Privacy Policy

Listor inc., a corporation incorporated in Canada and registered in Québec (“Listor”, “we”, “our”), operates Listor, an online platform that helps Québec real estate brokers prepare a listing: reading the file’s documents, the data sheet, writing descriptions, editing photos and creating publications (the “Service”). The website listor.immo (the “Site”) presents the Service.

This policy explains which personal information we collect through the Service and the Site, why, who we share it with, how long we keep it and how we protect it. We apply Québec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, and the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies.

By creating an account or using the Service, you accept the practices described here. When this policy changes materially, the Service asks you to read and accept it again before continuing.

Listor is a professional tool for real estate brokers and agencies. In this policy, “you” means the person who holds an account or visits the Site.

People whose information appears in a listing’s documents, for example the seller of a property, are not users of the Service. Section 4 explains how we handle their information and section 10 how they can exercise their rights.

a) Account and profile. At signup and in your settings: name, email address, password (stored hashed, never in clear), language, OACIQ licence number, phone number if you provide one or enable text-message verification (stored encrypted), the secret of app-based two-step verification (encrypted), your writing profile (tone, signatures, preferred and banned phrases) and the elements of your brand kit: agency name, logo, portrait, title, professional phone and email, colours and fonts.

b) Content you submit. The documents you upload for a listing (assessment roll, certificate of location, brokerage contract, seller’s declarations, tax bills, leases, invoices, annexes and any other document), photos, property addresses, measurement sheets, questionnaire answers, the texts you write or correct, the publications you create in the Studio and your communications with us. These documents often contain information about other people (see section 4).

c) Payment. Subscriptions and credits are paid through Stripe, our payment provider. Stripe collects your card number and billing details directly; we never see or store the full number. We send Stripe your name and email, and we keep your Stripe customer identifier, your subscription status, invoices and receipts, and the ledger of credits bought and used. When tax billing is active, Stripe also collects your billing address and, where applicable, your business’s legal name and tax numbers.

d) Information collected automatically. When you use the Service, our servers record usual technical data: IP address, browser and device, pages and features used, timestamps, security logs (sign-ins, attempts, rate limiting) and AI processing logs. The latter hold metadata only (operation, model, duration, tokens, estimated cost), never the content of your documents, photos or texts. We also record the date, the accepted version, the IP address and the browser when you accept the terms of use and this policy, and a log of the emails we send you (recipient, subject, template). Our error-tracking tool (Sentry) receives the technical description of an error and the IP address, with no session recording.

e) Cookies and local storage. See section 12.

The Service reads the documents you upload to extract the data useful to the listing. It then keeps them in the file, encrypted, so you can view, reuse and delete them, and for your record-keeping obligations as a broker. These documents often contain information about other people: the name and address of the selling owner, the name of a representative, or the name, agency and licence number of a signing broker.

By accepting the terms of use, you confirm that you hold the authorisation needed to entrust these documents to us, usually under your brokerage contract. We process this information on your behalf, solely to prepare your listing, and we deliberately limit its scope:

• the only information extracted about the seller is their name and address, and about a representative, their name and address; no field exists for their phone, email, date of birth, financial situation or mortgage balance, and signatures are never read;
• about a signing broker, only the name, agency and licence number are extracted;
• tenants’ identities are never extracted; the occupancy of a building is described in counts only;
• the marketing texts produced by the Service never mention the seller, a tenant or another broker;
• annex clauses reused in a publication are stripped of names, personal addresses, contact details and financial information.

You remain responsible for how you use the data and texts produced, in line with your professional obligations.

We use personal information only to:

• create, authenticate and administer your account, including two-step verification;
• provide the Service: read and classify your documents, fill in the data sheet, write descriptions and addenda, classify and edit photos, create publications and measurement sheets, show the map and neighbourhood scores of an address;
• bill your subscriptions and credits through Stripe and keep the credit ledger;
• write to you about your account: email verification, password reset, failed-payment notice, text-message verification codes, replies to your requests, and send the documents you ask us to send (for example a measurement sheet);
• protect the Service against fraud and abuse, diagnose failures and keep it secure;
• meet our legal, tax and regulatory obligations.

We do not use your documents, photos or texts to train artificial-intelligence models, and we send no newsletters or promotional messages.

You give express consent to the creation of your account, to the terms of use and to this policy by ticking the box at signup, and again each time a material version is published. The date, the accepted version, the IP address and the browser are recorded.

Text-message verification requires a separate consent, never pre-ticked, which you can withdraw by replying STOP or by turning the option off in your settings. It is never a condition of purchase or use.

You can withdraw your consent at any time by writing to info@listor.immo or by deleting your account. Withdrawal may prevent us from providing all or part of the Service.

Listor does not sell personal information and does no targeted advertising.

We share personal information only:

• with our staff and authorised collaborators, bound by confidentiality, to the extent needed to operate the Service;
• with providers that process information on our behalf, under our instructions and under contract:
  • DigitalOcean (Toronto, Canada): hosting of the servers, files and database, and storage of encrypted backups in Canada;
  • Anthropic (United States): reading and classifying the file’s documents, classifying photos by room, checking that an edit did not change a room’s structure, the visual assistant and translation of short fields;
  • OpenAI (United States): writing descriptions and addenda from the file’s facts and a sample of photos, and reading the building plans of the certificate of location;
  • Google (United States): photo editing by the Gemini model; address search, geocoding and static maps by Google Maps, called from our servers; Google Fonts loaded by your browser in the Studio;
  • Walk Score (United States): neighbourhood scores computed from the property address;
  • Stripe (United States): payments, invoices, receipts and taxes;
  • Resend (United States): sending account-related emails;
  • Twilio (United States): sending text-message verification codes and receiving messages sent to Listor’s number;
  • Sentry (United States): technical error tracking.
• with our professional advisers (legal, accounting) when necessary;
• with authorities when the law requires it or to establish, exercise or defend our rights.

Artificial-intelligence providers receive only what the requested operation needs: the document to read, the photo to classify or edit, the file’s facts to write from. We use their commercial interfaces, whose terms exclude training their models on submitted content, and we do not ask them to retain the exchanges. We require every provider to protect the information and use it only for the purposes we specify.

We keep information only as long as needed for the purposes described here:

• Account and profile: as long as the account exists. When the account is deleted, the profile is anonymised, the subscription cancelled and access revoked.
• Documents, listing data, photos and edits: as long as the listing exists; deleted when you delete the document, the listing or your account. Documents are stored encrypted and are never reused for another file.
• Photo library, Studio images, publications and measurement sheets: as long as you keep them; deleted with the account.
• AI processing logs: purged with the listing or the account.
• Credit ledger, invoices and payments: kept after account deletion for the period required by tax law; this is the only exception to the right to erasure.
• Consent records and audit logs: kept for the life of the account, then three years, to prove consent and answer an investigation.
• Log of sent emails: twelve months.
• AI usage metadata (no personal information): twenty-four months.
• Expired or revoked session tokens: thirty days at most.
• Server and security logs: fourteen days.
• Backups: encrypted, kept fourteen days; deleted data drops out of the backups as they rotate.

• encryption in transit (HTTPS and TLS) on the Site, the Service and exchanges with our providers;
• passwords stored hashed; phone number and two-step verification secret encrypted; verification codes and backup codes stored hashed and single-use;
• two-step verification by app or text message, mandatory for administration accounts;
• documents, photos and listing files encrypted at rest on our servers, in a space separate from the application;
• backups encrypted before leaving the server, stored off-site, decryption key kept offline;
• data access limited to the file’s owner; administration access restricted, protected by two-step verification and logged;
• security headers, rate limiting and logging to detect and block abuse; short-lived sessions renewed by token, revoked on sign-out and on password change;
• a register of confidentiality incidents. In case of an incident presenting a risk of serious injury, we notify the Commission d’accès à l’information and the people concerned.

No system is perfectly secure. You are responsible for keeping your password, backup codes and device confidential.

Subject to applicable law, you may:

• access the personal information we hold about you;
• have it corrected if it is inaccurate, incomplete or out of date;
• withdraw your consent;
• ask for your information to be deleted or anonymised;
• receive a copy of the information you provided to us in a structured, commonly used format (portability);
• be informed of any automated processing concerning you.

You can edit your profile, brand kit and writing profile, delete a document, a photo or a listing, download a copy of your data (profile, files, descriptions, credit history) and delete your account directly in the Service, under Settings, Account security. For any other request, write to info@listor.immo from your account’s email address. We answer within the 30 days provided by Law 25, after verifying your identity.

People who are not users of the Service but whose information appears in a file may write to the same address; we handle their request with the broker responsible for the file.

If you are not satisfied with our answer, you may file a complaint with the Commission d’accès à l’information du Québec (www.cai.gouv.qc.ca) or, as the case may be, the Office of the Privacy Commissioner of Canada.

The Service uses artificial-intelligence models to read your documents, propose the values of the data sheet, write descriptions and edit photos. These results are drafts that you verify: every extracted value shows its source and awaits your confirmation, every text is marked for review, inconsistencies detected between documents are flagged to you without ever changing your data, and every edited photo is compared with the original, which stays available.

Listor makes no decision producing legal effects on you, or affecting you significantly, based solely on automated processing. The broker remains the author of the published listing and answers for it before the OACIQ.

The Service uses no advertising cookies and no audience-measurement tool, and our servers set no cookies.

To keep you signed in, the Service stores your session tokens in your browser’s local storage, along with your preferences (theme) and drafts in progress (new listing, Studio publication). This data stays on your device and is cleared when you sign out or clear the site’s data.

Some steps rely on components from our providers that may set their own cookies or receive your IP address: Stripe’s embedded payment form on the subscription and credits pages, and Google Fonts in the Studio’s font picker. You can manage cookies in your browser settings.

Our servers, files and database are hosted in Toronto, Canada. The providers listed in section 7 process information in the United States: documents and photos during their analysis, the file’s facts during writing, property addresses, payment details, email addresses and phone numbers.

Before entrusting information to a provider outside Québec, we assess the privacy factors required by Law 25, we limit the data sent to what is necessary and we rely on contractual commitments of equivalent protection.

Listor is a professional tool reserved for brokers and agencies; it is not intended for people under 18. We do not knowingly collect information from minors.

Pier Blackburn, person in charge of the protection of personal information
Listor inc., Québec, Canada
Email: info@listor.immo

We may change this policy. The date and version at the top of the page are updated with every change, and the Service asks you to accept the policy again when the change is material. The French version prevails; the English version is provided for reference.

For any question or request about this policy or your personal information: Listor inc., info@listor.immo.

Version 2026-09-16.