Effective date: October 27, 2026
Listly is a CarXprt product operated by AltakLabs Inc, 8 THE GRN STE R, Dover, DE 19901-3618, United States. This policy covers listly.pro, the Listly Chrome extension, and our related account, billing, support and backend services.
AltakLabs Inc is responsible for the personal information described in this policy. For privacy questions or requests, email dealership@carxprt.com or write to the address above.
Account and sign-in information. When you sign in with Google, we receive account information such as your email address, name and Google account identifier. We use it to authenticate you, maintain your account, manage access and subscriptions, and provide support. Google processes the sign-in under its own privacy policy. Google sign-in is separate from Google Analytics.
Dealership and vehicle information. When you use Listly, we process dealership URLs, vehicle details, photo URLs, and listing information needed for the features you use. Examples include VIN, year, make, model, price and description. We use this information to prepare listings, fill vehicle forms, manage inventory and identify sold vehicles.
Product usage and diagnostics. We collect information about your use of Listly's account, dealership, listing and subscription features, together with relevant identifiers, activity times, browser and extension details, errors and limited listing-form diagnostics. We use this information to provide and improve those features, resolve problems, prevent duplicate actions and measure reliability.
Billing. Stripe processes payments. We receive information needed to manage your subscription, such as customer, subscription and invoice identifiers, payment status, amounts, currency and trial dates. We do not store full payment card details on our servers.
AI features. When you request an AI-generated description or translation, we send the vehicle information and text needed for that request to OpenAI. When you request photo cleanup, we send the selected vehicle photo to Google Gemini. For photo cleanup we can retain a hash of the original image, the generated image, dimensions and request diagnostics. These are service requests, separate from analytics. Do not submit sensitive personal information in vehicle descriptions or images.
Support and applications. If you contact us or apply for a beta feature, we process your message, reply address, and the setup details you provide. Support submissions can include a limited snapshot of browser and extension version, dealership or Marketplace context, workspace and entitlement status. Messages may be delivered through our email provider and retained in our support inbox.
Install-link requests. If you ask for the install link on our website, we process your email address to send it and so our sales team can follow up, as described in section 4.
Technical requests. Our hosting and service providers receive information needed to serve requests and protect the service, including IP address, browser information, timestamps and error information. Essential authentication and security storage remains available when you reject optional website tracking.
Listly does not collect Facebook passwords, authentication cookies or private messages for analytics. It does not collect general browsing history or arbitrary keystrokes. Its vehicle and form features process relevant dealership and Marketplace content as described above.
The website tracking described below applies to our public website and does not run inside the extension, dealership websites or Facebook pages.
Our use of information collected through the Listly extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We limit its use to providing and improving the extension's disclosed features and related operational needs.
How these tools start depends on where you are:
To choose which of these applies, our website looks up the country of your IP address. It keeps the result only in your browser tab and does not store it on our servers. If the lookup fails, optional tools stay off until you choose. You can use the website and open the Chrome Store link whatever you choose.
Analytics — Google Analytics. Google Analytics measures website visits and interactions, such as pricing views, demo plays, install-link clicks and install-link requests. This can include page and traffic-source information, timestamps, browser/device information and pseudonymous browser identifiers. Our website integration does not deliberately send your account name or email address to Google Analytics, and it keeps Google's advertising features off.
Session recordings — Microsoft Clarity. Only if you choose Accept all or turn this on, Microsoft Clarity collects website interactions to create heatmaps and session replays. These records can include clicks, scrolling, navigation, page content, browser/device details and identifiers. Replays represent activity on our website; they are not a recording of your entire computer screen. Clarity masks input fields, and other content is governed by its masking settings. We do not use this integration to record activity inside the extension, on dealership sites or on Facebook.
Advertising — Meta. Meta Pixel and our server-side Conversions API report website visits, pricing views, demo interactions, install-link clicks and install-link requests to Meta. We use this to measure advertising results and improve campaigns. Data can include the action and time, page URL, event identifier, IP address, browser user agent, browser and ad-click identifiers, and a pseudonymous website visitor identifier. When you ask us to email you the install link, it also includes a hashed (one-way encoded) copy of that email address, not the address itself. Meta may match this information to information it holds about you. Hashed or pseudonymous identifiers are not necessarily anonymous. Browser and server copies can share an event identifier so Meta can avoid counting the same event twice.
Referrals — FirstPromoter. Referral tracking records the partner who referred you and a referral visitor identifier. If a referral is associated with an account or promotion, Listly and FirstPromoter can process related subscription events to administer commissions, discounts and referral records. Existing billing or commission records are distinct from permission to place a new optional website tracking cookie.
Install link by email. If you ask us to email you the install link, we use your email address to send it and share the request with our sales team, who may contact you about setting up Listly. We do not add the address to a mailing list, and our website database does not store it in readable form. A hashed copy can be shared with Meta as described above unless you have opted out of advertising.
You can change these choices at any time through Your privacy choices on the website. Opting out or withdrawing stops future collection under that choice; it does not automatically delete information already received by a provider. Where optional tools are on by default, our website treats a Global Privacy Control or Do Not Track signal as an opt-out of advertising, including any sale or sharing of personal information with Meta; analytics and referral tracking can continue. In the European Economic Area, the United Kingdom and Switzerland, our website treats these signals as a request to keep every optional tool off. Clearing browser storage or changing browser/device may require you to set your choices again.
For more information, see the Google Privacy Policy, Microsoft Privacy Statement, and Meta Privacy Policy.
We use providers to deliver the functions described above. These include our hosting providers, Railway and Vercel; Google for sign-in; Stripe for billing; OpenAI and Google Gemini for requested AI features; FirstPromoter for referrals; and our email service provider for support communications. Optional website tools send information to Google Analytics, Microsoft Clarity and Meta when the relevant category is on, as described in section 4. These companies may have their own responsibilities and uses under their terms and privacy notices; we do not describe all of them as acting only on our instructions.
The public website also requests map imagery from CARTO and font assets from Google Fonts. Those providers receive the network information needed to serve the requested assets, such as IP address and browser information. We do not send Listly account records with those asset requests.
For extension user data, human access is limited to your explicit consent to read specific data, security needs, legal requirements, or aggregated and anonymized data used for internal operations.
We may disclose information when legally required or necessary to protect against fraud or abuse. Transfers of extension user data as part of a merger, acquisition or sale of assets require your explicit prior consent. We do not give analytics providers unrestricted access to our database.
We do not sell personal information for money. Disclosure to advertising providers can constitute a sale, sharing or targeted advertising under some privacy laws even without a payment for the data. You can opt out of this through Your privacy choices, and a Global Privacy Control signal opts you out automatically.
Where a law requires a legal basis, we rely on:
Providing information needed for sign-in, payment or a requested feature is necessary for that function. Refusing optional website tracking does not prevent you from using unrelated product features.
We retain information for the purposes above and applicable record-keeping requirements. The following periods describe Listly-controlled storage in this release:
| Record | Retention |
|---|---|
| Website event payloads on our server | 30 days |
| Website privacy choice in your browser | Up to 180 days |
| Website notice acknowledgement in your browser | Up to 365 days |
| Opt-out or consent setting for your browser tab | Until you close the tab |
| Install-link email address | A copy stays in our sales inbox while we follow up; our website database keeps only a hashed copy, with the website event, for up to 30 days |
| Pending advertising-withdrawal request in browser storage (visitor identifier and timestamp) | Removed after server acknowledgement; expires after 30 days and is cleared when the website next checks it |
| Listly website visitor cookie | Up to 30 days |
| Accepted referral handle/cookie | Up to 60 days |
| Detailed product usage records | 180 days |
| Minimal records needed to prevent duplicate processing | While the linked account exists; removed with account deletion |
| Temporary billing-processing records | 30 days; separate accounting records can remain longer |
| Listing field diagnostics | Up to 90 days |
| Generated photo-cleanup images | No automatic expiry at present; removal can be requested |
Account, inventory, billing and support records are kept for the period needed to provide the service, resolve requests or disputes, and meet applicable legal duties. Deletion can be subject to required accounting records, security needs and backup expiry. We do not promise that deleting browser cookies deletes server records.
Pending withdrawal records are used only to retry a privacy request if the server or network is unavailable. These retries do not enable tracking. We cannot recall data already delivered before a withdrawal reaches the server.
Providers have separate retention periods. Microsoft currently documents 30 days for ordinary Clarity playback and nine months for heatmaps and labeled or favorited recordings. Google Analytics retention depends on our property settings. Provider cookies can have different lifetimes from the Listly cookies listed above.
Depending on where you live and applicable law, you may have rights to access, correct, delete or obtain a copy of personal information, restrict processing, object to certain processing, and withdraw consent. Where applicable, you can opt out of sale, sharing or targeted advertising and appeal a decision about a privacy request. We will not deny the public website because you reject optional tracking.
To make a request, email dealership@carxprt.com. Tell us the account email and what you want us to do. We may need to verify your identity or an authorized agent's authority, using information proportionate to the request. Do not send passwords or full payment card details. Account deletion is requested through support, rather than an automated self-service deletion control.
We aim to complete verified account-deletion requests within 30 days, subject to records we must retain and applicable response periods. We will explain relevant limits or extensions. You may also complain to the privacy regulator where you live, work or believe an infringement occurred, where that right applies.
You may object to processing based on legitimate interests and to direct marketing where applicable. Use the contact above. You can change your website tracking choices directly through Your privacy choices.
Listly currently serves customers in the United States, where AltakLabs Inc is based. Our providers may process information in the United States and other countries where they operate. Privacy laws may differ between countries.
Railway processes hosted customer data under its Data Processing Addendum, which describes its data-protection obligations and safeguards for international transfers where applicable. Other providers describe their practices in their applicable terms and privacy notices. Contact dealership@carxprt.com for information about where your data is processed and the safeguards that apply.
We use access controls, encrypted network connections and other technical and organizational measures to protect information. No service can guarantee absolute security. Server-side processing does not make collection anonymous or remove the obligations described in this policy.
Listly is a business tool for vehicle listing professionals and is not directed to children. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action.
We will update the effective date when this policy changes. Where required, we will provide a prominent notice and obtain a new choice before a materially different optional use begins. A website policy update does not automatically change your saved choices or give permission for a different extension data practice.