Listserved Privacy Policy

1. Introduction

Dallas TechSaaS Foundry LLC ("Company," "we," "us," or "our") operates Listserved ("Service"), a commercial real estate (CRE) deal management platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Organization name
• Password (stored in hashed form)

2.2 Email Data

When you forward or connect emails to the Service, we collect:

• Email content, subject lines, and sender information
• Attachments (including PDF documents)
• Deal information extracted from emails using artificial intelligence

2.3 Payment Information

Payment processing is handled by Stripe. We do not store your credit card numbers or bank account details. We receive and store transaction records, subscription status, and billing history from Stripe.

2.4 Usage Data

We automatically collect:

• Log data (IP address, browser type, pages visited)
• Feature usage and interaction data
• Device and browser information

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process and extract deal information from forwarded emails using AI
• Match deals against your defined criteria ("Buy Boxes") and send alerts
• Process payments and manage subscriptions
• Send transactional communications (account verification, password resets, billing notifications)
• Improve and optimize the Service
• Respond to support requests

4. Third-Party Services

We use the following third-party services to operate the platform:

• Supabase — hosting, authentication, and database
• Stripe — payment processing and subscription management
• Google Maps Platform — property geocoding and mapping
• Google Gmail API — email ingestion (when connected by the user)
• xAI (Grok) — AI-based email processing and deal extraction
• Google Gemini — AI-based enrichment, research, and embeddings
• Postmark — inbound email routing and delivery
• Resend — transactional email delivery (invitations, alerts)

Each third-party service processes data in accordance with their own privacy policies. We only share the minimum data necessary for each service to perform its function.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share information in the following circumstances:

• Service Providers: with the third-party services listed above, solely to operate the platform
• Organization Members: with other members of your organization, as the Service is multi-tenant and organization-scoped
• Legal Requirements: if required by law, regulation, legal process, or governmental request
• Business Transfers: in connection with a merger, acquisition, or sale of assets, with notice to affected users

6. Data Retention

• Your data is retained for as long as your account is active
• Upon account deletion, your data is retained for 90 days (to allow for recovery), after which it is permanently deleted
• You may request data export at any time through the account settings
• Payment records may be retained longer as required by applicable tax and accounting laws

7. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS/HTTPS)
• Row-level security (RLS) policies ensuring organization-level data isolation
• Authentication and session management via Supabase Auth
• Optional two-factor authentication (TOTP-based MFA)

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Your Rights

You have the right to:

• Access: request a copy of the data we hold about you
• Export: download your organization's data through the account settings
• Correction: update or correct your personal information
• Deletion: delete your account and associated data
• Objection: object to certain processing of your information

To exercise any of these rights, contact us at support@listserved.com.

9. Google API Services — Limited Use Disclosure

Listserved's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only access Google user data that is necessary to provide the Service (email ingestion and processing)
• We do not use Google user data for advertising purposes
• We do not allow humans to read your Google user data unless: (a) we have your explicit consent, (b) it is necessary for security purposes (e.g., investigating abuse), (c) it is necessary to comply with applicable law, or (d) our use is limited to internal operations and the data has been aggregated and anonymized
• We do not transfer Google user data to third parties except as necessary to provide the Service, as required by law, or with your explicit consent

10. Cookies

We use essential cookies for authentication and session management. These cookies are necessary for the Service to function and cannot be disabled. We do not use third-party advertising or tracking cookies.

11. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will take steps to delete that information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Information

For questions about this Privacy Policy:

Email: support@listserved.com

Mailing Address:
Dallas TechSaaS Foundry LLC
6223 Twin Oaks Cir
Dallas, TX 75240