Privacy Policy

1. Introduction

Welcome to ListingRocket ("we," "our," or "us"), operated from Ontario, Canada. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information globally, in compliance with major privacy regulations including PIPEDA (Canada), CCPA (USA), GDPR (EU/UK), and the Privacy Act (Australia).

2. Information We Collect

• Personal Information: Name, email address, phone number, and billing information when you register or make a purchase.
• Property Data: Addresses, property descriptions, and photos you upload for AI analysis and marketing generation.
• Social Media Data: When you connect Instagram or Facebook, we receive your platform user ID, account name, and access token (encrypted with AES-256-GCM). We do not access your direct messages, followers, or other private social data.
• Usage Data: Information about how you interact with our services, including IP address (hashed), browser type, and device information.
• Cookie Preferences: Your cookie consent choices stored locally in your browser.
• Referral Data: Referral codes used during registration.

3. How We Use Your Information & Legal Basis

We process your data for the following purposes, relying on valid legal bases (such as the performance of a contract, your consent, or our legitimate interests):

• Provide, operate, and maintain our AI services (Performance of Contract).
• Process secure billing and generate property websites (Performance of Contract).
• Post to your connected social media accounts when you request it (Performance of Contract).
• Improve and personalize our web experience (Legitimate Interest).
• Communicate with you for customer support (Legitimate Interest).
• Analytics tracking to understand site usage, only with your consent (Consent).

4. AI and Third-Party Data Processing

Our services utilize the following third-party AI providers to generate real estate marketing content:

• Google Gemini (primary) — text and vision analysis
• Groq (fallback) — text generation
• OpenRouter (fallback) — text generation
• Google Veo — video generation

Data sent to AI providers includes: property addresses, feature descriptions, and uploaded photos for vision analysis. No personally identifiable information (name, email, phone) is included in AI prompts.

We have strict agreements in place: we do not allow third-party AI providers to use your data to train their public underlying foundation models.

5. Cookie Policy

We use cookies in three categories:

You can manage your preferences at any time via the cookie banner or by clearing your browser's localStorage. Consent choices are stored locally in your browser under the key lr-cookie-consent.

6. Social Media Data

When you connect your Instagram or Facebook account, we receive and store:

• Platform user ID and account name
• Access token (encrypted with AES-256-GCM, decrypted only server-side during posting)
• Page tokens for Facebook Page posting (if applicable)

Tokens are used solely for posting content when you explicitly initiate a post. You can revoke access and disconnect your accounts at any time via Dashboard → Settings. We do not read your direct messages, follower lists, or any private social data beyond what is required for posting.

7. Data Retention Schedule

8. Data Export & Account Deletion

You can export all your data as a JSON file via Dashboard → Settings → Account. The export includes your profile, listings, purchases, tokens, social accounts (excluding encrypted tokens), and post history.

You can permanently delete your account and all associated data via the same page. Deletion is irreversible and processed immediately. All related records (listings, photos, videos, social accounts, tokens, subscriptions) are permanently removed.

9. Your Privacy Rights by Region

Canada (PIPEDA)

You have the right to access your personal information and request corrections. Data may be transferred to and processed on servers located in the US/EU, where it may be subject to the laws of those jurisdictions. We ensure appropriate safeguards are in place for any cross-border data transfers.

European Union & United Kingdom (GDPR / UK GDPR)

If you reside in the EEA or UK, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data ("Right to be Forgotten").
• Object to processing or request data portability.

United States (CCPA/CPRA & State Laws)

California residents and residents of applicable states have the right to request disclosure of the categories of data we collect. Notice of Sale: ListingRocket does not sell your personal information to third parties.

Australia (Privacy Act 1988)

We adhere to the Australian Privacy Principles (APPs). You may access or correct your personal information, or lodge a privacy complaint if you believe we have breached the APPs, by contacting us using the details below.

10. Data Security

We implement industry-standard technical and organizational security measures to protect your data, including: encryption at rest and in transit (TLS 1.2+), AES-256-GCM encryption for sensitive tokens, parameterized database queries, input validation on all API boundaries, rate limiting on all public endpoints, and security headers on all responses.

11. Contact Us & Exercising Your Rights

To exercise any of your privacy rights, or if you have questions about this policy, please contact our Data Protection Officer at: [email protected]. We will respond to all legitimate requests within the timeframe required by your local applicable laws.