DRAFT — FOR ATTORNEY REVIEW. This document is a starting template and is not legal advice. Replace every [bracketed] item and have qualified counsel review before publishing. Last updated: [Month Day, Year].
This Privacy Policy explains how [Company Legal Name] (“ListingKit,” “we,” “us”) collects, uses and shares personal information when you visit listingkit.com, use our application, or interact with pages our customers create with ListingKit (such as property pages and open house sign-in forms). ListingKit operates only in the United States and is not directed to anyone outside the U.S.
Two roles we play
- For our customers (agents) and website visitors, we decide how personal information is used, and this policy applies directly.
- For our customers’ contacts — open house visitors, past clients, photographers and others whose information an agent stores in ListingKit — we act as a service provider/processor to that agent. The agent controls that information and their own privacy notice applies. We use it only to provide the Service to that agent, as described in our Agent Data Processing Terms. If you’re one of those people and want to exercise rights, contact the agent; you can also contact us and we’ll forward your request.
Information we collect
- Account and profile: name, email, phone, password (hashed), license number and state, brokerage, office address, headshot, logos, website and social profile links.
- Billing: plan, billing status and limited payment details from Stripe (e.g., card brand and last four). We never receive or store full card numbers.
- Content you add: listing details, photos, documents you import, contacts, email templates and messages.
- Open house sign-ins (for agents): name, email, phone, whether the visitor is working with an agent, optional feedback, and whether they agreed to follow-up.
- Free Visibility Check: name, email, city, state, license number, brokerage, website and profile links you submit, plus the results of the check.
- Device and usage data: IP address, browser and device type, pages viewed, referring URLs, and approximate location derived from IP; collected through cookies and similar technologies (see our Cookie Policy).
- Communications: support emails and replies.
- Publicly available information: for our own outreach, we may collect professional contact and business information that real estate professionals publish (e.g., brokerage rosters, professional websites) and publicly available signals about online presence (e.g., Google Business Profile ratings).
How we use information
- Provide, secure and maintain the Service (including generating materials, hosting pages, sending emails you approve, and processing payments).
- Send transactional messages (account, billing, security, upload notifications).
- Send marketing messages about ListingKit where permitted, always with an opt-out.
- Measure and improve the Service and our advertising (analytics and ad measurement, subject to your cookie choices).
- Prevent fraud and abuse, enforce our terms, and comply with law.
- Generate AI-assisted content you request. We send only the data needed for that request to our AI provider, and we do not permit providers to train their models on your data [Counsel/Ops: confirm vendor terms].
How we share information
- Service providers who process data on our behalf: hosting ([Kinsta/Google Cloud]), CDN/security ([Cloudflare]), payments (Stripe), email delivery ([Brevo]), AI processing ([Anthropic]), mapping and business data (Google), MLS data platforms you or your broker authorize, and analytics/advertising partners (Google Analytics, Google Ads, Meta) subject to your choices.
- As you direct: e.g., publishing a property page, sharing a seller report link, or sending emails to your contacts.
- Legal and safety: to comply with law, respond to lawful requests, or protect rights and safety.
- Business transfers: in a merger, acquisition or sale of assets.
We do not sell personal information for money. Our use of advertising cookies and pixels (Meta Pixel, Google Ads) may be considered “selling” or “sharing” for cross-context behavioral advertising under some state laws. You can opt out at any time — see Your Privacy Choices. We honor Global Privacy Control (GPC) signals.
Retention
We keep account information while your account is active and for [X] days after closure, unless longer retention is required for legal, tax, accounting or security purposes (e.g., billing records for [7] years). Open house sign-ins, contacts and other customer content are kept until the agent deletes them or closes their account, then deleted within [30–90] days, except backups which expire on a rolling basis within [30] days. Suppression (unsubscribe) records are kept so we can continue to honor opt-outs. [Counsel: finalize schedule.]
Security
We use reasonable administrative, technical and physical safeguards, including encryption in transit, access controls and private, expiring links for uploads. No method of transmission or storage is 100% secure.
Your choices
- Marketing email: use the unsubscribe link in any message.
- Cookies and ads: use the “Cookie settings” link in our footer or enable GPC in your browser.
- Account data: agents can download their data and request deletion in Account & privacy settings.
U.S. state privacy rights
Depending on your state of residence (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others with comprehensive privacy laws), you may have the right to: know/access the personal information we hold about you; correct inaccuracies; delete it; obtain a portable copy; opt out of the sale or sharing of personal information and of targeted advertising; and opt out of certain profiling. You may also appeal our decision on your request. We will not discriminate against you for exercising these rights. [Counsel: confirm which laws apply based on thresholds.]
How to submit a request: email [privacy email] or use Your Privacy Choices. We will verify your request using information associated with your account or interaction. You may use an authorized agent with your signed permission. If we deny your request, you may appeal by replying to our decision with “Appeal” in the subject line.
California notice at collection and disclosures
In the past 12 months we collected the following categories of personal information under the California Consumer Privacy Act (as amended by the CPRA): identifiers; customer records; commercial information; internet or network activity; geolocation (approximate); professional or employment-related information (license and brokerage); audio/visual information (photos); and inferences (e.g., visibility scores). Sources, purposes and recipients are described above. We may “share” identifiers and internet activity with advertising partners for cross-context behavioral advertising; you may opt out. We do not use or disclose sensitive personal information for purposes requiring a right to limit. We do not knowingly sell or share personal information of consumers under 16. Retention is described above.
Shine the Light: California residents may request information about disclosures of personal information to third parties for their direct marketing purposes by contacting [privacy email]. [Counsel: confirm applicability.]
Children
The Service is for licensed professionals and is not directed to children under 13 (or under 16 where applicable). We do not knowingly collect their personal information.
Changes and contact
We will post changes here and update the date above; material changes will be communicated by email or in-app. Contact: [Company Legal Name], [Mailing Address], [privacy email].