Privacy Policy
Effective date: [DATE] · Last updated: [DATE]
This Privacy Policy explains how [STOA LEGAL NAME] ("Stoa", "we", "us"), [ADDRESS], collects, uses, shares and protects personal information when you use ListLit and any other Stoa app or website that links to this policy (the "Service").
The short version
- We collect what we need to run the Service: your Google sign-in details, the listings, photos and branding you add, what you create, your purchases, and a small amount of usage and error information.
- We send your photos to AI providers only to make the videos and images you ask for.
- We do not sell your personal information, share it for targeted advertising, or use advertising trackers.
- You can export or delete your data in the app. After deletion, we keep your Google account ID and email to stop the same person from claiming another free campaign. Details in section 7.
1. Who this policy covers
The Service is for business use by adults (18+). It covers you if you are a customer or user of the Service, or a visitor to a public listing page a user published. It does not cover data our customers collect about their own clients outside the Service.
2. Information we collect
2.1 Information you give us
| Category | Examples | Where it comes from |
|---|---|---|
| Account and sign-in | Google account ID (the "subject" identifier), email address, name, whether Google verified the email | Google, when you sign in (scopes: openid, email, profile) |
| Email and password sign-in | Your email address and a salted, one-way hash of your password (PBKDF2). We never store your password itself. | You |
| Sign in with Apple | Apple account ID, email address (which may be an Apple "Hide My Email" relay address), and your name the first time you sign in | Apple, when you sign in |
| Branding and professional details | Your name, brokerage, phone, email, license line, brand color, logo, headshot, font choice | You |
| Listing information | Address, city, price, beds, baths, square feet, description, status, listing date, source link, source attribution and MLS disclaimer text | You, or the listing page or data feed you import from |
| Photos and media | Listing photos, headshots, logos, generated videos, posts, Stories, carousels and flyers | You, our AI providers (output) |
| Rights confirmations | The rights statement you confirmed, how (upload or import) and when | You |
| Purchases | Plan, billing interval, price, credits, order status, paid-through date, Stripe checkout, subscription and payment references | You and Stripe. We do not receive or store your full card number. |
| Messages and requests | Feedback, support messages, privacy requests | You |
One account per email. If you sign in with Google, with Apple or with a password using the same verified email address, they all open the same ListLit account.
2.2 Information collected automatically
| Category | What we keep | What we do not keep |
|---|---|---|
| Session cookie | A random sign-in token in a secure, HttpOnly cookie. We store only a hash of it, with your account ID, email, name, and created and expiry times (30 days). | |
| Sign-in flow cookie | A short-lived cookie (10 minutes) that protects the Google sign-in flow | |
| Email sign-in codes | A one-way hash of the 6-digit code we email when you create or reset a password. It works for 15 minutes and for at most five tries. | The code itself |
| Phone notifications | If you turn them on in the installed app: the push address your phone gives us and your time zone, so we can remind you about your listings at most once a day, in the daytime. Turn them off any time in the app or in your phone settings, and we delete the push address. | Notification contents. Our notifications carry no content; the app fetches it after you open it. |
| Funnel milestones | Up to fourteen setup and plan steps (for example "viewed plans", "opened checkout"), the plan and interval selected, and first and last time seen | Page contents, form values |
| Where you came from | The first marketing tags on the link that brought you (source, medium, campaign, content, term), a referral or creator code, the first page you landed on, and the name of the referring website (for example "l.instagram.com"). Kept with your account; the first visit is the one we keep. | Full URLs, other query parameters, other sites you visit |
| Two optional answers | What you want most from your listing marketing, and how you heard about ListLit, each picked from a fixed list | Free text |
| Agreement records | The version of the Terms you accepted and when; for memberships, the auto-renewal terms shown to you and when you agreed | |
| Error diagnostics | Error type, app area, browser family, and up to five code locations in our own scripts, at most 20 reports a day | Error messages, form contents, listing addresses, URLs with queries, screen recordings |
| Listing page view counts | A count of opens of each published page and the time of the last open. Link-preview bots and the agent's own visits are excluded. | Viewers' IP addresses, identities or cookies |
| Usage limits | Counts of address and listing searches per minute and day | The addresses you typed |
| Connection data | Our hosting provider (Cloudflare) and other providers process IP addresses, device and browser information to deliver and secure the Service | |
| Browser storage | Small preferences in your browser's local storage (for example, that you dismissed a prompt) |
We do not use advertising cookies, analytics pixels, session replay, or cross-site tracking.
2.3 Information about other people
Listing-page inquiries. When someone uses the "Interested in this home?" form on a published listing page, we collect the name, phone number or email address, and message they enter, and which listing page they used. We send it to the listing agent and store it in that agent's account, to be used only to reply about that home. We do not ask anything about who would live in the home. To limit abuse we count messages per network using a one-way hash of the IP address, not the address itself.
Listings and photos can include information about sellers, occupants or neighbors, such as a home address or a person visible in a photo. Customers are responsible for having the right to share it (see the Terms and the Photo Rights Policy). If you believe we hold your information because a customer uploaded it, contact us (section 12).
3. How we use information
| Purpose | Information used | Legal basis where one is required |
|---|---|---|
| Create and secure your account, keep you signed in | Account, session | Contract |
| Import listings and find photos you asked for | Addresses, listing links, search queries | Contract |
| Create videos, images and captions you request, including AI camera motion and automated scene checks | Photos, listing and branding details | Contract |
| Publish listing pages you choose to publish, and show you how many times they were opened | Listing, media, branding, view counts | Contract |
| Charge you, manage credits, renewals, refunds and taxes; send receipts, renewal reminders and billing notices | Purchases, email | Contract, legal obligation |
| Answer support and privacy requests | Messages, account | Contract, legal obligation |
| Improve setup and find broken steps | Funnel milestones, error diagnostics | Legitimate interest |
| Prevent fraud and abuse, including limiting the free first campaign to one per person and enforcing suspensions and repeat-infringer terminations | Google account ID, email, deletion records, usage counts | Legitimate interest, legal obligation |
| Comply with law, enforce our Terms, respond to legal process | Any, as needed | Legal obligation, legitimate interest |
We do not: sell personal information; "share" it for cross-context behavioral advertising; use your content to train our own AI models; use your content in our advertising without your separate permission; or make decisions with legal or similarly significant effects about you solely by automated means.
Email. We send transactional emails about your account, purchases, renewals and changes to our terms. If we send marketing emails, each will include an unsubscribe link and our postal address, and we will honor opt-outs within 10 business days. We do not send text messages.
4. Google user data
We use Google Sign-In only to identify you. We request the openid, email and profile scopes, which give us your Google account ID, email address, whether it is verified, and your name. We do not request access to your Gmail, Drive, Calendar, contacts or any other Google data.
We use this information only to create and secure your account, sign you in, contact you about the Service, and prevent abuse (including the one-free-campaign rule). We do not sell it, use it for advertising, or use it to train AI models, and we do not let people read it except with your consent, for security or abuse investigations, or to comply with law.
ListLit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Who we share information with
We share personal information only with the service providers below, who process it for us under contracts that limit their use, and as described in "Other disclosures".
| Provider | What it does for us | Information it receives | Location |
|---|---|---|---|
| Cloudflare, Inc. (Workers, D1 database, R2 storage) | Hosts the app, database and files; network security | All information in the Service | United States and Cloudflare's global network |
| Cloudflare Workers AI | Reviews reduced-size photos and sampled video frames to choose shots, crops and to check AI scenes | Photos and video frames only, with no account ID or listing text | Cloudflare network |
| Google LLC | Sign-in | Sign-in request; Google already holds your account | United States |
| Apple Inc. | Sign in with Apple | Sign-in request; Apple already holds your account | United States |
| Resend | Sends the 6-digit codes for email sign-in and password resets | Your email address and the code | See provider processing terms |
| Apple, Google and Mozilla push services | Deliver phone notifications you turn on | Your device's push address and an empty message, with no listing or personal content | Varies |
| Stripe, Inc. | Payments, subscriptions, receipts, fraud screening, tax | Your email, payment details you give Stripe, plan and price | United States |
| Resend (when transactional email is enabled) | Sends billing confirmations, cancellation notices and renewal reminders | Your account email, plan details, billing dates and notice content | See provider processing terms |
| Higgsfield and, through Higgsfield, Kling AI Pte. Ltd. (Singapore; Kling models are developed by Kuaishou) | AI video generation (camera motion) | Selected photos, uploaded to Higgsfield storage, and a fixed camera-motion instruction. We do not send your name, contact details, email or the listing address. | United States, Kazakhstan, Singapore and other countries where their vendors operate |
| Geoapify GmbH | Address suggestions while you type | The partial address text you type, sent from our servers (not your IP address) | Germany / EU |
| Tavily | Web search to find a listing's public page | The address you search, sent from our servers | |
| DuckDuckGo, Inc. | Backup web search when Tavily is unavailable | The address you search plus "real estate listing photos", sent from our servers | United States |
| SimplyRETS | MLS listing data feed | Listing number or address you search | United States |
| Listing websites you import from (for example Zillow, Realtor.com, Redfin, Compass, Windermere, OneKey MLS) | Source of the listing page and photos you asked to import | A request from our servers for that page and its photos | Varies |
| GitHub, Inc. | Stores encrypted database backups and runs scheduled maintenance | Encrypted backup files only; GitHub cannot read them without our key | United States |
| Google LLC (Google Drive) | Holds a separately retained encrypted recovery copy | Encrypted backup file only | United States |
| Healthchecks.io | Uptime monitoring | Success or failure signals only, no personal information | EU |
We list providers here so you can see where your data goes. We will update this list before adding a provider that receives personal information.
AI providers and training. We send photos to AI providers only to produce what you request. Our providers have their own terms, and you should know what they say:
- Higgsfield's current Terms of Use (updated July 26, 2026, §4.4) allow Higgsfield to use content, inputs and outputs submitted through its service to train and improve its and its affiliates' AI models, unless a separate enterprise agreement says otherwise, and say content already used for training cannot be removed from trained models.
- Kling's User Policy (April 21, 2026, §4.7.3) likewise allows Kling to use submitted content to train its models.
- Cloudflare Workers AI does not use customer content to train AI models.
- Tavily says it may use portions of search queries to improve its results. We send it only the address you searched.
- Geoapify keeps request logs for no longer than 24 hours.
This means photos you send for AI video may be used by Higgsfield and Kling to train their models. If you do not want your photos sent to those providers, do not use ListLit's AI video features.
Public listing pages. When you publish a listing page, the property details, photos, video, and your name, brokerage, phone, license line and headshot are visible to anyone with the link, and may be indexed by search engines. Copies others download are outside our control.
Other disclosures. We may disclose information: to comply with law, a subpoena or court order; to protect the rights, safety and property of users, the public or Stoa; to investigate fraud or security issues; with your consent; and to a buyer or successor in a merger, acquisition, financing or sale of assets, subject to this policy.
6. How long we keep information
| Information | How long |
|---|---|
| Account, listings, photos, videos, designs, branding, rights confirmations | While your account is open, until you delete the item or your account |
| Published listing page snapshot and its view count | Until you unpublish it or delete your account |
| Sign-in sessions | Expire after 30 days; all sessions are deleted when you delete your account |
| Email sign-in codes | Deleted when used or replaced; they stop working after 15 minutes |
| Listing-page inquiries | In the agent's account until the agent deletes their account |
| Phone notification push addresses | Until you turn notifications off, the push service reports the address is gone, or you delete your account |
| Funnel milestones | Deleted automatically 90 days after their last update |
| Error diagnostics | Deleted automatically 30 days after their last update |
| Credits, orders and billing records in ListLit | Until you delete your account |
| Records of your consent to automatic renewal (the text shown, time, IP address, order) | At least 3 years, or 1 year after the membership ends if longer, even after account deletion, because the law requires it |
| Support messages and privacy requests | Until resolved, then [12 months], or until account deletion if sooner, except records of privacy requests we must keep for [24 months] |
| After you delete your account: Google account ID, email address, and the date the account was created | Kept for abuse prevention, as long as the Service operates. See section 7. |
| After you delete your account: an internal account number and the dates of the deletion request and completion | Kept as a record that the deletion happened and to block restoring deleted data from backups |
| Encrypted backups (GitHub) | Expire automatically after 30 days (recovery rehearsal copies after 90 days) |
| Encrypted recovery copy (Google Drive) | Reviewed and removed by us within [90] days |
| Records providers keep | Under their own policies and legal duties (for example Stripe's payment records) |
7. Deleting your account, and what we keep afterward
You can delete your account in the app (Account → Delete account, or /account-deletion). First cancel any membership and wait for its paid period to end, and let processing videos finish. Deletion then:
- unpublishes your listing pages immediately;
- deletes your photos, videos and files from our storage;
- deletes your listings, designs, branding, credits, orders, feedback, milestones and diagnostics;
- signs you out on every device.
Copies in encrypted backups expire on the schedule in section 6. We do not restore deleted accounts from backups.
What we keep, and why. To prevent abuse of our free first campaign and to enforce suspensions and repeat-infringer terminations, we keep your Google account ID and the email address linked to it after deletion, together with an internal account number and the deletion dates. We use this record only to recognize the same Google account if it signs in again, and for no other purpose. It is not used for marketing, not shared except with our hosting provider, and not sold. As a result, the same Google account cannot be used to open a new ListLit account or claim another free campaign.
If you also signed in with Apple or with an email and password, we keep those sign-in identifiers (your Apple account ID or your email address) for the same reason. We delete your password hash.
8. Your choices and rights
In the app you can: view and edit your branding and listings; download your media; export your account data (Account → Export account data); unpublish listing pages; cancel renewal; and delete your account.
Requests. You can also ask us to access, correct, delete, or give you a copy of your personal information, or ask about how we use it, by using Account → Feedback → Privacy request, or emailing [PRIVACY EMAIL]. We will verify your request by confirming it comes from the email on your Google-authenticated account. An authorized agent may make a request for you with your signed permission. We respond within 45 days and tell you if we need more time. We will not treat you differently for exercising a right.
State privacy rights. Depending on where you live, you may have additional rights under state law, such as the right to know, delete, correct, obtain a copy of, and opt out of the sale or sharing of personal information or of targeted advertising and profiling, and to appeal our decision on a request. We do not sell or share personal information for targeted advertising, and we do not profile people in ways that produce legal or similarly significant effects. If we decline your request, you may appeal by replying to our decision with "Appeal"; we will answer within 60 days.
California (CalOPPA). You can review and request changes to your information as described above. We will post changes to this policy as described in section 11.
Do Not Track. Our Service does not respond differently to browser "Do Not Track" signals, because we do not track users across third-party websites or services, and we do not allow third parties to collect personal information about your online activities over time and across different websites through our Service.
9. Cookies
We use only cookies needed to run the Service: a sign-in session cookie (30 days) and a sign-in flow cookie (10 minutes). Both are first-party, secure and HttpOnly. We do not use advertising or analytics cookies. Stripe sets its own cookies on its checkout pages to process payments and prevent fraud, under Stripe's privacy policy.
10. Security
We protect information with measures appropriate to its sensitivity, including: encryption in transit (HTTPS); storing only hashes of session tokens; secure, HttpOnly, SameSite cookies; restricting account data to the account that created it; server-side access checks; keeping payment card data with Stripe instead of our systems; encrypted backups; limited staff access; and monitoring. No system is perfectly secure.
If there is a breach. If we discover a breach of security that exposes your personal information, we will notify you and the regulators the law requires (for example, under New York General Business Law §899-aa) without unreasonable delay, and within any deadline the law sets.
11. Children
The Service is not directed to children and is only for adults using it in their work. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.
12. Changes to this policy
We will post any change here with a new "Last updated" date. If a change is material, we will tell you by email or in the app before it applies. We will not use information we already collected in a materially different way without your consent where the law requires it.
13. Contact
[STOA LEGAL NAME] [ADDRESS] Privacy requests: [PRIVACY EMAIL] or in the app (Account → Feedback → Privacy request) Support: [SUPPORT EMAIL]