Privacy Policy
Effective May 24, 2026
The short version
ListingRoux is software for real-estate agents. We collect what we need to run the product, nothing for resale. The data you give us stays with us and the small set of vendors we use to operate the platform. Inquiries that come through an agent’s listing always go to that agent — we never sell, route, or repurpose them.
If you only read one section, read “Leads belong to the listing agent”.
Who we are
ListingRoux (“ListingRoux,” “we,” “us”) is operated by Voodoo Superposition LLC. We’re a software platform — not a real-estate brokerage and not a licensed agent. Listings are entered by the individual licensed agents who use the product.
Questions about anything in this policy: support@listingroux.com.
What we collect from agents
When an agent creates a ListingRoux account and uses the product, we collect:
- Account basics: email, password (hashed by our auth provider, not stored in plaintext), full name, phone number, license number and state, profile slug.
- Profile content: display name, headshot, bio, brand colors, current brokerage affiliation.
- Listing content: property addresses, photos, descriptions, pricing, open-house schedules, showing instructions, and anything else entered into the listing wizard.
- Notification preferences: which kinds of emails the agent has opted into.
- Payment metadata: a Stripe customer ID and the current subscription tier and status. Card numbers and billing addresses are handled by Stripe directly — ListingRoux never sees or stores them.
- Product usage: AI-generated post drafts, which posts were marked as used or discarded, when listings were published, lead activity tied to the agent’s listings.
What we collect from buyers
Buyer-side accounts are optional. Browsing listings and the public search page does not require an account. When a buyer signs in or saves a search, we collect:
- Email address — how we send magic-link sign-ins and saved- search digests.
- Name (optional) — if the buyer fills it in after first sign- in.
- Saved searches and favorites — the filter criteria and individual listings a buyer chose to save.
We don’t build buyer profiles for advertising and we don’t sell buyer data to anyone. Saved searches power the email digest the buyer asked for; favorites are a convenience feature; that’s the whole scope.
What we collect from anyone who visits the site
Visiting ListingRoux without signing in still produces some data, because operating a modern web product requires it:
- Server logs: the URL requested, your IP address, browser type, referrer, and timestamp. Used for security, abuse prevention, and debugging. Kept for 30 days by default at our hosting provider.
- Rate-limiting state: a temporary record of recent requests per IP, used to block scraping and abuse. Expires automatically within minutes to hours.
- Analytics: aggregate page-view and event data via Google Analytics 4. See Cookies & analytics below for what this collects and how to opt out.
- Listing-view counts: when you open an agent’s listing micro-site, we record an anonymized visit count (a one-way hash of your IP and browser, rotated daily, plus a coarse referrer bucket like “direct,” “search,” or “social”) so the listing agent can see how many people viewed their listings each week. We also record an approximate location (country, state, and city) inferred from your IP by our hosting provider (Vercel), used to tell agents which areas their listings are reaching — for example, “most of this week’s viewers came from Lafayette and Baton Rouge.” We don’t store your raw IP or the URL you came from, and we don’t set a cookie for this.
When someone submits a lead form on an agent’s listing, we collect what they chose to share: name, email, phone (optional), and a message. See “Leads belong to the listing agent”.
How we use what we collect
We use this data to:
- Run the product — render listings, deliver emails, process payments.
- Notify agents about activity on their own listings (leads, weekly digests, milestones).
- Deliver buyer-requested saved-search digests.
- Operate the platform safely — rate-limiting, abuse detection, debugging.
- Improve the product — aggregate usage patterns inform what to build next; AI post drafts and the agent’s edits to them inform future generation quality.
- Comply with applicable law and respond to lawful requests.
We don’t use the data for behavioral advertising, we don’t sell it to third parties, and we don’t share it with brokerages or MLSs.
Leads belong to the listing agent
This is a foundational principle of the product and worth stating directly. When a buyer fills out the inquiry form on a listing’s page, the resulting lead goes to the agent who listed that property. It is not:
- Sold or rented to other agents.
- Routed to a different agent because someone paid for better placement.
- Aggregated into a marketing list we resell.
- Shared with brokerages, MLSs, or third-party CRM products.
The lead lives in the listing agent’s dashboard. The agent decides what to do with it. If we ever change this, we will tell every affected agent in writing first — this is not a clause we will quietly soften.
Third-party processors
We use a small set of vendors to operate the platform. Each one processes specific data on our behalf under their own privacy and security commitments. The current list:
| Vendor | What they process |
|---|---|
| Supabase | Authentication, the application database, server-side functions. |
| Vercel | Hosting and the request/response edge layer. |
| Cloudflare R2 | Listing photos and their derived sizes. |
| Resend | Transactional email (lead alerts, digests, password resets, magic links). |
| Stripe | Subscription billing. Card data is collected by Stripe directly; we never see it. |
| Anthropic | AI post generation. Listing data is sent to the Claude API to produce post drafts. |
| Google Maps | Address autocomplete during the listing wizard and map rendering on the search page. |
| Google Analytics 4 | Aggregate site analytics. See the Cookies & analytics section. |
| Upstash | Rate-limiting state (recent requests per IP). |
Each vendor is bound to use the data only to provide the service to us. If we add a new processor that touches user data — or remove one — we update this table and the effective date at the top of this page.
Your choices and rights
Depending on where you live, you may have rights under laws like the GDPR or CCPA. Regardless of jurisdiction, here’s what we offer to everyone:
- Access: ask us what data we hold about you. For agents, most of it is visible in your dashboard already.
- Correction: agents can edit profile and listing data directly; buyers can update their name from the buyer dashboard. For anything you can’t edit yourself, email us.
- Deletion: ask us to delete your account and the data associated with it. Some records may be retained briefly for legal or financial reasons (for example, invoice records required by tax law).
- Marketing-email opt-out: every transactional email we send is tied to a product action you took; we don’t send marketing campaigns. Digest and alert emails have one-click unsubscribe links per RFC 8058.
- Analytics opt-out: see Cookies & analytics above.
To exercise any of these, email support@listingroux.com from the address tied to your account.
How long we keep things
- Agent accounts and listings: as long as the account is active, plus a short grace period after deletion in case of a recovery request.
- Leads: in the listing agent’s dashboard for as long as their account is active. Deletion of an agent account deletes the leads tied to it.
- Buyer saved searches: until the buyer unsubscribes or deletes them. Inactive saved searches with zero engagement may be pruned periodically.
- Server logs: ~30 days at our hosting provider.
- Billing records: as long as required by US tax and financial-record law (typically seven years).
Security
We use commonly-accepted technical and administrative measures to protect data: encrypted connections (TLS) for all traffic, encrypted-at-rest storage at our providers, hashed passwords (we never see your password in plaintext), least-privilege access controls on the database, and rate-limiting against abuse.
No system is perfectly secure. If we ever discover a breach affecting your data, we will notify you in accordance with applicable law.
International users
ListingRoux operates from the United States and our data processors store data on US-based infrastructure. If you use ListingRoux from outside the US, your data is transferred to the US. By using the product, you agree to that transfer.
Children
ListingRoux is not directed at children under 13 and we don’t knowingly collect data from them. If you believe a child has signed up, email us and we will delete the account.
Changes to this policy
We may update this policy as the product changes — for example, when a new data processor is added or a feature collects different data. Material changes will be announced via the product or via email to affected accounts before they take effect. The effective date at the top of the page always reflects the current version.
Contact
Privacy questions, deletion requests, anything in this policy that’s unclear: email support@listingroux.com.
