time from Settings > Integrations
  • Disconnecting asks Google to revoke LOTULIS's access and deletes your Google tokens immediately
  • Disconnecting also deletes the events brought in from Google Calendar and the meetings they added to your contacts' timelines. A meeting on a contact's timeline for one of your own LOTULIS shoots or events stays, without the guest list, replies and link that came from Google
  • Turning off "Bring Google events into LOTULIS" stops new events from coming in; events already brought in stay until you disconnect Google
  • Files you copied from Google Drive into a gallery become part of that gallery and stay until you delete them
  • Upon account deletion, all Google-related data is permanently deleted within 30 days
  • You can also revoke access via your Google Account permissions; to delete what LOTULIS copied from Google Calendar, also disconnect Google in Settings > Integrations

3. How We Use Your Information

We use the information we collect to:

  • Provide Services: Operate the platform and deliver requested features
  • Process Transactions: Handle payments, invoices, and refunds
  • Communicate: Send service updates, notifications, and support responses
  • Improve Platform: Analyze usage patterns to enhance features and fix issues
  • Security: Detect and prevent fraud, abuse, and unauthorized access
  • Legal Compliance: Meet legal obligations and respond to lawful requests
  • Customer Support: Assist with inquiries and technical issues

4. Data Sharing and Disclosure

4.1 Service Providers

We share data with third-party service providers who assist in operating our platform:

  • Vercel: Application hosting and deployment
  • Supabase: Database, authentication, and file storage
  • Backblaze B2: Storage of original media files
  • Cloudflare R2: Media file storage and delivery
  • Stripe: Payment processing (cards, bank payments and wallets such as Apple Pay), for payments to businesses on the platform and for LOTULIS subscriptions
  • PayPal and Square (until October 2026): Payment processing for a business that chose to connect either one. Neither is offered now, and no new data is shared with them.
  • Resend: Transactional email delivery
  • Twilio: Transactional SMS delivery and phone-number verification
  • Google Cloud Vision: Image analysis for copyright protection (CopyPro feature)
  • AI Editing Providers: Google (Gemini for AI photo edits, Veo for AI tour videos) and Clipdrop, only for AI edits you ask for

We do not sell or share your phone number with third parties for their marketing purposes. Phone numbers shared with Twilio for SMS delivery and verification are governed by Twilio's own privacy and data-use practices.

4.2 Business Transfers

If LOTULIS is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4.3 Legal Requirements

We may disclose information if required to:

  • Comply with applicable laws, regulations, or legal processes
  • Respond to lawful requests from government authorities
  • Protect the rights, property, or safety of LOTULIS, our users, or others
  • Enforce our Terms of Service

4.4 With Your Consent

We may share information with third parties when you explicitly consent or direct us to do so.

4.5 Public Gallery Pages

When you create public gallery pages (branded or unbranded), the property information, photos, and media you include become publicly accessible. Client contact information on these pages is displayed as you configure it.

5. Data Security

We implement comprehensive security measures to protect your data:

5.1 Encryption

  • All data transmitted over the internet uses TLS encryption (HTTPS)
  • Sensitive data at rest is encrypted using AES-256
  • OAuth tokens and API credentials are encrypted with AES-256-GCM
  • Passwords are hashed using bcrypt with unique salts

5.2 Access Control

  • Row-Level Security (RLS) policies ensure complete data isolation between tenants
  • 199+ database security policies enforce ownership-based access
  • Role-based access control (Superadmin, Admin, Client)
  • Secure session management with automatic expiration

5.3 Infrastructure Security

  • Hosted on enterprise-grade cloud infrastructure (Vercel, Supabase)
  • Regular security updates and patching
  • DDoS protection and rate limiting
  • Comprehensive audit logging of all actions

5.4 Application Security

  • Protection against SQL injection, XSS, and CSRF attacks
  • Input validation and sanitization
  • Content Security Policy (CSP) headers
  • Regular security assessments

6. Data Retention

  • Active Accounts: Data is retained while your account is active
  • Cancelled Subscriptions: Data is retained for 90 days to allow reactivation
  • Account Deletion: An account can be deleted in Settings. After the final confirmation the account closes at once. Its content is then deleted in stages, as each part of the account settles, within 30 days of the request at the latest.
  • Account Record: LOTULIS keeps the account's record and its activity history after a deletion, tied to the account email. They stay internal to LOTULIS and are never shown to anyone else.
  • Records Kept by Law: After a deletion LOTULIS keeps only its own billing records about the business, the record of its platform fee on each payment without client names, and records of agreements accepted, for 7 years, because the law requires it.
  • Account Email: The email address of a deleted account stays on a closed record, so it cannot open a new account. Support can release it on request.
  • Shared Content: Messages a deleted account sent stay in the other people's conversations, shown as from "Deleted account". Reviews and photos shared with other businesses stay with them, and contact details another business saved stay in its records.
  • Hosted Websites: Copies of a business website that LOTULIS built into its own code stay in that code's history after deletion.
  • Backups: Backup copies are purged within 90 days of deletion
  • Legal Holds: Data may be retained longer if required by law
  • Anonymized Data: Aggregated, anonymous analytics may be retained indefinitely

7. Your Rights and Choices

Depending on your location, you may have the following rights:

7.1 Access

Request a copy of the personal data we hold about you.

7.2 Correction

Request correction of inaccurate or incomplete personal data.

7.3 Deletion

Request deletion of your personal data, subject to legal retention requirements.

7.4 Data Portability

Request your data in a structured, machine-readable format (CSV/JSON export).

7.5 Withdraw Consent

Revoke consent for specific data processing activities at any time.

7.6 Object to Processing

Object to certain types of data processing.

7.7 Opt-Out of Marketing

Unsubscribe from marketing communications at any time via email preferences.

To exercise these rights, contact us at support@lotulis.com or use the data management features in your account settings.

8. International Data Transfers

LOTULIS is based in the United States. If you access our platform from outside the US, your data will be transferred to and processed in the United States. By using our services, you consent to this transfer.

We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where applicable.

9. Third-Party Services

Our platform integrates with third-party services that have their own privacy policies. We encourage you to review their policies:

10. Children's Privacy

LOTULIS is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete that information.

11. California Privacy Rights (CCPA)

California residents have additional rights under the CCPA:

  • Right to Know: What personal information we collect and how it's used
  • Right to Delete: Request deletion of personal information
  • Right to Opt-Out: Opt out of the "sale" of personal information (we do not sell data)
  • Right to Non-Discrimination: Equal service regardless of privacy choices

To exercise these rights, contact us at support@lotulis.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

  • Posting the updated policy on this page with a new "Last updated" date
  • Sending an email notification for significant changes
  • Displaying a notice in the platform dashboard

Your continued use of LOTULIS after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us:

LOTULIS is operated by LOTULIS L.L.C., a Wyoming limited liability company.