Privacy Policy

Draft dated October 26, 2026. Bracketed, highlighted items are open questions for the owner and the attorney.

1. Who we are
2. What we collect, and when
3. Cookies, storage and tracking
4. How we use what we collect
5. Codes and logins
6. Who else sees it
7. Referral links and affiliate relationships
8. How long we keep it
9. How we protect it
10. Your choices
11. Children and where we operate
12. Changes to this policy
13. Contact

Who we are

Listed & Live is a setup service for short-term rental hosts. It is run by Holdfast Holdings LLC ("we", "us"), a Florida company. The site is at listedandlive.com. The same site is also reachable at hostlaunchco.com, which redirects to listedandlive.com. This policy covers both.

This policy explains what we collect, why, who else sees it, and the choices you have. It applies to the website, the intake form, your account page and the emails and texts we send you about your setup. It does not cover the apps and platforms we help you set up (Airbnb, Vrbo and so on). Those have their own policies.

What we collect, and when

If you use the contact form on the home page

Your name, email, phone number (optional), which package you are considering, your property address, where you are in the process (new, already listed, or leaving a manager), how you heard about us, anything you write in the notes box, and whether you ticked the box to get texts. This form is delivered through Netlify Forms, a feature of our web host.

When you pay

You pay through a Stripe checkout page (a Stripe Payment Link). Stripe collects your payment details, and, at our request, your name, email, phone number and the address of your rental property. We never see or store your card number. If you choose an installment option such as Klarna or Affirm, that company collects what it needs to approve and service the plan, under its own policy.

After payment, Stripe sends you back to our site with a payment reference. Our server uses that reference, with a read-only key, to ask Stripe whether the payment went through and which package you bought. From Stripe we then keep your name, email, phone, property address, package, amount paid, any promo code you used and the Stripe payment reference.

Your account

We create one account per paid order. It holds the information above, plus a progress stage (intake, your accounts, building, review, handover, done), an optional one-line note from us, and a checklist of which apps you have signed up for and how you have given us access. You sign in with your email. We send a one-time sign-in link, and there is no password to create. Public sign-up is turned off, so an account exists only if a payment created it.

The intake form

The intake asks about the property and how you want it run. That includes the address, bedrooms and beds, amenities, safety devices, any cameras or noise monitors and where they are, the neighborhood, house rules, pricing and cancellation preferences, the kind of lock and entry method, Wi-Fi details, whether you have photos (and a link to a shared folder if you do), the accounts you already have, how you like to be contacted and the best time for a call. It also records three confirmations you tick before sending: that you own or are authorized to list the property, that you are responsible for permits, licenses and taxes, and that your answers are accurate. We do not ask you to upload files through the site.

Door, gate and alarm codes and your Wi-Fi password

The intake has fields for an owner or master code, a lockbox or backup code, a gate, garage or building code, an alarm code and the Wi-Fi password. When you send the intake, your browser encrypts these before they leave your device (see "Codes and logins" below). They are not saved in the draft on your device and they are not stored in readable form in our database.

App logins you choose to save

Your account page has a "Secure logins" box for apps that cannot add a second person, mostly smart-lock apps. If you use it, you give us the app name, a username and a password, and an optional note. These are encrypted in your browser before they are sent.

We do not accept Airbnb or Vrbo logins, or bank or email logins. Those are handled with a co-host invite, a screen share or a team invite instead.

When you contact us

If you email us, call us or text us, we keep the messages and whatever you tell us in them. If you reply to your Stripe receipt, Stripe delivers that to us.

Cookies, storage and tracking

This site does not use analytics, advertising pixels, tracking scripts or third-party fonts. Apart from the services named in this policy (Stripe for checkout, and our account provider Supabase), pages load only from our own domain.

We do not set cookies. We do use your browser's local storage in two ways:

• Intake draft. As you fill in the intake, a draft is saved on your device under the name "ll-intake-draft" so you can come back later. It can include your name, email, phone, address and your other answers. It never includes the codes or the Wi-Fi password. It is deleted when you send the intake. You can clear it any time by clearing site data in your browser.
• Sign-in session. When you sign in, our account provider (Supabase) keeps a sign-in token in local storage so you stay signed in. Signing out removes it.

Our web host (Netlify) and our account provider (Supabase) keep ordinary server logs, such as IP address, browser type and the pages requested, for security and operation. We do not use these logs to build profiles of you.

Because we do not track you across other sites, there is nothing for a "Do Not Track" signal to turn off.

How we use what we collect

• To set up your rental: build the listing, booking software, channels, pricing, lock, guest messages, guidebook and cleaner app, and walk you through handover.
• To take payment, confirm it, create your account and send you sign-in links.
• To reach you about your setup by email, phone or, if you opted in, text.
• To answer questions, fix problems and keep records of what we did for you.
• To keep the site and accounts secure and to prevent spam and abuse. The forms include a hidden spam trap.
• To meet legal, tax and accounting obligations.

We do not sell your information. We do not share it for advertising. We do not use your intake answers, codes or logins for anything except setting up and supporting your rental.

Codes and logins

This is the most sensitive information we handle, so here is exactly how it works.

• Your browser locks the codes, the Wi-Fi password or the app login before sending. The locking uses a public key that is built into the site. Only we hold the matching private key. It is stored separately from the website and the database, on a computer we control, so neither our web host nor our database provider can read the contents.
• Once saved, the site cannot show an item to you again. You can see that it exists, its app name, a short generic label and the date. The label never contains any part of a code, password or username, and you can delete it. You cannot read it back.
• When we need it for setup, we open it on one office computer, outside the website. The password is copied to the clipboard only when we ask for it and the clipboard is then cleared. We record the date we opened each item, and you can see that date on your account page.
• We use a login only for your setup and testing. At handover, you change the password. We delete your sealed items within 30 days of handover.
• A code or password you tell us any other way (a text, an email, a call) is not protected this way. Please use the secure box or the intake instead.
• If you ask us to set up cleaner access, we share the door code your cleaner needs with your cleaner, and no one else.

The rest of your intake answers (property details, house rules and so on) are stored in our database readable by us. They are protected by the access rules described in "How we protect it", not by this extra locking.

Who else sees it

We share information only with the services that help us run Listed & Live, and with the platforms you ask us to set up for you.

• Stripe processes payment and holds your payment details. Klarna or Affirm, if you choose them, handle installment plans.
• Netlify hosts the website, runs the server function that checks your payment, and receives home-page form submissions.
• Supabase stores your account and intake.
• Resend delivers our email, including your sign-in links, and our regular business email tools carry our replies to you.
• The apps and platforms you ask us to set up (Airbnb, a booking-software provider such as Hospitable or OwnerRez, a pricing tool, a cleaner-scheduling tool, a noise monitor, Canva, your lock app, and for the Complete package Vrbo and Booking.com). We enter your property information into those accounts at your direction. Those accounts are in your name, and each platform's own policy governs what it does with the data.
• Professional advisers (lawyers, accountants, insurers) under a duty of confidentiality, and authorities when the law requires it or to protect rights, safety or security.
• A buyer or successor, if the business is sold or reorganized.

Some intake answers, such as your cleaner's name and contact details, are about other people. Please only give us those details if that person is happy for you to share them. We use them only to set up your rental.

Referral links and affiliate relationships

Affiliate disclosure. We use referral links or codes for Airbnb, PriceLabs, Hospitable, HostBuddy, Touch Stay, Minut, Turno and Amazon. If you sign up or buy through one, the company may pay us a fee, credit or commission. It does not change your price. As an Amazon Associate I earn from qualifying purchases. We only point you to tools we recommend, on the next-steps page after your intake and in your account, and we say so near each link. Offers such as discounts or credits are set by the other company and may change.

When you click a link, the other company may set its own cookies and track your visit. We do not control that.

How long we keep it

We keep account, payment and intake records for 5 years after handover, for tax, accounting and warranty questions. We delete sealed codes and logins within 30 days of handover. Home-page form messages that never led to a purchase are deleted after 12 months.

You can delete your own sealed items from your account page at any time. To have anything else deleted, contact us.

How we protect it

• The site is served over HTTPS and sets strict browser security rules that block outside scripts.
• Each account can read and change only its own records. The database enforces this with row-level security, not just the website.
• Accounts are created only by our server after Stripe confirms a payment. Sign-in links are single-use and expire after an hour.
• Codes and saved logins are locked in your browser, as described above.
• Our server holds only a read-only Stripe key, and the key that can create accounts is never sent to the browser.

No system is perfectly secure. If we learn of a breach that affects your information, we will notify you and any regulator as the law requires, including under Florida law.

Your choices

• Ask what we hold about you, ask us to correct it, or ask us to delete it. We will do this unless we need to keep something for a legal or accounting reason. Contact us at hello@listedandlive.com.
• Delete your own saved logins and codes from your account page.
• Change your answers in the intake until we start building. After that, message us and we will update it.
• Stop texts by replying STOP. Stop emails about your setup by telling us. We may still send messages about your order and account.
• Clear the draft stored on your device at any time by clearing site data in your browser.

Children and where we operate

Listed & Live is for property owners and is not directed to anyone under 18. We do not knowingly collect information from children. The service is offered to hosts in the United States.

Changes to this policy

If we change this policy, we will post the new version here with a new date. If a change is significant, we will also email customers with an account. This policy took effect on October 27, 2026.

Contact

Holdfast Holdings LLC
Email: hello@listedandlive.com