GDPR & data protection

The General Data Protection Regulation (GDPR) and the UK GDPR give individuals in the EU, EEA, and UK specific rights over their personal data. This page explains how those rights apply when Lytle.ai is used by a US real estate agent to engage a contact who lives in one of those regions.

• Agent / brokerage — acts as the data controller for the leads they add and engage.
• Lytle.ai — acts as the data processor, handling data on behalf of the agent under a Data Processing Agreement (DPA), available on request.

• Contract — to provide the service to agent-users who subscribe.
• Consent — for outbound AI messages initiated to a lead, and for optional analytics cookies.
• Legitimate interests — for fraud prevention, security, and product improvement, balanced against user rights.

• Access — request a copy of your personal data.
• Rectification — correct inaccurate data.
• Erasure — request deletion ("right to be forgotten").
• Restriction — pause processing while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, without affecting prior lawful processing.

To exercise any of these rights, email privacy@lytle.ai. We verify your identity and respond within 30 days.

Lytle.ai is operated from the United States. When personal data is transferred from the EU/EEA/UK to the US, we rely on the Standard Contractual Clauses (SCCs) and the UK IDTA, and we apply supplementary technical and organizational safeguards.

We rely on a limited set of vetted subprocessors for hosting, database, email delivery, payments, and AI inference. A current subprocessor list is available on request from privacy@lytle.ai. We notify controllers of material changes.

For GDPR inquiries, DPA requests, or to raise a complaint, contact privacy@lytle.ai. EU/UK residents also have the right to lodge a complaint with their local supervisory authority.