This Privacy Policy ("Policy") describes how Lizo AI Ltd. and its affiliates ("lizo.ai," "we," "us," or "our") collect, use, disclose, and protect information in connection with the lizo.ai artificial intelligence platform and related services (the "Platform").
This Policy applies exclusively to business clients ("Clients") and their authorized personnel ("Authorized Users"). The Platform is not directed at, and does not knowingly process information of, residential tenants, consumers, or natural persons acting in a non-business capacity.
CLIENT WARRANTY. By executing an Order Form or accessing the Platform, each Client represents and warrants that: (i) all Authorized Users access the Platform solely in their professional, employment-related capacity; (ii) no data submitted to the Platform constitutes consumer data, residential tenant data, or personal data of natural persons acting outside a commercial context; and (iii) Client is solely responsible for ensuring that no unauthorized personal data is uploaded to the Platform. lizo.ai bears no responsibility for Client violations of this restriction.
For purposes of this Policy, the following terms have the meanings set forth below:
"Client" means a business entity that has executed an Order Form or Master Subscription Agreement ("MSA") with lizo.ai to access the Platform.
"Authorized User" means an employee, contractor, or representative of a Client who is granted access to the Platform under Client's subscription.
"Client Data" means property address lists, portfolio data, financial models, and other proprietary commercial data that a Client uploads or transmits to the Platform in the course of using the services.
"System Data" means aggregated, de-identified, and/or anonymized data derived from Platform usage, performance metrics, and analytical outputs that cannot reasonably be used to identify any Client, Authorized User, or individual property owner. System Data is owned exclusively by lizo.ai and may be retained and used indefinitely. See Section 5.
"Platform" means the lizo.ai AI-driven commercial real estate analytics platform, including all software, interfaces, APIs, machine learning models, and related services.
"Order Form" means a written or electronic agreement specifying the Platform services, subscription term, fees, and any additional terms applicable to a Client.
"Subscription Term" means the period during which a Client has an active, paid subscription to the Platform as specified in the applicable Order Form.
"Personal Information" means information that identifies or can reasonably be linked to an Authorized User as a natural person, such as name, work email, or IP address. As used in this Policy, Personal Information is limited to business contact and usage data of Authorized Users and does not include Client Data.
2.1 Account and Contact Information
When a Client establishes an account or executes an Order Form, lizo.ai collects business contact information, including the names, email addresses, job titles, and phone numbers of Authorized Users, as well as company name, billing address, and payment details. Payment card data is processed exclusively by PCI-DSS-compliant third-party payment processors; lizo.ai does not store raw payment card numbers on its systems.
2.2 Client Data
Clients may submit property address lists and portfolio data to the Platform. This data relates to real property assets and commercial business operations, not to individual persons. lizo.ai processes Client Data solely to deliver the contracted services and, in de-identified or aggregated form, as System Data pursuant to Section 5.
2.3 Platform Usage Data
lizo.ai automatically collects technical data about how Authorized Users interact with the Platform, including IP addresses, browser type, device identifiers, session duration, features accessed, and pages viewed. This data is used for security monitoring, product improvement, operational analytics, and the generation of System Data.
2.4 Cookies and Tracking Technologies
The Platform uses cookies and similar technologies to maintain session authentication, remember user preferences, and analyze usage patterns. Authorized Users may adjust browser settings to refuse cookies, though this may affect Platform functionality. The Platform does not use third-party advertising cookies or cross-site behavioral tracking technologies.
lizo.ai uses the information collected for the following purposes:
lizo.ai does not sell, rent, or trade Client Data or Authorized User information to third parties for their own independent marketing or commercial purposes.
4.1 Service Providers and Sub-Processors
lizo.ai may engage third-party vendors and service providers — including cloud hosting providers, payment processors, customer support tools, and email service providers — who process information on lizo.ai's behalf under contractual confidentiality and data protection obligations consistent with this Policy, including restrictions on use for their own independent purposes. A current list of lizo.ai’s material sub-processors is available upon written request to privacy@lizo.ai and, when published, at www.lizo.ai/sub-processors. lizo.ai will provide at least thirty (30) days’ advance written notice of any material changes to its sub-processor list, and Clients may object to any such change by notifying lizo.ai in writing within such notice period.
4.2 Legal Requirements
lizo.ai may disclose information if required to do so by applicable law, regulation, legal process, subpoena, court order, or lawful request by governmental authorities. Where legally permitted and practicable, lizo.ai will notify the affected Client prior to such disclosure and cooperate with Client's efforts to seek a protective order or other relief.
4.3 Business Transfers
In connection with a merger, acquisition, corporate reorganization, financing, or sale of lizo.ai's business or assets, information may be transferred to the acquiring or successor entity, subject to confidentiality obligations consistent with this Policy. lizo.ai will notify affected Clients of any such transfer.
4.4 System Data
lizo.ai may use and disclose System Data (as defined in Section 1 and further described in Section 5) to third parties, partners, or the public in aggregate or de-identified form, including in industry reports, benchmarks, research publications, and marketing materials. Such disclosures do not constitute disclosure of Client Data or Authorized User Personal Information.
4.5 With Client Consent
lizo.ai may disclose information for any other purpose with the prior written consent of the affected Client.
5.1 Creation and Ownership of System Data
In the course of operating the Platform, lizo.ai generates System Data by applying de-identification, aggregation, and anonymization techniques to Client Data and Platform Usage Data. System Data cannot reasonably be used to identify any specific Client, Authorized User, individual property owner, or natural person, and is treated as non-personal for purposes of this Policy. System Data does not include raw Client Data or Authorized User Personal Information. System Data is the exclusive property of lizo.ai. By using the Platform, Clients agree that lizo.ai may create, use, and disclose System Data indefinitely without restriction.
5.2 Permitted Uses of System Data
lizo.ai may use System Data for any lawful business purpose, including without limitation:
5.3 Client Data Firewall
lizo.ai shall not use a specific Client’s raw, identifiable Client Data to train, fine-tune, or validate any machine learning model in a manner that could directly or indirectly benefit any other Client or third party. All AI and machine learning model training performed by lizo.ai that incorporates data derived from Client submissions shall be conducted exclusively on de-identified, aggregated System Data meeting the standards set forth in Section 5.1. Raw Client Data shall not be shared with, disclosed to, or made accessible to any other Client under any circumstances. lizo.ai maintains technical and organizational separation controls at the data ingestion layer to enforce this restriction, and such controls shall be subject to periodic internal review.
5.4 Retention of System Data
Because System Data does not identify any Client or individual and constitutes lizo.ai's proprietary research and development asset, lizo.ai may retain System Data indefinitely. This indefinite retention applies only to data that meets the de-identification and aggregation standards described in Section 5.1. All other data is subject to the retention schedule set forth in Section 8.
6.1 Applicability
This Section applies to the extent lizo.ai processes personal information of California residents in its capacity as a "business" under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA"). The Platform is designed for B2B use only. The personal information lizo.ai processes in this context is limited to business contact information of Authorized Users (e.g., work email, name, business phone, IP address) and does not include consumer data or residential tenant data.
6.2 Categories of Personal Information Collected
In connection with operating the Platform for B2B Clients, lizo.ai may collect the following categories of personal information from California residents acting in a business capacity:
lizo.ai does not collect sensitive personal information as defined under CPRA § 1798.121 from Authorized Users in the ordinary course of business.
6.3 Sale or Sharing
lizo.ai does not sell or share personal information as those terms are defined under the CCPA/CPRA. No personal information of Authorized Users is disclosed to third parties for cross-context behavioral advertising.
6.4 Rights of California Residents
To the extent applicable under the CCPA, California residents who are Authorized Users may have the following rights:
To submit a verifiable request, contact lizo.ai at privacy@lizo.ai (subject line: "CCPA Rights Request") or at www.lizo.ai/privacy-request. lizo.ai will acknowledge receipt within ten (10) business days and will substantively respond within forty-five (45) calendar days of receipt, with a possible extension of an additional forty-five (45) days where reasonably necessary. lizo.ai may require verification of the requestor's identity before processing any request.
6.5 Shine the Light
California Civil Code Section 1798.83 permits California residents to request information about personal information disclosed to third parties for direct marketing purposes. lizo.ai does not disclose personal information to third parties for their own direct marketing purposes and accordingly no Shine the Light disclosure is required.
lizo.ai implements and maintains commercially reasonable administrative, physical, and technical safeguards designed to protect information against unauthorized access, disclosure, alteration, loss, or destruction. These safeguards include, without limitation:
No method of transmission over the internet or electronic storage is completely secure. lizo.ai cannot guarantee absolute security. In the event of a confirmed data security incident affecting Client Data or Authorized User Personal Information, lizo.ai will notify the affected Client without undue delay, and in any event within seventy-two (72) hours of lizo.ai becoming aware that a Personal Data Breach has occurred, to the extent such notification is practicable. Such notification shall include, to the extent then known: a description of the nature of the incident, the approximate number of individuals and records affected, the categories of data involved, the likely consequences of the breach, and the measures lizo.ai has taken or proposes to take to address the incident and mitigate its possible adverse effects. lizo.ai's liability for security incidents is limited as set forth in the applicable Master Subscription Agreement.
lizo.ai retains different categories of data for different periods based on the nature of the data and applicable legal requirements, as set forth in the table below:
Upon expiration of the applicable retention period, lizo.ai will securely delete or anonymize the relevant information in accordance with industry-standard data destruction practices. System Data, which is de-identified and aggregated, is not subject to deletion obligations and may be retained indefinitely as provided in Section 5.4.
The Platform is operated through servers and infrastructure located in the United States and Israel. By executing an Order Form and using the Platform, each Client expressly authorizes the transfer, storage, and processing of Client Data and Authorized User information in these jurisdictions.
lizo.ai's primary infrastructure is located in the United States. Client Data and Authorized User information processed in the United States is subject to applicable US federal and state law, including the California Consumer Privacy Act (CCPA/CPRA) as described in Section 6.
lizo.ai also operates infrastructure and personnel in Israel. Data transferred to Israel is subject to the Israeli Privacy Protection Law, 5741-1981, as amended and supplemented from time to time, including any regulations and orders promulgated thereunder. lizo.ai implements appropriate contractual and technical measures to protect information transferred to Israel consistent with applicable law, and monitors developments under Israeli privacy legislation, including pending amendments to the Privacy Protection Law, in order to update its practices as required prior to any such amendments taking effect.
lizo.ai's current operations are focused on US and Israeli jurisdictions. lizo.ai does not presently target or serve clients located in the European Economic Area (EEA), the United Kingdom, or Switzerland. If lizo.ai expands its services to EEA or UK markets in the future, this Policy will be updated accordingly with appropriate transfer mechanisms and data subject rights frameworks prior to any such expansion.
The Platform may reference, link to, or enable integrations with third-party data sources, mapping services, or external websites. lizo.ai is not responsible for the privacy practices, security standards, or content of any third-party services accessed through or referenced by the Platform. Clients and Authorized Users are encouraged to review the privacy policies and terms of service of any third-party services they access in connection with their use of the Platform. lizo.ai does not endorse and is not liable for any third-party content, products, or services accessible through the Platform.
The Platform is not directed to individuals under the age of eighteen (18) and is designed exclusively as a commercial business tool. lizo.ai does not knowingly collect personal information from minors. The Children's Online Privacy Protection Act (COPPA) does not apply to lizo.ai's Platform operations. If lizo.ai becomes aware that personal information of a minor has been submitted to the Platform, lizo.ai will promptly delete such information and may suspend the associated Authorized User account. Clients are responsible for ensuring that all Authorized Users are adults with legal capacity to enter into commercial agreements.
lizo.ai reserves the right to update this Privacy Policy at any time. The most current version of this Policy will be posted at www.lizo.ai/privacy with the Effective Date updated accordingly.
For material changes — meaning changes that materially affect how lizo.ai collects, uses, or discloses Client Data or Authorized User Personal Information — lizo.ai will notify Clients via email to the designated account contact and/or by a prominent notice on the Platform dashboard at least thirty (30) days prior to the changes taking effect.
For Clients operating under a Master Subscription Agreement, any amendment to this Policy that materially and adversely reduces Client’s data protection rights shall require mutual written agreement between lizo.ai and the affected Client, notwithstanding the general amendment mechanism above. For purposes of this provision, “materially and adversely reduces” shall include, without limitation, changes to: (i) the categories of data collected; (ii) the purposes for which Client Data may be used; (iii) the data retention periods set forth in Section 8; (iv) the sub-processor authorization framework set forth in Section 4.1; or (v) the international transfer arrangements set forth in Section 9.
Continued use of the Platform after the effective date of any updated Policy constitutes acceptance of the revised terms, subject to the foregoing MSA provision.
When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.
For questions or concerns about this Policy or lizo.ai's privacy practices, or to exercise any rights described herein, please contact:
Lizo AI Ltd.
Attn: Privacy & Data Protection
Email: privacy@lizo.ai
Website: https://www.lizo.ai
Sub-Processor List: www.lizo.ai/sub-processors
Privacy Requests: www.lizo.ai/privacy-request