FCRA Disclosure

This Fair Credit Reporting Act (FCRA) Disclosure explains how the Cio behavioral scoring system operates, what role Ciosanna and our Customers (property managers and similar businesses that use the Service) each play, and what rights Residents and applicants have when a Cio Score is used as a factor in a tenant screening, credit, or other housing decision.

The Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., is the federal law that governs the use of consumer reports in housing, credit, employment, and similar decisions. This Disclosure explains how the FCRA may apply to the Cio Score and what Ciosanna does and does not do under the FCRA.

This Disclosure is part of our legal framework alongside the Privacy Policy and Terms of Service. Section 10 of the Privacy Policy describes the Cio scoring system and your automated-decision rights in detail, and Section 9 of the Terms of Service sets out our scoring disclaimers and the obligations of Customers. Where this Disclosure overlaps with those documents, all three should be read together.

For questions about this Disclosure or the Cio Score, contact us at support@ciosanna.com. To submit a formal dispute or other rights request, see Section 7 below or use our privacy request form at /legal/privacy-request.

The Cio Score is a numeric indicator generated by the Cio behavioral scoring system that reflects patterns in a Resident's interactions on the Service. The score ranges from 300 to 850, with a starting baseline of 650 for new Residents, and is recalculated as new events are recorded.

The Cio Score, as Ciosanna generates and stores it, is not by itself a consumer report or a credit score, and Ciosanna is not a consumer reporting agency as defined in the FCRA. The score is derived only from a Resident's own interactions on the Service — such as ledger history, communication responsiveness, maintenance behavior, and lease compliance events — and is intended as an internal customer-service indicator.

The FCRA may apply when a Customer uses the Cio Score as a factor in a tenant screening, credit, or other FCRA-covered decision. In that situation the Customer is responsible for FCRA compliance, including obtaining required consents, providing the disclosures described in this document, and operating a 30-day dispute process. Ciosanna provides tooling to help Customers meet these obligations but does not itself decide whether the FCRA applies to a given use.

The Cio Score is calculated from four categories of behavioral data recorded as the Resident uses the Service:

• Payment history — on-time, late, or missed payments to the ledger
• Communication responsiveness — response time to messages and notices
• Maintenance behavior — how maintenance requests are submitted, completed, and followed up
• Lease compliance events — notices, violations, and similar lease-related events

The Cio Score is not calculated from any protected-class attribute. Race, color, national origin, religion, sex, familial status, disability, age, source of income, and similar attributes are not inputs to the score and are not used by the scoring system to weight, adjust, or modify the score in any way.

The Cio Score ranges from 300 (lowest) to 850 (highest). New Residents begin at a baseline of 650. The score is designed to move up or down over time as events are recorded — favorable events increase it, unfavorable events decrease it.

The Cio Score is recalculated whenever a scoring event is recorded. Recalculations occur continuously as new events occur, not on a fixed schedule. Older events fall out of the calculation after seven (7) years, consistent with the retention policy described in Section 7 below.

Ciosanna uses the Cio Score internally as a customer-service indicator — for example, to surface patterns in resident interactions to the Customer's staff, to inform optional rewards programs, and to support the Customer's day-to-day property operations. This internal use does not by itself trigger the FCRA.

A Customer may, at the Customer's discretion and subject to applicable law, choose to use the Cio Score as one factor in a tenant screening, lease renewal, or similar housing decision. When a Customer does so, the Customer is using the Cio Score as a consumer report for purposes of the FCRA and assumes the obligations described in Section 6 below, including the obligation to provide an adverse action notice if a decision is adverse to the Resident or applicant.

The Cio Score is decision-support only. A Customer must apply meaningful human review before any housing decision that relies on the score, and the Customer must not delegate adverse housing decisions to the score or to Cio. Ciosanna does not make final housing decisions and does not authorize the use of the Cio Score as the sole basis for any decision affecting a Resident, applicant, owner, or vendor.

If you are a Resident with a Cio Score, you may view your current score at any time through the resident portal. The portal also shows the events that have contributed to your score, organized by category.

You may dispute any scoring event that you believe is inaccurate or incomplete by submitting a dispute through the resident portal. The Customer is required to investigate the dispute within thirty (30) days. If the dispute is upheld, the event is removed and your score is recalculated. If the dispute is denied, you will receive a written explanation and the right to add a statement to the disputed event. The dispute process is described in more detail in Section 6 below.

If a Customer denies your application, declines to renew your lease, or takes other adverse action against you that was based in whole or in part on the Cio Score, the Customer is required to provide you with an adverse action notice within thirty (30) days. The notice must identify the score that was used, the principal factors that lowered the score, your right to dispute the score, and contact information for both Ciosanna and the Customer.

After receiving an adverse action notice, you have the right to request a free copy of the score report that was used in the decision. You may request this report by contacting support@ciosanna.com within sixty (60) days of receiving the adverse action notice.

You may opt out of the Cio Score and request deletion of your scoring data at any time. Because some scoring data must be retained to comply with the FCRA and other applicable law, deletion is implemented by pseudonymization — your identifying information is removed from the scoring record, while a de-identified record is retained for the period described in Section 7. After opt-out, a cooling period applies before you may opt back in, as described in your scoring consent.

A Customer is required to issue an adverse action notice when the Customer takes adverse action against a Resident or applicant — for example, denying an application, declining to renew a lease, or imposing materially less favorable terms — and the Cio Score was a factor in that decision. The notice obligation applies even if the Cio Score was only one of several factors considered.

An adverse action notice must include:

• The Cio Score that was used in the decision
• The principal factors that contributed to lowering the score
• A statement that the Resident or applicant has the right to dispute the score
• Contact information for Ciosanna (support@ciosanna.com) together with a statement that Ciosanna did not make the underlying housing decision
• Contact information for the Customer who made the decision

The adverse action notice must be provided to the Resident or applicant within thirty (30) days of the adverse decision. Ciosanna provides tooling that helps Customers generate adverse action notices automatically when a denial is recorded in the Service, but the Customer remains responsible for delivery and content.

If you believe a scoring event is inaccurate or incomplete, you may file a dispute through the resident portal. The dispute should identify the specific event being disputed and the reason you believe it is inaccurate or incomplete. There is no charge to file a dispute.

The Customer is required to investigate the dispute within thirty (30) days of receipt. During the investigation the disputed event is marked as such on your score report. If the dispute is upheld, the event is removed and your score is recalculated immediately. If the dispute is denied, you will receive a written explanation, and you have the right to add a statement of up to one hundred (100) words to the disputed event, which will be visible alongside it. If the Customer does not complete the investigation within thirty (30) days, the dispute is automatically upheld and the event is removed.

Ciosanna maintains reasonable procedures to support the accuracy of scoring data, including validation of events at the time they are recorded, the dispute process described in Section 6, and an audit log of every scoring event and recalculation. Customers are required to validate events recorded under their account and to investigate disputes promptly.

Scoring data is retained for seven (7) years from the date of the event. After seven years the event is removed from the active score calculation but the record may be retained in a de-identified form for audit and compliance purposes. When a Resident requests deletion of their scoring data, the data is pseudonymized — identifying information is removed and the de-identified record is retained for the period described in this Section.

For questions about this Disclosure, the Cio Score, or your rights under the FCRA, contact support@ciosanna.com. To submit a formal dispute or request a free score report after an adverse action, use the resident portal or the privacy request form at /legal/privacy-request. We will respond to FCRA-related requests within thirty (30) days of receipt.

If you believe Ciosanna or a Customer has not complied with the FCRA, you may file a complaint with the federal Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov, with the Federal Trade Commission (FTC) at ftc.gov, or with your state attorney general's office. You may also have additional rights under your state's consumer protection laws.