CrowList
Last Updated: October 25, 2026
Effective Date: October 25, 2026
Welcome to CrowList (the “Platform”). This Privacy Policy explains how CrowList, Inc. (“Company,” “we,” “us,” or “our”) collects, uses, shares, and protects your personal information when you use our Platform.
By using the Platform, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform.
This Privacy Policy is incorporated into and is subject to our Terms of Service.
We collect several types of information from and about users of our Platform.
Account Registration Information:
Broker-Specific Information:
Homeowner-Specific Information:
Identity Verification (Homeowners and Brokers):
Before a Listing is shown to Brokers, and before a Broker Account can be approved automatically, you verify your identity through our identity verification provider, Stripe Identity. You photograph a government-issued photo ID (driver's license, passport, or ID card) and take a live selfie. Stripe compares the selfie to the ID photo, which involves processing facial geometry (biometric information).
Listing and Bid Information:
Communications:
Payment Information:
Usage Data:
Device Information:
We currently use only essential cookies, which the Platform needs to work: sign-in and session cookies set by our authentication provider (Clerk), and security cookies set by its network provider (Cloudflare) to block automated abuse. We do not use advertising cookies or third-party analytics cookies; our website analytics (Vercel Web Analytics) works without cookies. Embedded videos use YouTube's privacy-enhanced mode, which sets no cookies until you play a video. The Platform also stores small settings in your browser's local storage (for example, when you dismissed the “install the app” prompt).
If we add analytics or preference cookies in the future, we will update this Policy and ask for your consent where the law requires it.
You can control cookies through your browser settings. However, disabling essential cookies will prevent you from using the Platform.
Authentication Provider (Clerk): email verification status, account creation timestamp, login history.
Payment Processor (Stripe): payment success/failure status, subscription status, refund/chargeback information.
License Verification Services: broker license status, license expiration dates, disciplinary action records, if any. Broker licenses are checked against the New York Department of State public license records.
Identity Verification Provider (Stripe Identity): whether your identity was verified, the verification date, and the name on your verified ID.
Referral Sources: how you found the Platform, if you came from an external link.
We use your information for the following purposes:
To Provide Services:
To Process Payments:
Transactional Communications: account creation confirmations, password reset emails, bid notifications, selection notifications, payment receipts, Membership renewal reminders.
Service Announcements: Platform updates, new features, maintenance schedules, Terms or policy changes.
Marketing Communications (with your consent): product updates, tips for using the Platform, industry news.
You may opt out of marketing communications but cannot opt out of transactional communications without closing your Account.
We do not sell your personal information. We share your information only in the following circumstances:
Homeowners See (about Brokers):
Brokers See (about Listings):
After Selection: once the selected Broker's Match Fee payment succeeds, the Homeowner's full address and contact details are revealed to that Broker only, and direct messaging is enabled between the Homeowner and that Broker.
Never Shared With Brokers: your proof-of-ownership documents and identity verification details. Only CrowList's verification team can see ownership documents.
We share information with third-party service providers who perform services on our behalf:
All service providers are contractually obligated to protect your information and use it only for providing services to us.
We may disclose your information when required by law or in response to:
If the Company is involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred to the successor entity. You will be notified of any such change via email and/or prominent notice on the Platform.
We may share your information for purposes not described in this Privacy Policy with your explicit consent.
We may share aggregated, anonymized data that does not identify you personally, such as Platform usage statistics, market trends, and performance benchmarks.
We implement industry-standard security measures to protect your information:
Encryption: TLS encryption for data in transit; AES-256 encryption for data at rest; AES-256-GCM field-level encryption for property addresses.
Access Controls: role-based access controls, multi-factor authentication for admin accounts, and the principle of least privilege.
Monitoring: security event logging, automated alerts, daily automated testing of our AI assistants, and regular security review.
Infrastructure: secure cloud hosting via Vercel and Neon, with regular security patches and DDoS mitigation.
Vendor Management: due diligence on service providers, and data processing terms with each vendor that handles personal information on our behalf.
We retain your information for as long as your Account is active or as needed to provide services. Specific retention periods:
Account Data: active Accounts are retained while the Account is active. When you delete your Account, it is deactivated immediately, and within 30 days we erase your name, email address, phone number and verified-ID name, your agent profile photo and bio, and your Listings' photos, descriptions and street address, except for the records listed below. One exception: if you are a Homeowner and a Technology Fee could still become due (Terms §4.9, during a Listing's 12-month Tail Period), we keep your name, email address and payment method on file until that period ends, and then erase them. The street address of a Listing that closed with a Technology Fee is kept with the payment record.
Transaction Data: payment records for 7 years (tax and accounting requirements); bid history for 5 years (performance scoring, dispute resolution); messages for 3 years (legal compliance).
Verification Data: proof-of-ownership documents are deleted 90 days after our team approves or rejects them. We keep a record of the verification decision (status, document type, reviewer, and date) with the Listing's admin action log. Identity verification results (status, date, and verified name) are kept with your Account. Stripe retains ID images and selfies under its own retention policy.
Audit Logs: security logs, including the logs of Crow conversations (with personal details removed) and AI support assistant requests, for 2 years; admin action logs for 7 years (compliance).
Help Requests: “Talk to a person” requests and the email address you give for our reply are kept for 2 years.
Legal Hold: data subject to legal proceedings is retained until resolution.
After retention periods expire, we securely delete or anonymize your information.
No security system is completely secure. While we implement strong protections, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials.
In the event of a data breach affecting your personal information, we will notify you without unreasonable delay and within the time required by applicable law (in New York, no later than 30 days after discovery), describe the nature of the breach, explain what information was compromised, outline the steps we are taking, and advise you on protective measures.
If you are a California resident, you have the following rights:
Right to Know: you may request the categories of personal information collected, sources of information, business purposes for collection, categories of third parties with whom we share information, and specific pieces of information we hold about you.
Right to Delete: request deletion of your personal information, subject to legal exceptions.
Right to Correct: request correction of inaccurate personal information.
Right to Opt-Out: opt out of the “sale” or “sharing” of personal information. Note: we do not sell or share personal information as defined by CCPA.
Right to Limit: limit use of sensitive personal information, which includes addresses.
Right to Non-Discrimination: we will not discriminate against you for exercising your privacy rights.
Authorized Agent: you may designate an authorized agent to make requests on your behalf.
Response Time: we will respond to verified requests within 45 days, and may extend by an additional 45 days with notice.
Verification: we will verify your identity before fulfilling requests and may request additional information.
CrowList currently operates only within the United States. If this changes and you are in the EU/EEA/UK, you would have the following rights:
Right of Access: obtain confirmation of processing and access to your personal data.
Right to Rectification: correct inaccurate or incomplete data.
Right to Erasure (“right to be forgotten”): request deletion of your data, subject to legal exceptions.
Right to Restriction: restrict processing of your data in certain circumstances.
Right to Data Portability: receive your data in a structured, commonly used format.
Right to Object: object to processing based on legitimate interests or direct marketing.
Rights Related to Automated Decision-Making: not be subject to decisions based solely on automated processing. Note: we do not use automated decision-making for significant decisions.
Right to Lodge a Complaint: file a complaint with your local data protection authority.
Legal Basis for Processing: contract performance, consent, legitimate interests, and legal obligations.
Regardless of location, you can:
To exercise your privacy rights, email legal@crowlist.com with the subject line “Privacy Rights Request,” and include your full name, the email address associated with your Account, the specific right you wish to exercise, and a description of your request.
We will verify your identity before processing requests and may request additional information to confirm your identity.
No Fee: we do not charge a fee to process requests unless they are manifestly unfounded, excessive, or repetitive.
Response Time: CCPA requests within 45 days, may extend by 45 days. GDPR requests within 30 days, may extend by 60 days.
The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.
If you are a parent or guardian and believe your child has provided us with personal information, contact us immediately at legal@crowlist.com. We will delete such information promptly.
Your information is stored on servers located in the United States. By using the Platform, you consent to the transfer of your information to the United States.
CrowList currently operates exclusively within the United States. If we expand internationally, this Privacy Policy will be updated to describe the safeguards used for any international data transfers, such as Standard Contractual Clauses and data processing agreements with applicable vendors.
Some browsers have “Do Not Track” (DNT) features. The Platform does not currently respond to DNT browser signals because there is no industry standard for how to interpret such signals.
We do honor Global Privacy Control (GPC) signals as required by California law. If your browser sends a GPC signal, we will treat it as an opt-out request for the “sale” or “sharing” of personal information, we will not use cookies for behavioral advertising, and we will suppress your data from third-party marketing purposes.
To enable GPC, adjust your browser settings or install a GPC-enabled browser extension.
The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any information.
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date, notify you via email, display a prominent notice on the Platform, and for material changes, provide 30 days' notice.
Your continued use of the Platform after the effective date of changes constitutes acceptance of the updated Privacy Policy. If you do not agree to changes, you must stop using the Platform and may close your Account.
Previous versions of this Privacy Policy are available upon request.
For questions about this Privacy Policy or our privacy practices, email legal@crowlist.com or write to CrowList, Inc., 32 Frost Mill Rd, Mill Neck, NY 11765.
CrowList currently operates only within the United States and has not appointed a Data Protection Officer. If our operations expand to require one, contact information will be added here.
To exercise your privacy rights (access, deletion, correction), email legal@crowlist.com with the subject line “Privacy Rights Request.”
California residents may contact the California Attorney General or the California Privacy Protection Agency.
In the past 12 months, we have collected the following categories of personal information:
| Category | Examples |
|---|---|
| Identifiers | Name, email, phone, IP address |
| Personal Records | Property address, license number |
| Commercial Information | Purchase history, transaction data |
| Internet Activity | Browsing history, usage data |
| Geolocation | IP-based location, property location |
| Professional Information | Broker license, firm affiliation |
| Inferences | Performance scores, preferences |
We do not sell personal information as defined by CCPA.
We do not share personal information for cross-context behavioral advertising.
If our practices change, we will update this Privacy Policy and provide a “Do Not Sell or Share My Personal Information” link.
See Section 4.2 for detailed retention periods by data type.
We collect the following sensitive personal information: property addresses (precise geolocation) and financial account information, for payment processing via Stripe.
Use of Sensitive Information. We use sensitive information only to provide the services you request, for security and fraud prevention, and for legal compliance. We do not use sensitive information to infer characteristics about you or for behavioral advertising.
Limit Use. You have the right to limit use of sensitive personal information. Contact legal@crowlist.com to exercise this right.
We retain personal information for as long as necessary to provide services, to comply with legal obligations (7 years for tax records), to resolve disputes (statute of limitations periods), and to prevent fraud (5 years for bid history).
Under California Civil Code Section 1798.83, California residents may request information about disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.
For GDPR purposes, CrowList, Inc. is the data controller. Contact: 32 Frost Mill Rd, Mill Neck, NY 11765, or legal@crowlist.com.
We process your personal data under the following legal bases:
Contract Performance: providing Platform services, processing payments, fulfilling our Terms of Service.
Consent: marketing communications, non-essential cookies, optional features.
Legitimate Interests: fraud prevention, security, Platform improvement, analytics.
Legal Obligation: tax compliance, regulatory compliance, legal requests.
As noted in Section 11.2, CrowList operates only within the United States at this time and has not appointed a Data Protection Officer.
See Section 7 for information on the current scope of our operations.
We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.
Performance Scoring. While we calculate Broker performance scores algorithmically, these are informational only and do not automatically determine outcomes. Homeowners make final Selection decisions independently.
You have the right to lodge a complaint with your national data protection authority.
Cookies are small text files stored on your device when you visit websites. They help websites remember information about your visit.
Strictly Necessary Cookies: authentication (keeping you logged in) and security (preventing fraud and automated abuse). These cookies are essential for the Platform to function and cannot be disabled.
No analytics, advertising or preference cookies. Our website analytics works without cookies, and settings such as a dismissed prompt are kept in your browser's local storage, which you can clear at any time.
Because we use only strictly necessary cookies, we do not show a cookie consent banner. If we ever add cookies that need your consent, we will update this Policy and ask for your consent before setting them.
Third-party cookies on the Platform: Clerk and its network provider Cloudflare (sign-in and security cookies); Stripe, on Stripe-hosted pages you open to add a card or verify your identity; and YouTube, only after you play an embedded video. Third-party cookies are subject to the respective third party's privacy policy.
You can control cookies through your browser settings (Chrome: Settings, Privacy and security, Cookies; Firefox: Settings, Privacy and Security; Safari: Preferences, Privacy; Edge: Settings, Cookies and site permissions).
Note: disabling essential cookies will prevent you from using the Platform.
Session Cookies: deleted when you close your browser.
Persistent Cookies: remain until expiration or manual deletion, typically 30 to 365 days.
By using the Platform, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.