Privacy policy

This policy explains which personal data is processed when you visit https://livelisted.app, use the application, or interact with availability pages and widgets published by our customers. It is issued in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

Last updated 03/10/26

1. Controller

GMC Holding GmbH, Viktringer Ring 13, 9020 Klagenfurt am Wörthersee, Austria. Managing director: Georg Micheu. Privacy enquiries: privacy@livelisted.app.

2. Two roles: controller and processor

For the operation of the website, customer accounts and contract processing, GMC Holding GmbH is the controller.

For the data that customers (property developers, project marketers) enter into livelisted — units, prices, reservations, sales partners, prospect enquiries including the search profile (budget, financing, search and location preferences) — the respective customer is the controller. livelisted processes that data as a processor under Art. 28 GDPR on the basis of the data processing agreement that forms part of the Terms of Service. In these cases, data subjects should contact the customer; we assist with the response.

3. Visiting the website

When you visit the site, our hosting provider processes technically necessary data: IP address, time, page requested, browser and device type, referring page. The purpose is to deliver the page, defend against attacks and analyse errors. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). Server logs are deleted after 30 days at the latest.

We currently use no analytics, tracking or advertising cookies. Only technically necessary cookies are set: the sign-in session (signed-in users only) and the chosen language (cookie “ll_lang”, 12 months). No consent is required for these cookies (§ 165(3) TKG 2021).

4. Registration and account

On registration we process your email address, optionally your name and company name, your password (hashed) and sign-in timestamps. Access is usually via a sign-in link sent by email. The purpose is to provide the account and perform the contract; the legal basis is Art. 6(1)(b) GDPR.

Users may voluntarily upload a profile picture. It is stored without image metadata (such as location or camera data) and is visible to the members of their organisations (for sales partners, also to the inviting organisation); it appears as the contact photo on an exposé only if it is explicitly added there. It can be removed from the account at any time (Art. 6(1)(a) and (b) GDPR).

If you register your interest via the homepage, we store your email address and, where provided, your company name in order to contact you about the product (Art. 6(1)(f) or (a) GDPR). You can withdraw your registration at any time by email.

5. Using the application

Customers enter projects, units, prices, status changes, reservations with deadlines, notes, sales partners (company name, contact email, invited users) and documents. Every status change is recorded in the history with the time and the person who made it (email address); this history is deliberately immutable because it evidences the sales history.

Sales partners invited by a customer receive their own account with access only to the projects shared with them. Their email address is shown to the inviting organisation.

This processing is carried out on behalf of the customer (section 2).

6. Public availability pages, widget and enquiries

Customers can publish a project's availability and price list — as a page under livelisted.app/p/… or as a widget on their own website. No third-party personal data is published; notes, sales partner names and reservation details always stay internal.

Anyone who sends an enquiry about a unit through such a page or widget submits their name, email address, optionally a phone number, and a message. This data is passed on to the publishing customer, who answers the enquiry; the enquirer receives a confirmation by email. The customer is the controller for the enquiry; livelisted is the processor. The legal basis is the consent given on sending (Art. 6(1)(a) GDPR) and steps prior to entering into a contract (point (b)). To protect against abuse, the time and number of enquiries per email address are evaluated for a short period.

The widget loads data from livelisted.app into the customer's website; the visitor's IP address is transmitted to our hosting provider (section 3). The widget sets no cookies.

7. Emails

We send sign-in links, invitations, confirmations, reminders about expiring reservations, notices of automatic releases and enquiry notifications. We send marketing emails only with consent. Delivery is handled by the service provider named in section 9.

8. PDF import and AI prefill

If a price list is uploaded as a PDF, we transmit the content of the file to Anthropic PBC so that the units can be extracted automatically. Only the file content is transmitted, no account or user data. The file is not used there to train models and is not stored permanently. The result is applied only after the user has reviewed it. Customers decide for themselves whether to use this function; Excel and CSV imports are processed exclusively on our own systems.

The same applies to uploaded documents for a single property (brochures, energy performance certificates, floor plans, photos) that are transmitted to Anthropic PBC to prefill the property form: only the file content, no account or user data, no use for training, no permanent storage there. The suggested values are applied only once the user confirms them; spreadsheets (Excel, CSV) are read exclusively on our own systems. Where documents contain personal data of third parties (such as contact details), the uploading customer is responsible for ensuring that the transmission is permissible. The same applies to property details dictated or typed into the exposé form and extracted with “Fill in fields”: only that text is transmitted. Speech recognition itself is performed by the browser or its vendor (e.g. Google for Chrome, Apple for Safari); we receive only the recognised text.

9. Processors and recipients

We use the following providers, with whom data processing agreements under Art. 28 GDPR are in place:

Where providers are based in the USA, transfers rely on the EU-US Data Privacy Framework (adequacy decision of the European Commission) and, in addition, the Commission's standard contractual clauses. Application data is stored in the EU.

If users connect an AI assistant (such as Claude by Anthropic or ChatGPT by OpenAI) to their account through the connector interface (MCP), we transmit the data the assistant requests on their behalf — such as projects, leads with contact details, notes or exposé texts — to that provider on their instruction. The provider processes the data under its own terms; the customer decides for themselves whether to connect, the scope of the connection (read, or read and write), and can disconnect it at any time under Settings → Integrations. We log only which tool was called, when and with what outcome, not the content.

If customers connect a property portal (such as willhaben, immowelt or Kleinanzeigen) through its OpenImmo interface, we transfer the properties they activate for that portal — property details, texts, images and the contact details from the exposé — to that portal via FTP on their instruction; the portal processes them under its own terms. If they connect their ImmoScout24 account (Germany), we transfer the activated properties with these details, including the images and a contact for enquiries, to Immobilien Scout GmbH through the ImmoScout24 API and publish them there; for this purpose we store the access token issued by ImmoScout24. We store the portal credentials in encrypted form and use them only for these transfers. An OpenImmo file imported from other estate agent software is placed in our storage for the import and deleted once the import is complete.

If users connect their own mailbox (IMAP/SMTP), we send emails to their leads on their behalf through their email provider and retrieve messages from their mailbox. We store only emails exchanged with the organisation's leads (the sender or recipient is a lead's address, or the email is a reply in a conversation that is already stored): sender, recipients, subject, date, the text without the quoted history, and the names of attachments — not the attachments themselves. All other emails are neither downloaded nor stored. We store the credentials in encrypted form and delete them when the mailbox is disconnected. When an AI reply suggestion is requested, we transmit the email and the lead's details to Anthropic PBC; nothing is sent automatically.

Video calls: users can invite leads to a video call in livelisted. The invited person joins through a personal link in their browser, without an account. Video and audio are transmitted in real time through Daily (Daily.co, Inc.), via media servers in the EU where so configured; no audio or video recording is made or stored. Only if the invited person expressly agrees before the call (“Agree”) can the user start a transcription: the spoken words are converted to text at Daily (sub-processor Deepgram), with processing in the EU; the invited person can stop the transcription at any time, and without consent no transcription takes place. After the call we import the transcript into livelisted, store it with the lead (visible to the members of the organisation who are permitted to see the lead), transmit it to Anthropic PBC to create a summary, and then delete it from the provider; the call room is deleted after the call. We also store the time, the duration and the decision on the transcription (Art. 6(1)(a) GDPR for the transcription, otherwise points (b) and (f)).

Beyond that, we disclose data only where there is a legal obligation to do so or where you have given your consent.

10. Retention

We keep account data until the account is deleted and contract data for the duration of the statutory retention periods (in Austria generally seven years). Customers' application data is deleted within 90 days of the end of the contract unless an export is requested beforehand. Prospect enquiries are managed by the customer and are deleted together with the customer's data at the latest. Server logs: 30 days. Email delivery logs at the sending provider: up to 30 days.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw any consent you have given at any time with effect for the future. To do so, contact privacy@livelisted.app. If your request concerns data that a customer processes using our service, we forward it to the customer and assist with the response.

You also have the right to lodge a complaint with the supervisory authority. In Austria this is the Datenschutzbehörde (Data Protection Authority), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

12. Security

All connections are TLS-encrypted. Access to customer data is segregated by organisation at database level (row-level security); sales partners see only the projects shared with them. Status histories are immutable. Credentials for third-party services are not stored in the source code.

13. Changes

We update this policy when processing activities or service providers change. The current version is always available at livelisted.app/legal/privacy; the date of the last change is shown at the top.