ListOnce
Draft, pending review by counsel. Not yet in effect.

Privacy policy

What ListOnce, run by Molluso Holdings LLC, collects, why, who processes it, how long it is kept, and how to have it deleted.

What we collect

Accounts
Sign-in email, name, the organizations you belong to and your role, when you last signed in
Until you or your organization asks us to delete it
Sign-in links and sessions
Stored only as one way hashes, with times created, last seen and ended
Links: deleted a day after they expire. Sessions: until the account is deleted
Two-step sign-in
Your authenticator secret (encrypted) and recovery codes (hashed)
Until you turn it off or the account is deleted
Listings
Address, price, property details, remarks, photos, agent and office names, the seller's name and visibility choice, and a history of every change naming who made it
As long as the listing brokerage keeps the listing; history is append only
Join applications
Brokerage, license number, state, number of agents, contact name, email and role
Until decided and then as a record of the decision, or until deleted on request
Pitch deck viewers
The name and email typed to open a deck, held in a signed cookie in your browser and sent to our internal Slack with which slides were viewed
Cookie: 30 days. Slack: per our Slack retention
Abuse limits
Counters keyed by a hash of an email address or IP address, never the raw value
Deleted after one day
Members only access log
Which marked copy was read, through which channel, by the minute; no IP addresses
As long as the listing
Security history
Two-step changes, key rotations, deletions and deletion requests, by account id, never by name or email
Kept as an audit record

The demo at /app keeps its sample data in your own browser and never sends it to us.

Why we use it

  • To run the service: sign you in, deliver listings where the listing brokerage and seller chose, and send the emails the service needs (sign-in links, invitations, confirmations).
  • To keep it safe: rate limits, audit history, tracing leaked members only copies.
  • To follow up with people who asked to see our pitch decks.

We do not sell personal information and do not use it for advertising.

Who processes it for us

Supabase (database and photo storage, AWS us-east-1), Vercel (hosting, US), Postmark (email, US), Anthropic (when you use AI intake, the document or text is sent to it to read; we store none of it unless you save the listing; US), Slack (internal notifications, US) and Google Fonts (typeface on the decks). The Trust page lists what each one handles.

Listings and sellers

Listing data belongs to the listing brokerage, which decides what to enter and is responsible for having the seller's permission. Publicly marketed listings go to the destinations the brokerage's rules allow; members only listings go only to member brokerages, as marked copies. Seller names are never sent to home search sites or data feeds.

Deleting your data

Ask at privacy@listonce.io. Deleting a person removes their account, memberships, sessions, sign-in links, recovery codes and join applications, and revokes API keys they created. Names already written into a listing's change history stay, because that history is append only and belongs to the listing brokerage. An organization's admin can ask from Settings for all of its data to be deleted; we confirm with them before anything is removed. Backups age out within 7 days.

Changes

We will post changes here with a new date and tell account holders by email before a change that affects them takes effect.