Privacy Policy

1. Introduction & Scope

InFlux LLC (“Listing Nav,” “we,” “us,” or “our”) operates the Listing Nav platform at listingnav.com. This Privacy Policy describes how we collect, use, share, and protect your personal information when you use our platform.

This policy applies to all users of Listing Nav, including:

• Property seekers who browse listings and submit inquiries
• Agents and brokerages who create tenant sites to list properties
• Site visitors who access any page on the platform

Listing Nav acts as a data processor for lead and inquiry data collected through tenant sites, and as a data controller for account and platform-level data.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, password (hashed with bcrypt — we never store plaintext passwords), and optionally your phone number.

Business Information (Agents & Brokerages)

If you sign up as an agent or brokerage, we also collect your company name, chosen URL slug, and real estate sector preference.

Payment Information

Payment processing is handled by Stripe. We never receive or store raw credit card numbers. We store only Stripe customer IDs and subscription IDs to manage your billing relationship.

Property Data

Property listings include addresses, descriptions, photos, geographic coordinates (latitude/longitude), and pricing information.

Lead & Inquiry Data

When visitors submit inquiries through tenant sites, we collect their name, email address, phone number, company name, and message content.

Where an inquiry form asks whether the business may contact you by automated telephone call or text message, we also record your answer, the exact consent wording you were shown, and the date, time, IP address, and browser at the moment you answered. We keep this with the inquiry so that we, and the business you contacted, can show precisely what you agreed to and when. Answering “no” is recorded the same way, and is never a condition of sending your message.

Technical Data

We collect IP addresses and user agent strings for the following purposes:

• Rate limiting on public-facing forms
• Terms of Service and Privacy Policy acceptance audit records
• Property listing attestation audit records (recorded each time you create or update a listing)
• Security audit logging (login, logout, signup, password changes, email verification events)
• Evidence of your answer to a call-and-text consent question on an inquiry form, stored with that inquiry

Uploaded Content

Images and files you upload are stored on Vercel Blob (cloud storage) in production or local storage during development.

Browsing Data

On a tenant’s own website — whether you reach it at listingnav.com/their-name or on their own domain — no advertising pixel loads at all. Browsing an agent’s listings on their site is not tracked for advertising, and no advertising cookie is set.

On our own marketing pages — the Listing Nav homepage, our plan pages for agents, brokerages, lenders and affiliates, and our get-started, contact and signup pages — we use the Meta Pixel to measure how well our advertising works. It records the page you viewed, that a plan page was read, that you requested a demo, and that a signup completed, along with the IP address and browser your request carried. We never send Meta your name, email address, phone number, or any account identifier.

The product tour video on our homepage and our agent plan page is hosted on YouTube and does not load until you press play. Until then you are looking at a still image served from our own servers, and nothing about your visit reaches YouTube or Google. If you press play, they receive your IP address, your browser, and the page you played from.

You can switch advertising measurement off at any time in Your Privacy Choices, and we honour Global Privacy Control signals automatically. We also use Vercel’s traffic analytics across the platform, which is cookieless and does not identify you or follow you to other websites. Aside from these, we collect only the technical data necessary for rate limiting (IP address) when you submit forms.

3. How We Use Information

We use the information we collect for the following purposes:

• Service delivery — operating the platform, displaying property listings, and connecting seekers with agents
• Authentication — verifying your identity and managing account access
• Payment processing — managing subscriptions and billing through Stripe
• Lead forwarding — delivering inquiry data to the tenant (agent/brokerage) whose site received the inquiry
• System notifications — sending emails for password resets, team invitations, and lead alerts
• Rate limiting — preventing abuse by limiting form submissions per IP address
• Platform improvement — understanding usage patterns to improve features and performance

We do not use your property listings, lead data, or personal information to train artificial intelligence or machine learning models.

4. How We Share Information

We share information only in the following circumstances:

• With tenants — Lead inquiry data is shared with the tenant (agent or brokerage) whose site received the inquiry. This is the core function of the platform.
• With service providers — We use trusted third-party services to operate the platform:
  • Stripe for payment processing
  • Email provider for system notifications
  • Vercel for hosting, file storage, and cookieless traffic analytics
  • Neon for database hosting and storage
  • Cloudflare for bot protection on our sign-up and password-reset forms

  Each of these sub-processors maintains a Data Processing Addendum (DPA):

  • Stripe DPA
  • Vercel DPA
  • Neon DPA
• With Meta, for advertising measurement — On the marketing pages listed in Section 2, the Meta Pixel sends Meta the page you viewed, your IP address, and your browser user agent. Under California law this is sharing for cross-context behavioral advertising rather than a service-provider disclosure, and you have the right to opt out of it — see Your Privacy Choices. We do not send Meta your name, email address, phone number, or any account identifier, and we receive no money for it. It does not run on any tenant’s website or on any signed-in dashboard.
• With Cloudflare, on our sign-up and password-reset forms — Those two forms are the only pages on the platform that will send an email to an address a stranger typed, so they carry a Cloudflare Turnstile challenge that tells a person from an automated script. Cloudflare receives your IP address, your browser user agent, and signals about your browser in order to score the request. We do not send Cloudflare your name, email address, phone number, or any account identifier, and Turnstile is not used for advertising, profiling, or tracking you across sites. It runs on those two forms only — never on a tenant’s website, never on a custom domain, and never on a signed-in dashboard. This is a security measure: in August 2026 an automated campaign used our sign-up form to send unwanted mail to hundreds of real addresses, and this is how we stop it.
• With YouTube, only if you play a video — Our homepage and our agent plan page each show the same product tour, hosted on YouTube. It is not loaded when the page opens. We show a still image stored on our own servers, and nothing is requested from YouTube or Google until you press play. If you press play, YouTube receives your IP address, your browser user agent, and the address of the page you played it on, and may set its own storage in your browser under its own privacy policy. We do not send YouTube your name, email address, phone number, or any account identifier, and we receive no money for it. If you never press play, nothing about you reaches YouTube.
• Legal requirements — We may disclose information if required by law, court order, or governmental regulation.
• Business transfers — In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not sell personal information, and no third party receives personal information from us in exchange for monetary or other valuable consideration. We do share personal information for cross-context behavioral advertising in one narrow way: the Meta Pixel described above, on our own marketing pages only. You may opt out of it in Your Privacy Choices. No tenant site carries an advertising pixel, and we do not build profiles of individuals for advertising.

5. Cookies

Listing Nav uses one strictly necessary cookie everywhere. On our sign-up and password-reset forms, Cloudflare’s bot check may additionally set a short-lived cookie to record that the challenge was passed; it is a security cookie, it is not used to advertise to you or to recognise you on other sites, and it is set on those two forms only. On the marketing pages listed in Section 2, the Meta Pixel additionally sets one advertising cookie. That one is never set on a tenant’s website, never set on a signed-in dashboard, and never set for a visitor who has opted out or whose browser sends a Global Privacy Control signal.

Video playback. The product tour on our homepage and our agent plan page is hosted on YouTube, and is embedded in privacy-enhanced mode. It is not loaded when the page opens: what you see before you press play is a still image served from our own servers, so no cookie or other storage is set by YouTube and no request reaches Google. If you press play, the player loads and YouTube may set its own storage in your browser under Google’s privacy policy. That storage is not ours, is not listed in the table above, and is never set for a visitor who does not press play — which is why there is no separate switch for it. Choosing not to play the video is the control.

The session cookie is strictly necessary for the platform to function. The advertising cookie is not, and we do not pretend otherwise: it is offered on an opt-out basis, which is the standard California law sets. We do not target the European Union today; if that changes, the advertising cookie would require prior consent under the ePrivacy Directive (Article 5(3)) and this opt-out model would not be sufficient there.

5A. Do Not Track & Third-Party Tracking

Global Privacy Control: If your browser or extension sends a GPC signal, we treat it as an opt-out from advertising measurement. The Meta Pixel is never loaded, no advertising cookie is set, and no event is sent. You do not need to do anything else, and you do not need to be signed in.

Do Not Track signals: There is no agreed standard for what a “Do Not Track” (DNT) header obliges a site to do, so we do not act on DNT. GPC, above, is the signal we honour.

Third-party tracking: One third party — Meta — receives page-view information from our own marketing pages, as described in Sections 2 and 4. It is not loaded on any tenant’s website, on any tenant’s custom domain, or on any signed-in dashboard, and it never receives your name, email address, phone number, or account identifier. One further third party — YouTube — receives a request only if you press play on the product tour described in Sections 4 and 5, and receives nothing at all if you do not. Cloudflare receives request signals on our sign-up and password-reset forms in order to block automated abuse, as described in Section 4; that is a security control, not analytics or advertising, and it carries no profiling. Apart from Meta, that video embed, Cloudflare’s bot check, and Vercel’s cookieless traffic analytics, no third-party analytics or advertising technology runs anywhere on the platform.

5B. Your Privacy Choices

California residents have the right to opt out of the sharing of personal information for cross-context behavioral advertising. We offer that choice to everyone, not only to Californians, because a privacy right that depends on where you live is a poor one.

Opting out does not sign you out, does not change your account, and does not reduce anything the platform does for you. If you would rather have us confirm your choice in writing, emailsupport@listingnav.com.

6. Data Retention

• Account data is retained while your account is active and deleted upon request.
• Lead data is retained while the associated tenant account is active. Tenants can delete individual leads at any time. When a lead is deleted, we keep a minimal suppression record: a one-way cryptographic hash of the contact details (which cannot be reversed to recover them), the exact communications-consent wording and decision, and the deletion date. This exists so that a person whose data was deleted is never contacted again by mistake, and so consent given before deletion can be evidenced — it is retained to comply with legal obligations and to establish or defend legal claims.
• Rate limit data is short-lived and automatically purged.
• Terms of Service acceptance records (including IP address and user agent at the time of acceptance) are retained for the life of the account plus five years, for legal compliance and the defense of legal claims.
• Listing attestation records (including IP address and user agent at the time of each property listing creation or update) are retained for the life of the listing plus five years, for the same purposes.
• Security audit logs: routine sign-in events (login, logout, failed logins) are automatically deleted after two years. Other security and account events (signups, password changes, account-level actions) are retained as account history for security monitoring, legal compliance, and the defense of legal claims.
• Feedback and demo requests submitted through our forms are deleted after two years.
• Published advertiser card versions (advertisements that ran on participating websites) are retained as a record of what was published, as required for advertising compliance. On request, an individual’s photo, phone number, and email address can be redacted from retained versions while the regulatory record is preserved.

Our full retention schedule maps each record category to the legal basis for keeping it. To exercise a deletion or other privacy request, email support@listingnav.com.

7. Data Security

We implement the following security measures to protect your data:

• Passwords are hashed with bcrypt using 12 salt rounds
• Authentication cookies are HttpOnly and Secure in production
• All production traffic is transmitted over HTTPS
• Tenant data isolation — all database queries are filtered by tenant ID, preventing cross-tenant data access
• Rate limiting on public-facing forms to prevent abuse

While we take reasonable measures to protect your information, no method of transmission over the internet or method of electronic storage is 100% secure.

8. Your Rights (CCPA / CPRA / GDPR)

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right to know / access — Request a copy of the personal information we have collected about you in the preceding 12 months, including the categories of information, the sources, the business purposes, and the categories of third parties with whom we shared it
• Right to delete — Request deletion of your personal information, subject to certain exceptions (e.g., legal compliance records such as ToS acceptance and listing attestation records)
• Right to correct — Update inaccurate information via your account settings or by contacting us
• Right to data portability — Receive your data in a structured, commonly used format
• Right to opt-out of sale or sharing — We do not sell personal information. We do share it for cross-context behavioral advertising through the Meta Pixel on our own marketing pages. Opt out in Your Privacy Choices, or send a Global Privacy Control signal and we will honour it automatically.
• Right to limit use of sensitive personal information — We do not use sensitive personal information for purposes beyond those necessary to provide the services you requested
• Non-discrimination — We will not discriminate against you for exercising any of these rights

How to Submit a Request

To exercise any of these rights, contact us at support@listingnav.com. We will verify your identity before processing your request. We will respond within 45 days (CCPA/CPRA) or 30 days (GDPR) of receiving your verified request.

Authorized Agent Requests

You may designate an authorized agent to submit a request on your behalf. To do so, provide the agent with written permission signed by you, and have the agent submit the request to support@listingnav.com along with proof of their authorization. We may still require you to verify your own identity directly with us.

Notice at Collection (California)

The following table summarizes the categories of personal information we collect, the sources, the purposes, and the categories of third parties with whom we share it:

9. Multi-Tenant Data Roles

Listing Nav operates as a multi-tenant platform. This means multiple agents and brokerages each have their own site within our platform. The data responsibilities are divided as follows:

• Listing Nav (the platform) acts as a data processor for lead and inquiry data collected through tenant sites.
• Tenants (agents and brokerages) act as data controllers for leads collected on their respective sites.
• Tenants are responsible for their own privacy compliance regarding the lead data they receive.
• Listing Nav provides tools for tenants to manage and delete lead data within the platform.

10. Children's Privacy

Listing Nav is a business platform intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal information from children under 13 years of age in compliance with the Children's Online Privacy Protection Act (COPPA). If we discover that we have inadvertently collected information from a child under 13, we will promptly delete it.

11. International Data Transfers

Your information is processed and stored in the United States. If you are accessing Listing Nav from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States. By using the platform, you consent to the transfer of your information to the United States.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes, we will notify you by email or through a prominent notice on the platform. Your continued use of Listing Nav after any changes constitutes your acceptance of the updated policy.

13. Contact

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: