Privacy Policy
How we collect, use, and protect your data — with no ambiguity, no dark patterns.
What we keep. What we don't.
Lead data lives in your tenant. We never sell, share, or aggregate. We retain conversation logs for the lifetime of your subscription plus 90 days. Deletion on request.
Tenant isolation
firm_id everywhere
Every row in every table includes firm_id. No cross-tenant access. Engineers cannot read your data without an explicit support ticket and audit log entry.
Retention
90-day post-cancel
On cancellation, all conversation data is exported in JSON + CSV and archived for 90 days, then permanently deleted. Audit logs retain 365 days.
PII handling
Encrypted at rest
AES-256 at rest, TLS 1.3 in transit. Phone numbers + email tokenized in logs. PII redacted from prompt training data.
Every reply identifies as AI-assisted.
Listr replies always include a clear AI disclosure on first contact, and on every state-mandated touchpoint thereafter. We do not disguise the AI. The brokerage decides the exact wording during Phase i discovery.
First contact
Always disclosed
"Hi — this is Listr, the AI front desk for {brokerage}. I can answer questions, book showings, or hand you off to an agent. Reply STOP to stop."
On request
Always confirmed
If a lead asks "is this a real person?", Listr confirms it is AI-assisted, then offers to connect a human agent if requested.
Per state
Compliance-tuned
Texas requires broker-of-record on first message. Florida requires fair-housing disclosure. We tune per state during discovery.
Data rights you hold today
GDPR, UK GDPR, and CCPA grant you the rights below. We honour all of them without requiring you to go through a third-party portal.
Right to access
You may request a full export of any personal data Nortra holds about you at any time. Requests are fulfilled within 30 days via your registered email address.
Right to rectification
If any personal information we hold is inaccurate or incomplete, you have the right to request correction. Updates take effect within 14 business days.
Right to erasure
You may request deletion of personal data we hold, subject to legal retention obligations. We will confirm deletion within 30 days and provide written confirmation.
Right to portability
You may request your data in a structured, machine-readable format (JSON or CSV). This right applies to data you have actively provided to us.
Right to object & restrict processing
You may object to certain processing activities, including direct marketing and profiling. We will cease that processing within 10 business days of receiving your request.
Cookie & tracking preferences
You may withdraw consent for non-essential cookies at any time using our cookie preference centre. Functional cookies required for platform operation cannot be disabled.
How long we keep your data
We only keep data for as long as it is necessary. The schedules below are our standard retention periods.
Account data
Retained for account lifetime + 90 days
Profile details, billing records, and audit logs are retained while your account is active and for 90 days after closure to support dispute resolution.
Usage & analytics
Aggregated after 12 months
Raw event logs are anonymised and aggregated after 12 months. Aggregate statistics used for product improvement contain no personally identifiable information.
Communications
Messages purged after 36 months
AI-generated message logs are purged after 36 months unless a longer retention period is required by applicable law or a pending legal hold.