Privacy & Security

KeyList AI, Inc. (“KeyList,” “we,” “us,” or “our”) is a technology company incorporated in the State of Delaware. We operate the KeyList platform, an AI-powered real estate platform for for-sale-by-owner transactions. For purposes of applicable data protection law, KeyList AI, Inc. is the data controller of personal information collected through the Platform.

Information you provide directly:

• Account registration data: name, email address, phone number, password
• Property information: address, square footage, bedrooms, bathrooms, year built, condition, listing price, photos, and other property details you provide
• Identity and professional information (agents): real estate license number, state of licensure, brokerage affiliation, years of experience
• Payment and billing information: credit card numbers, billing address (processed by our payment processor — we do not store raw card numbers)
• Communications: messages, support requests, and feedback you submit to us
• Offer and transaction data: offer amounts, contingencies, buyer and seller details provided during the transaction process

Information collected automatically:

• Usage data: pages visited, features used, time spent, clicks, and search queries
• Device and connection data: IP address, browser type and version, operating system, device identifiers, and screen resolution
• Log data: server access logs, error reports, and performance metrics
• Location data: city-level location inferred from IP address
• Cookies and similar tracking technologies (see Section 9)

Information from third parties:

• Public property records and MLS data integrated to pre-populate listing information
• Payment verification data from our payment processor
• Social login data if you choose to authenticate via a third-party provider

We use the information we collect to:

• Create and manage your account and authenticate your identity
• Provide, operate, and improve the Platform and its AI features
• Generate property valuations, listing copy, offer analyses, and other AI-driven outputs
• Process payments and manage subscriptions
• Send transactional communications (account confirmations, offer notifications, escrow updates)
• Send promotional communications about new features, market insights, and offers — you may opt out at any time
• Respond to your support requests and feedback
• Detect, prevent, and investigate fraudulent or unauthorized activity
• Comply with our legal obligations and enforce our Terms
• Analyze aggregate usage patterns to improve the Platform and train our AI models

Where applicable law requires a legal basis for processing personal data, we rely on the following bases:

• Contract: processing necessary to perform the contract between you and KeyList (e.g., operating your account, processing payments)
• Legitimate interests: processing for our legitimate business interests, including improving the Platform, preventing fraud, and communicating about relevant services, provided these interests are not overridden by your rights
• Legal obligation: processing required to comply with applicable laws
• Consent: where you have given us explicit consent, such as for optional marketing communications

We do not sell your personal information. We may share your information in the following circumstances:

• Service providers: vendors who process data on our behalf (payment processors, cloud hosting providers, email delivery services, analytics providers) under confidentiality obligations
• Real estate professionals: if you elect to engage an agent or vendor through the Platform, relevant property and contact information is shared with that professional
• Platform participants: property listing information (excluding contact details) is shared with buyers, agents, and the public consistent with your listing settings
• Legal and regulatory: when required by law, court order, or governmental authority, or to protect the rights, property, or safety of KeyList, our users, or the public
• Business transfers: in connection with a merger, acquisition, or sale of all or substantially all of our assets, subject to standard confidentiality protections
• With your consent: for any other purpose with your explicit consent

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law. In general:

• Account data is retained for the duration of your account plus up to 7 years following closure for legal and tax compliance purposes
• Transaction records are retained for up to 7 years to comply with applicable financial recordkeeping requirements
• Usage and analytics data is retained in aggregated or de-identified form indefinitely
• Marketing consent records are retained for 5 years following your last interaction

You may request deletion of your personal data at any time (see Section 8). Certain data may be retained despite a deletion request where required by law or to defend legal claims.

We implement technical and organizational security measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of passwords using industry-standard hashing algorithms (bcrypt)
• Access controls limiting employee access to personal data on a need-to-know basis
• Regular security assessments and vulnerability testing
• Incident response procedures including breach notification processes

No security system is impenetrable. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate or incomplete information
• Deletion: request deletion of your personal information (subject to legal retention obligations)
• Portability: receive your personal information in a structured, machine-readable format
• Objection: object to certain processing activities, including direct marketing
• Restriction: request that we limit processing of your data in certain circumstances
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at privacy@keylist.ai. We will respond within 30 days. We may require identity verification before fulfilling requests. You also have the right to lodge a complaint with a relevant supervisory authority.

We use cookies and similar technologies to operate and improve the Platform. Types of cookies we use:

• Strictly necessary cookies: required for the Platform to function (session management, authentication). Cannot be disabled.
• Performance cookies: collect anonymized data about how visitors use the Platform to help us improve it.
• Functional cookies: remember your preferences and settings.
• Marketing cookies: used to deliver relevant advertising and track campaign effectiveness. These are only set with your consent.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect Platform functionality. We honor Do Not Track signals for analytics purposes.

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we discover we have inadvertently collected information from a minor, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at privacy@keylist.ai.

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell personal information. To submit a privacy request, contact us at privacy@keylist.ai or call our toll-free number provided in our CCPA Notice.

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other states with comprehensive privacy laws may have similar rights. We will honor verifiable requests from residents of all applicable states consistent with those states' laws.

KeyList AI, Inc. is based in the United States. If you access the Platform from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your home country. We implement appropriate safeguards for such transfers in accordance with applicable law, including standard contractual clauses where required.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on the Platform. The revised policy will be effective upon posting unless otherwise specified. We encourage you to review this policy periodically.

For privacy-related inquiries, please contact our Privacy Team:

• Email: privacy@keylist.ai
• Mailing Address: KeyList AI, Inc., Privacy Team, 1 Market Street, Suite 100, San Francisco, CA 94105

For general questions, see our FAQ or review our Terms & Conditions.