Privacy | Leasemark

What we store

Your sign-in. Your email address, and your name and photo if you sign in with Google. Sign-in runs on Firebase Authentication (Google).
Your posts. The listings and requirements you post, with the contact details you enter on them.
Photos you upload. We re-encode every photo on upload, which strips camera data such as GPS location, and keep it in a folder for your account on our own server.
Matches and intros. Which posts fit each other, and who asked for or accepted an intro.
Browser alerts. Only if you turn them on from your dashboard: the push address your browser gives us for this site (it comes from your browser maker's push service: Google, Mozilla, Apple or Microsoft) and its encryption keys. Alerts carry a short line about a match or an intro, never anyone's contact details. Turning alerts off, signing out on that browser or deleting your account removes it.
Listing alerts. If you ask to be emailed when a space is listed, the email address and what you asked to watch. If you ask for the alert in your browser instead, no email: that browser's push address and encryption keys (as above) and what you asked to watch. Turning the alert off on its card removes it, and so does blocking notifications for this site.
Messages you send us. Your name, email and message when you use the contact form or email hello@leasemark.co, so we can reply.
Your broker page. Only if you publish one from your dashboard: the name, title, company, intro and website you enter. If you add a New York real estate license number, we send only that number to the state's open data service (data.ny.gov) to look it up, and keep what the Department of State's public records show for it: the license type, holder name, the brokerage it is filed under and its expiry date. The page shows it only when the license is held under the name on your page; leave the field blank to remove it.
Building claims. If you request to claim a building page, we store the building, your account email, role, name, company, optional phone and note, and when you submitted. Our team reviews the request by hand. These answers are private and do not change the public page. Deleting your account removes your claims.
Early access. If you join the Broker Pro or Featured early-access list, the offers you picked, your inventory size band and any note you leave.
Building list downloads. When you download a neighborhood's or street's building list as a spreadsheet, which list it was, how many buildings it held and when. Deleting your account removes it.
Post view counts. How many times a day each post page is opened and the kind of place each visit came from, with no visitor details (see Analytics below).
Listings you open while signed in. When you are signed in and open someone else's listing, we record that your account viewed it and when. If that lister is on Broker Pro, they see your visit only as the open requirements you posted (which are public anyway), never your name, email, company or contact details; other listers see only a count of signed-in visitors. Choose “Browse privately” under any listing to stop it: that also deletes the visits already recorded. Visits are no longer shown after 30 days without another visit to that listing. Our weekly cleanup deletes those expired records; browsing privately or deleting your account removes them sooner.
Usage totals. Daily counts of how parts of the site are used, such as clicks on a “List a space” button by kind of page, with nothing about who did it (see Analytics below).
Server logs. Our web server records requests (IP address, page, browser) to keep the site secure and working.
Leasemark in ChatGPT and other assistants. When an assistant such as ChatGPT uses Leasemark's tools (leasemark.co/mcp) for you, it sends us what it is looking up: a neighborhood, type of space, size and budget, a building address or name, or a listing. We answer from public posts and city records and do not store what was sent; our log keeps only which tool was used, and your IP address is held in memory for a few minutes to limit how often the tools can be called. Nothing is posted from the chat: a requirement link opens our form, and only what you post there is stored. The assistant's own privacy policy covers what it keeps of your conversation.

Posts, matches, alerts and account records live in Google Cloud Firestore in the United States.

Who sees what

Public: everything about the space or the requirement itself, plus your role (broker, owner, tenant and so on). A listing also shows the company you enter; a requirement never does. If you publish a broker page, it shows what you entered on it plus your live listings, and each of those listings links to it; your requirements are never on it. Public posts and pages can appear in search engines.
Confidential listings: if you tick Keep it confidential, the space is left off search, the map, neighborhood, street, building and broker pages and the sitemap, and its page asks search engines not to index it. It is still matched, so people whose requirement fits see it in their dashboard, and anyone with its link can open its page, which shows the same details as any listing.
Private until an intro: your name, email and phone, and the company on a requirement. They are shown only to the other side of an intro, and only after both of you accept it.
Direct contact, only if you choose it: if you turn on direct contact for a listing (the Let tenants contact me directly box on the listing form or the spreadsheet import, which applies it to every space in that import, or the switch on your own listing page or dashboard), anyone who presses Contact on that listing sees your name, company, phone and email. On a requirement (the Let owners and brokers contact me directly box, or the same switch), they see your name, phone and email, never your company. Either way the details load only on that press, so they are not in the page itself or in search engines. Turn it off the same way to stop. It is off unless you turn it on.
Never sold. We do not sell or rent your information, and we do not share it with advertisers.

Email

We only email you about your own posts (including a Monday summary of how often they were viewed the week before, when they were), matches and intros, and alerts you confirmed. Those emails go through our email delivery provider, and every alert email and weekly summary has a link to stop it.

Our emails also carry a tiny image. When your mail app loads it, we note that the email was opened, when, and which kind of mail app asked for it (for example Gmail or Apple Mail), never your IP address. It tells us whether our emails reach people at all. We keep that note for 90 days and delete it with your account. To stop it, turn off images in your mail app: the email reads the same without them.

To invite brokers and owners to list, we keep a list of commercial real estate firms built from public business records (such as New York State real estate license data on data.ny.gov). Any email we send to a firm carries an unsubscribe link, and we keep unsubscribes permanently so we never email that address again.

Analytics and third parties

We do not run Google Analytics or advertising trackers today.

We count how many times each listing and requirement page is opened, as a number per day with nothing about who opened it, and show that count only to the person who posted it. Each visit also counts toward the kind of place it came from: a search engine, an AI assistant, social media, another website, no referring page, or a kind of Leasemark page (such as search or a neighborhood page). Your browser works that out and sends only the kind, never the address of the page or site. Your browser notes which posts it already counted today, so a repeat visit is not counted twice. Visits by the poster, search crawlers and bots are not counted.

We also keep daily totals of how the site is used, to see which pages and steps help people post: for example, how many building pages were opened, how many visits arrived from a search engine, or how many times a “List a space” button was clicked on a neighborhood page. Each total is a number per day on our own database, with no cookie, no IP address, no page address (only the kind of page) and nothing you type. Search crawlers and bots are not counted.

Maps load tiles from OpenFreeMap, which sees your IP address when your browser requests them. Your browser keeps your sign-in session and any unfinished post draft in its own storage on your device. If you ask for a sign-in link while posting, we also keep a copy of that post with your email for up to 24 hours, so the link can finish it in whichever browser you open it in. We delete the copy once it is used or expires. A one-time code for signing in the Home Screen app works for 10 minutes; we keep only a scrambled copy of it (never the code itself) and delete it once it is used, or automatically after it expires.

Your choices

Edit or take down a post any time from your dashboard (Edit, Mark leased, Mark filled). The same goes for your broker page (Edit, Unpublish).
Stop a listing alert with the link in its emails.
Delete your account from the bottom of your dashboard. It removes your posts, their matches and intros, browser alerts, alerts on your email, messages you sent us from that email, your photos, your early-access entry and your sign-in. We keep only the fact that an address unsubscribed, so it stays unsubscribed.
Backups. We keep daily backup copies of our database (accounts, posts, matches and intros) and of uploaded photos on our own servers, so we can recover from a mistake or an outage. After you delete your account, your data leaves those copies as they are replaced, within 30 days.

Changes

If this page changes, the date at the top changes with it. See also our terms.