Privacy
What ListingsPrep stores, where it goes, how long it stays, and how to get it back or have it removed.
Who this covers
ListingsPrep is a tool sold to real estate brokerages, operated by Lunchfocus Consulting in the United States. That means two different groups of people appear in it, and they are not in the same position:
- The people who use it — brokers, team leads and agents at a brokerage that has an account. We hold their account details directly, and this policy describes what we do with them.
- The people whose homes are photographed — sellers and owners. We do not have a relationship with them and never collect anything from them directly. Their brokerage decides what to photograph and upload; we process it on that brokerage's instructions, under our agreement with them.
- People who ask for access — anyone who fills in the request form on our home page. They are not customers and may never be. We hold what they typed only to decide whether to open an account and to write back about it.
If your home was photographed and you want those photographs removed, ask the agent or brokerage you are working with. They can delete them, and we act on their instruction.
What we hold
| What | Why | How long |
|---|---|---|
| Account details Name, email address, role, brokerage |
To sign you in, to show your colleagues who you are, and to decide what you may see | Until the brokerage is off-boarded |
| Password | To sign you in. If you forget it, we email a reset link to your address — there is no security question | Stored only as a PBKDF2-SHA256 hash with a per-user salt — never as text, and not recoverable by us |
| Listings Property address, the working document, captions and ordering |
The work product itself | Until deleted by the brokerage, or off-boarding |
| Photographs Previews and camera originals |
So a colleague, a review link, and an export from another machine all have images | 30 days after a listing was last worked on, then the bytes are released. See below. |
| A card on file The brand, the last four digits, a nickname if the brokerage set one, and Stripe's identifier for the customer |
So a brokerage can be charged for the listings it prepares, and can see which card is paying | Until the brokerage removes it, or off-boarding |
| Usage records Listings saved, photo counts, model token counts, timestamps |
To calculate what a brokerage is invoiced, and to show them their own spending | Kept as billing records, including after off-boarding |
| An access request Name, brokerage, an estimated team size, and a work email address |
To decide whether to open an account for that brokerage, and to reply | Until we decide, and then as a record of the decision. Ask us and we will delete it. |
| Sign-in attempts Email address, a count, a lockout time |
To stop password guessing | Cleared nightly once settled |
When somebody submits the access request form we also store a one-way hash of their IP address — never the address itself. It exists so the form cannot be used to send floods of email, and it is not used to identify anyone or to work out where they are.
There is no advertising, no third-party analytics, no tracking pixels, and nothing is sold or shared for marketing.
Cookies, and what else is kept on your device
Under the ePrivacy Directive, consent is needed before anything is written to your device unless it is strictly necessary to provide the service you asked for. Everything below is in that second category, which is why you are told about it rather than asked to agree to it. There is nothing here we could switch off and still sign you in.
| What | Why | How long |
|---|---|---|
lpp_session |
Keeps you signed in. HttpOnly, Secure, SameSite. | Until you sign out |
lpp_pending |
Holds a sign-in that is waiting on an emailed code. | Ten minutes |
lpp_admin |
The billing back end, which only the operator ever opens. | Until sign-out |
| Your browser's own store | Your listings and the full-size photographs, so a shoot survives a closed tab. Only downscaled previews are ever sent to us. | Until you delete the listing |
lpp_storage_notice |
Records that you have read this, so the banner stops appearing. | Until you clear site data |
If we ever add anything that is not strictly necessary — analytics, an embedded video, a marketing pixel — it will not load until you have agreed to it, and this page will say so before it does.
Photographs, specifically
Photographs of a home's interior are more revealing than most business data. They can show possessions, documents left on a counter, family pictures on a wall, and sometimes people. We treat them accordingly:
- They are stored under a key that begins with the brokerage's own account, so one customer's photographs are separated from another's by the storage layout itself and not only by the code that reads it.
- They are only ever served to someone signed in to that brokerage, or to someone holding a review link the brokerage created and can revoke.
- They are released 30 days after the listing was last touched. By then the property is usually on the market or sold, the set has been exported, and the agent still has every file on their own machine. A listing being actively worked on does not expire, and one with a review link still live is left alone until that link dies. The listing record and its captions survive; the images do not, and the record shows that they expired rather than pretending there were never any.
Who else processes it
We use three sub-processors. All are contracted, and we do not add others without updating this list.
| Who | What they do | What reaches them |
|---|---|---|
| Cloudflare, Inc. | Hosting, the database, and photo storage | Everything listed above. Cloudflare stores it; it does not read or use it. |
| Anthropic, PBC | The model that describes and orders photographs | Photographs and listing text sent for processing. Anthropic does not train its models on data submitted through its API, and does not retain it for training. |
| Stripe, Inc. | Taking card payments | The card itself, entered on Stripe's own page, plus the brokerage's name and the email address of the person who added it. |
A brokerage may choose to run on its own Anthropic account instead of ours. That changes who is billed for the model calls; it does not change what is sent or how it is handled.
Every page also loads its typeface from Google Fonts. No listing data or account information is sent there — only what any font request carries, including your IP address. Google is not a sub-processor because it never receives anything about your account or your listings.
A card number never reaches ListingsPrep. Adding a card sends you out to a page hosted by Stripe, and what comes back to us is the brand, the last four digits, and an identifier we can use to charge that customer later. The number, the expiry and the security code are typed into Stripe's page and are never seen, transmitted or stored by this application. Stripe is a PCI-DSS Level 1 service provider.
Where it is
ListingsPrep runs on Cloudflare's network. The database and the photo storage are provisioned in the United States (Cloudflare's Western North America region). Model processing is performed by Anthropic in the United States. Card payments are processed by Stripe in the United States. If you are outside the United States, your information is processed there.
How it is protected
- Everything travels over HTTPS.
- Passwords are hashed with PBKDF2-SHA256 at 210,000 iterations with per-user salts. We cannot read them.
- Sign-in cookies are HttpOnly, Secure, and scoped so they cannot be sent from another site.
- Repeated wrong passwords lock that address out temporarily.
- Every request to see a listing or a photograph is authorised on the server against the brokerage that owns it. Nothing is filtered in the browser.
No system is perfect, and we do not claim otherwise. If we discover a breach affecting your information, we will notify the affected brokerage without undue delay.
Your choices
- Get a copy. Every listing and its photographs can be exported from inside the app at any time, including while an account is on hold for non-payment.
- Correct it. There's no self-service edit for a name or email yet — email us and we'll fix it.
- Delete it. A brokerage can delete a listing, which removes its photographs immediately. Ask us to off-board the brokerage entirely and we remove its listings, its people and every photograph, keeping only the billing records we need to account for what was invoiced.
Depending on where you live you may have additional rights — including, under the California Consumer Privacy Act, the right to know what is collected, to have it deleted, to correct it, and not to be discriminated against for asking. We do not sell or share personal information, and never have. To exercise any of these, write to hello@listingsprep.com. Where a brokerage is our customer, we will generally direct a request about their listings to them and assist them in answering it.
Changes
If this policy changes in a way that matters, we will tell the brokerages using ListingsPrep before it takes effect. The effective date is at the top.
Questions about any of this, or a request about your information, go to hello@listingsprep.com.