0. Our position on data protection

Last updated: 19 October 2026

This page is for data protection officers and anyone who reviews ListPlus before using it. It sums up how we see our role and why. The binding texts are the data processing agreement, the privacy policy and the provider list; this page explains them.

1. A tool, not a database

ListPlus does not collect people and does not sell data. Every search, enrichment or research run happens because a customer triggers it in their workspace, and its result belongs to that workspace alone. Nothing about people is shared between customers; across customers we keep only company data without personal reference, for 30 days. Nobody can search for people on ListPlus without an account.

That is why we see ourselves as the customer's processor (Art. 28 GDPR): the customer decides whether, about whom and for what purpose data is retrieved; we provide the tools. The data providers we query on the customer's behalf are controllers of their own databases and receive only the search key. They are not sub-processors: we transmit the search key on the customer's instruction, name every provider with seat and safeguard, announce new providers 30 days in advance, and the customer can switch any of them off (DPA § 2(3)).

2. The customer is in control, on the server

The owner of a workspace switches off in the workspace policy whatever their data protection officer does not want: individual data providers, AI features, connected systems, the Inbox address, the Agent API, pipeline emails, usage events, contributing to the company cache. Off means: no member and no connected AI system can use the feature, and no data reaches the respective provider — checked on the server, not merely hidden in the interface.

Two features we treat specially. Monitoring people (Watchlist alerts) is off in every workspace until the owner switches it on after a notice of their responsibility; who switched it on and when is recorded. Rating research hits (fit score: how well a hit matches the search description) is on but can be switched off; then nobody is rated.

The policy exports as a text file, and the data protection package (policy, DPA with annexes, provider list, notice for the people in the data, privacy policy) opens as one file to print, or as a 30-day link to pass on.

3. Transparency: one list, every name

Every service provider, data provider and source is in one list with seat, data transmitted and third-country safeguard (listplus.ai/en/subprocessors), which is also Annex 3 of the DPA and the recipients section of the privacy policy — generated from one source so there are never two versions. We also name what is uncomfortable: that public sources such as LinkedIn, Crunchbase, Reddit or X are read by scrapers of a data collection platform, that some providers are in the USA, and where a provider names no transfer safeguard.

4. The people in the data

Anyone found or completed through ListPlus finds an explanation addressed to them at listplus.ai/en/contact-data-notice: what ListPlus is, where the data comes from, who receives it, which rights they have. An objection to support@listplus.ai goes, as a checksum, into a suppression list that applies to all customers: the person is no longer retrieved through ListPlus, no longer recorded as a hit and no longer monitored. One limit we name: in a search by name and company only, we learn email address and profile only when the provider answers; we then do not store the result.

5. AI

AI models run only on our servers, never in the browser. Requests to OpenAI go with the “do not store” setting and, according to the provider, without use for training; the judgement model works without storage at the provider. Which data a feature sends is in the privacy policy (section 12), including where it is whole texts. No AI output decides anything with legal effect; all of it is suggestions the user reviews.

6. What we deliberately do not do

• No database of people of our own, no data-broker model — not even for markets where it would be allowed.
• No sharing of personal data between customers.
• No monitoring of people without the customer's explicit activation.
• No person search without an account.
• No use of customer data for training models, neither by us nor by our AI providers.
• No regional “non-EU mode”: as a German GmbH we apply the GDPR to everyone, wherever the customer or the person is.

7. What is still open

We also write down what is not finished. The legal texts are under legal review (draft notice on every page). Some data providers name no seat or no transfer safeguard; the provider list says so openly, and the customer can switch them off. We are not required to appoint a data protection officer (Art. 37 GDPR, Section 38 BDSG); the features most likely to trigger that duty (monitoring, rating, search without an account) we have put under the customer's instruction or switched off. Questions: support@listplus.ai.

1. Workspace policy

Workspace: Sample workspace · never changed — default settings

What the owner of this workspace switched off for all members. “Off” means: no member and no connected AI system can use the feature, and no data reaches the respective provider — enforced on the server.

Sample without a workspace: a new workspace starts with every switch on. Which switches a customer has flipped is in the package they generate from their workspace settings.

2. Data processing agreement (DPA) with annexes

Last updated: 19 October 2026

This Data Processing Agreement (“DPA”) governs the processing of personal data by salesperformer GmbH, Sperberweg 7, 82152 Krailling, Germany (“ListPlus”, “processor”) on behalf of the customer (“Customer”, “controller”) when using ListPlus. It supplements the ListPlus Terms of Service (listplus.ai/terms, “Terms”) and becomes part of the contract when the user agreement is concluded, without the need for a separate signature. A signed copy is available on request (support@listplus.ai).

§ 1 Subject matter and definitions

(1) This DPA covers the processing of personal data that ListPlus carries out on behalf of the Customer when providing the Service under the Terms (“Customer Data”). Nature, purpose, categories of data and data subjects are set out in Annex 1.

(2) Terms such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meaning given in Art. 4 GDPR.

(3) “Retrieval Tools” are the features of the Service with which the Customer queries data from external data providers or publicly available sources, in particular enrichment, person and segment search, email verification, LinkedIn imports, AI research and signal lookups, including via the Agent API.

§ 2 Roles of the parties

(1) ListPlus as processor. The Customer is the controller and appoints ListPlus as processor for

• data the Customer uploads, imports, creates, synchronises from connected systems or forwards to the Inbox;
• data the Customer queries with the Retrieval Tools: ListPlus runs each search, enrichment or research only at the Customer's request and within the scope the Customer sets, transmits the necessary search key to the respective data provider and makes the result available to that Customer only;
• data the Customer sends to destinations of its choice via pipelines, exports, the Agent API or connected systems.

The Customer decides whether, about which persons, with which tools and for what purpose data is processed. It is responsible for complying with the obligations data protection law imposes on controllers.

(2) ListPlus as controller. ListPlus processes the following on its own responsibility and not on behalf of the Customer:

• account, contract, billing, support and usage data of the Customer's users;
• data required for operation, security, prevention of abuse and fraud, credit billing and compliance with legal obligations;
• aggregated or anonymised usage statistics for improving the Service that do not allow conclusions about individual data subjects in Customer Data;
• the cross-customer company cache (§ 13(3) of the Terms), to the extent it exceptionally contains personal data.

The ListPlus Privacy Policy (listplus.ai/privacy) applies to this processing.

(3) Data providers and sources. The external data providers and sources in Annex 3, Part B, are controllers of their own databases and not sub-processors of ListPlus. ListPlus owns no contact database and does not pass data from a database of its own to the Customer. When the Customer triggers a retrieval, ListPlus transmits, on the Customer's instruction (§ 3), only the search key needed for the query to a provider named in Part B that the Customer has not switched off in the workspace policy, and makes the result available exclusively to that Customer. The Customer, as controller, is responsible for the lawfulness of this transmission, including to a third country; for this purpose Annex 3, Part B, states for each provider its seat, the data transmitted and the safeguard the provider names. ListPlus informs the Customer of new providers in Part B with the notice period of § 7(2) sentence 1; the Customer can switch off any provider at any time in the workspace policy.

§ 3 Instructions

(1) ListPlus processes Customer Data only on documented instructions from the Customer, unless required to do so by Union or Member State law; in that case ListPlus informs the Customer of that legal requirement before processing, unless that law prohibits it.

(2) The Customer's instructions are set out in full in the Terms, this DPA, the workspace policy and the Customer's operation of the Service. Every action triggered by the Customer or its users — such as an import, a search, an enrichment, a Watchlist alert, an AI research run with the search description written and the sources chosen by the Customer, a pipeline or an export — counts as a documented instruction to the extent defined by that action. The same applies to actions the Customer triggers via the Agent API or an AI system it connects. With the workspace policy (Terms § 3(4)) the Customer instructs ListPlus not to use certain features, data providers or sources for its workspace; ListPlus enforces this instruction technically.

(3) The Customer gives further instructions in text form to support@listplus.ai. ListPlus may refuse instructions that go beyond the agreed scope of services or carry them out for reasonable remuneration.

(4) ListPlus informs the Customer without delay if, in its opinion, an instruction infringes data protection law, and may suspend carrying it out until the Customer confirms or changes it.

§ 4 Customer obligations

The Customer ensures that

• there is a legal basis for every processing it initiates, in particular for querying data with the Retrieval Tools and for its later use;
• it informs data subjects under Art. 13 and 14 GDPR, honours objections and responds to data subject requests;
• advertising by email, phone or other channels only takes place within the legal requirements, in particular Section 7 of the German Act Against Unfair Competition (UWG);
• no special categories of personal data (Art. 9 GDPR) and no data relating to criminal convictions (Art. 10 GDPR) are processed;
• it is entitled to provide the Customer Data to ListPlus for processing.

The Customer informs ListPlus without delay if it detects errors or irregularities in the processing.

§ 5 Confidentiality

ListPlus ensures that all persons authorised to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Only persons who need access to provide the Service, support or fix incidents are given access to Customer Data.

§ 6 Technical and organisational measures

(1) ListPlus takes the technical and organisational measures described in Annex 2 under Art. 32 GDPR to ensure a level of security appropriate to the risk.

(2) The measures are subject to technical progress. ListPlus may replace them with equivalent or better measures; the level of security must not fall below the agreed level.

§ 7 Sub-processors

(1) The Customer gives ListPlus general authorisation to engage sub-processors. The sub-processors engaged when the contract is concluded are listed in Annex 3 and are deemed approved.

(2) ListPlus informs the Customer in text form at least 30 days before engaging a new or replacing an existing sub-processor (e.g. by email or by updating Annex 3 with notice by email). The Customer may object to the change within this period in text form for a valid data protection reason. If the parties cannot agree, the Customer may terminate the user agreement with effect from the date the sub-processor is engaged. Where ListPlus must replace a sub-processor at short notice to maintain the security or availability of the Service — for example because a data provider fails, discontinues its service or the cooperation must end for legal reasons — ListPlus may engage the replacement without prior notice; ListPlus then informs the Customer without undue delay and in any event within seven days. The right to object under sentence 2 remains; the period starts with this notice.

(3) ListPlus contractually binds each sub-processor to data protection obligations that substantially correspond to those in this DPA. ListPlus is liable to the Customer for the sub-processor's compliance with these obligations under Art. 28(4) GDPR.

(4) Ancillary services ListPlus uses from third parties without those third parties having access to Customer Data (e.g. telecommunications, payment processing for ListPlus itself) are not sub-processing within the meaning of this DPA.

§ 8 Transfers to third countries

Customer Data is processed outside the EU/EEA only if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision (e.g. the EU-U.S. Data Privacy Framework) or the EU Standard Contractual Clauses (Module 3, processor to processor) that ListPlus concludes with the respective sub-processor. The Service is hosted in the EU region Frankfurt; the sub-processors concerned and the respective safeguard are listed in Annex 3.

§ 9 Assisting the Customer

(1) ListPlus assists the Customer with appropriate technical and organisational measures in responding to data subject requests. The Service enables the Customer to view, export, correct and delete Customer Data itself; the workspace's Block List flags records of people who are not to be contacted. If a data subject objects to ListPlus, ListPlus enters their identifier as a hash into a cross-customer suppression list so that they are no longer retrieved from data providers, recorded as a research hit or monitored through the Service; records the Customer already holds are unaffected and are for the Customer to handle.

(2) If a data subject contacts ListPlus directly, ListPlus forwards the request to the Customer without delay where the Customer can be identified, and does not answer it itself unless the Customer instructs it to or the law requires it.

(3) Taking into account the nature of processing and the information available, ListPlus assists the Customer in complying with the obligations under Art. 32 to 36 GDPR (security, notifications, data protection impact assessment, prior consultation).

(4) ListPlus may charge reasonable fees based on effort for assistance that goes beyond the features of the Service and is not caused by a breach by ListPlus.

§ 10 Personal data breaches

ListPlus notifies the Customer of a breach affecting Customer Data without undue delay after becoming aware of it, where possible within 48 hours. The notification contains, as far as known, the information under Art. 33(3) GDPR; missing information is provided later. ListPlus takes the necessary measures to secure the data and mitigate possible adverse effects without delay. Notifying supervisory authorities and data subjects is the Customer's responsibility.

§ 11 Deletion and return

(1) During the term of the contract, the Customer can export and delete Customer Data itself at any time. Certain data is deleted automatically after the periods stated in the Privacy Policy (section 11).

(2) After the user agreement ends and the account is deleted, ListPlus deletes the Customer Data unless there is a legal obligation to retain it. Copies in the daily backups of the database are deleted after 7 days at the latest.

(3) Data is returned through the Service's export feature before deletion.

§ 12 Evidence and audits

(1) On request, ListPlus provides the Customer with all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR. Up-to-date self-assessments, the description of measures in Annex 2 and certificates and audit reports of sub-processors (e.g. the hosting provider's ISO 27001 or SOC 2) will normally suffice as evidence.

(2) The Customer may carry out further audits, including inspections, at most once per calendar year after giving reasonable notice (at least 30 days) during normal business hours, itself or through an auditor bound to confidentiality who does not compete with ListPlus, unless a supervisory authority requires more or there is a specific reason. Each party bears its own costs.

§ 13 Liability

Liability towards data subjects is governed by Art. 82 GDPR. Between the parties, the liability provisions of the Terms (§ 14 of the Terms) and the indemnification under § 15 of the Terms apply. As a processor, ListPlus is only liable for damage caused where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to the Customer's lawful instructions.

§ 14 Term and final provisions

(1) This DPA applies for the term of the user agreement and beyond for as long as ListPlus processes Customer Data.

(2) In the event of conflicts between this DPA and the Terms, this DPA prevails in matters of data protection.

(3) ListPlus may change this DPA under the procedure in § 16 of the Terms, in particular to adapt it to changes in the law or in sub-processors. § 7 takes precedence for sub-processors.

(4) The laws of the Federal Republic of Germany apply. To the extent permitted by law, the place of jurisdiction is the registered office of salesperformer GmbH.

(5) Should individual provisions be invalid, the validity of the remaining provisions remains unaffected.

Annex 1: Subject matter and scope of processing

Nature and purpose of processing

Storing, checking, cleaning, enriching, searching, researching, transmitting and exporting contact and company lists as part of the Service under the Terms, including querying external data providers and publicly available sources with the Retrieval Tools and processing by AI models to the extent described in the Privacy Policy (section 12).

Categories of data subjects

• business contacts, prospects, customers and other persons in the Customer's lists;
• persons whose data the Customer queries with the Retrieval Tools, including persons the Customer has monitored on the Watchlist and persons recorded in AI research as authors of, commenters on or reactors to public posts;
• senders of, and persons named in, forwarded content (Inbox); persons who fill in a form of the Customer or whose data a system sends to a list's webhook; persons whose data arrives as an app event from an app the Customer connected (e.g. form answers, bookings, messages);
• correspondents the Customer captures through the Outlook add-in; persons and companies whose LinkedIn pages the Customer captures with the browser extension for Chrome and hands over to a list;
• the Customer's employees, to the extent they are contained in Customer Data.

Categories of personal data

• name, job title and seniority, company;
• business email address and its deliverability status, business phone and, where applicable, mobile number;
• LinkedIn profile URL, location, publicly visible profile information (e.g. career history, past employers), public posts, comments and reactions; in AI research the source, evidence and a fit estimate;
• content of forwarded emails and attachments (Inbox);
• other data the Customer adds to its lists (no data under Art. 9 and 10 GDPR).

Duration

For the term of the user agreement; deletion under § 11.

Annex 2: Technical and organisational measures

• Hosting and location: application, file storage and working memory (Redis) in the EU region Frankfurt. The hosting provider Vercel is certified under ISO 27001:2022 and has a SOC 2 Type 2 report; ListPlus itself holds no certification of its own.
• Encryption: transmission encrypted only (TLS), including between the application and the database and to every service provider; file storage at the hosting provider and the database (Redis Cloud) encrypted at rest; access keys stored by the Customer are stored encrypted.
• Sign-in control: sign-in by one-time email code or via Google; sessions via signed tokens (30 days); no shared accounts.
• Access control: access to lists only for the respective account, invited workspace members and people it is explicitly shared with; every interface checks authorisation on the server. Database and API keys are used on the server only.
• Separation: Customer Data is stored separately per workspace. Results about people are not shared between customers; only company data without personal reference is stored across customers (30 days).
• Data minimisation in retrievals: only the search key needed for the query is transmitted to data providers, never the rest of the list.
• Data minimisation in AI: AI processing on the server only; the extract needed for the task is sent to AI providers — for checks only unique values, for text columns, the Inbox, the webhook check and dictation the respective text or record (Privacy Policy, section 12); requests to OpenAI with the “do not store” setting and without use for training (OpenAI keeps abuse-monitoring logs for up to 30 days), to the judgement model without storage at the provider. The Customer can switch AI features off per workspace.
• Transfer control: external access points (Agent API, data endpoints, Inbox address, list webhooks) are protected by secret, revocable keys; incoming webhooks verify signatures or shared secrets; which service providers receive data the Customer controls through the workspace policy.
• Availability: the lists live permanently in the hosting provider's file storage and are loaded from there; the database is replicated, writes a journal and is backed up daily to separate, encrypted storage in Frankfurt (Amazon S3); every backup is deleted after 7 days; for the file storage the hosting provider offers no backup that ListPlus can access. Rate limits against abuse.
• Deletion: deletion of lists, workspaces and the account by the Customer with immediate effect (self-service); automatic deletion periods for the Inbox, shared links, research runs, caches and pipeline history (Privacy Policy, section 17).
• Organisation: commitment to confidentiality; access to production data only where needed for operation and support, and only through the administrative access of the hosting and the database provider; ListPlus currently keeps no log of its own of administrative access.
• Review: automated tests and type checks on every change to the application; ListPlus reviews these measures and the sub-processors at least once a year and on material changes.

Annex 3: Sub-processors

Part A: Sub-processors

These providers process customer data on our behalf under Art. 28 GDPR. “Switch off” names the workspace policy switch with which the customer stops transfers to this provider for its workspace.

Part B: Data providers and sources

On a lookup these providers receive only the search key (e.g. e-mail address, domain, LinkedIn URL, name and company or search filters), never the rest of the list. They are controllers of their own data and not sub-processors; ListPlus transmits the search key on the customer's instruction (DPA § 2(3)). “Switch off” names the workspace policy switch with which the customer switches a provider off for its workspace.

Part C: Recipients chosen by the customer

Systems the customer transfers data to because it connects or names them itself. The customer is the controller of that transfer; they are listed for completeness.

The current version of this annex is published at listplus.ai/en/subprocessors. Not in this annex: providers that process only the users' account, contract and billing data (privacy policy, section 15).

3. Service providers and data sources

Last updated: 19 October 2026

This list is Annex 3 of our data processing agreement (listplus.ai/en/dpa) and the “Recipients” section of our privacy policy in one — generated from a single source so that there are never two versions. Changes of sub-processors are announced to customers 30 days ahead (DPA § 7).

“Customer can switch off” names the workspace policy switch with which a workspace owner stops transfers to this provider for its workspace.

Part A: Sub-processors

These providers process customer data on our behalf under Art. 28 GDPR. “Switch off” names the workspace policy switch with which the customer stops transfers to this provider for its workspace.

Part B: Data providers and sources

On a lookup these providers receive only the search key (e.g. e-mail address, domain, LinkedIn URL, name and company or search filters), never the rest of the list. They are controllers of their own data and not sub-processors; ListPlus transmits the search key on the customer's instruction (DPA § 2(3)). “Switch off” names the workspace policy switch with which the customer switches a provider off for its workspace.

Part C: Recipients chosen by the customer

Systems the customer transfers data to because it connects or names them itself. The customer is the controller of that transfer; they are listed for completeness.

4. Notice for the people in the data

Last updated: 16 October 2026

You are probably reading this because a company contacted you and named ListPlus as its source, or because you want to know what ListPlus has to do with your data. Here it is, as briefly as possible.

What ListPlus is — and is not

ListPlus (listplus.ai) is a tool of salesperformer GmbH, Sperberweg 7, 82152 Krailling, Germany, with which companies check, complete and research their contact lists. ListPlus has no database of people of its own. When a customer looks a person up or completes a field, ListPlus asks specialised data providers or public sources at that moment and shows the customer the result.

For these lookups we act on behalf of the respective customer (processor, Art. 28 GDPR). The customer is responsible for looking you up, using your data and contacting you. Who that was you can see from the message you received; we may not and cannot tell you from our own knowledge if the customer is not identifiable.

Which data can be retrieved

Only data related to your professional role: name, position, company and its details (industry, size, location), business e-mail address and whether it is deliverable, business phone number, the address of your LinkedIn profile, location, and publicly visible profile details and public posts or reactions when a customer explicitly retrieves them. No private data, no special categories (health, religion, political opinion).

Where the data comes from

From data providers that run their own databases of business contacts (for example Prospeo, FullEnrich, CompanyEnrich, MillionVerifier), and from publicly accessible sources (for example LinkedIn, company websites, Google search, Crunchbase, Hacker News, Reddit, X) that a service reads at the customer's request. The complete, current list with the providers' seats is at listplus.ai/en/subprocessors, Part B. The providers are responsible for their own databases; information about those you obtain from them.

Who receives the data and how long it stays

The result of a lookup is seen only by the customer who triggered it; it is stored in that customer's workspace until they delete it. Results are not shared between customers. We additionally keep a cache per customer for at most 30 days so that the same lookup is not paid twice. Nobody can search for people on ListPlus without an account.

The legal basis for the lookup is the customer's legitimate interest (Art. 6(1)(f) GDPR) in finding business contacts and keeping accurate business data, limited to the professional context. Whether the customer may contact you beyond that depends on its own legal basis and on unfair-competition law; that is the customer's responsibility.

Your rights — and what we do

Objection (Art. 21 GDPR). Write to support@listplus.ai with your business e-mail address or the address of your LinkedIn profile. We enter both as a checksum (not in plain text) into a suppression list that applies to all customers: your data is then no longer retrieved from providers through ListPlus, no longer recorded as a research hit and no longer monitored. One limit we have to name: if a customer searches only with your name and company, we learn e-mail address and profile only when the provider answers; we then do not store the result, but the provider has seen the request.

Access, rectification, erasure (Art. 15 to 17 GDPR). These rights are directed at the customer who uses your data; if your request reaches us, we forward it to the customer where identifiable and answer what we know ourselves. The data providers delete your data in their own databases themselves; their contact details are in the provider list.

Complaint (Art. 77 GDPR). Our supervisory authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Everything else, in particular how we handle the data of website visitors and customers, is in our privacy policy at listplus.ai/en/privacy.

5. Privacy policy

Last updated: 19 October 2026

This privacy policy informs you under Articles 13 and 14 of the General Data Protection Regulation (GDPR) which personal data we process when operating the website listplus.ai and the ListPlus application (listplus.ai/app, including the Outlook add-in, the browser extension for Chrome and the Agent API), for which purposes, on which legal basis, and which rights you have.

1. Controller

salesperformer GmbH
Sperberweg 7
82152 Krailling
Germany
Phone: +49 (0)89 28741023
Email: support@listplus.ai
Commercial register: Amtsgericht München, HRB 189481
Managing Director: Stephan Methner

For any data protection question and to exercise your rights, contact us at support@listplus.ai.

2. Data protection officer

We are not required to appoint a data protection officer (Art. 37 GDPR, Section 38 BDSG). Please send data protection requests to support@listplus.ai.

3. Overview: our role in processing your data

Depending on your relationship with ListPlus, we process your data in different roles:

• Website visitors (listplus.ai): we are the controller for the data arising when you visit the website (sections 4 and 5).
• Users of the application (customers and their staff with their own account): we are the controller for account, contract, billing, usage and support data (sections 6 to 10).
• People in customer lists: personal data that customers upload, import, create, enrich or forward to the Inbox is processed by us on behalf of that customer as a processor under Art. 28 GDPR. The customer is the controller (section 11).
• People whose business contact data is retrieved through ListPlus: when customers retrieve contact or company data from data providers through ListPlus, section 13 gives you the information required by Art. 14 GDPR about the sources and the processing.
• Visitors who look at the application without an account: they see the interface and the sample list with invented data; searches, enrichments and everything that retrieves third-party data require an account. Section 4 applies to these visitors.

4. Visiting the website and hosting

The website and the application are hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA); servers and file storage are located in the EU region Frankfurt am Main. When you open a page, Vercel processes technically necessary connection data: IP address, date and time, requested URL, referrer, browser and operating system information and status codes (server log files).

Purpose: delivering the website, stability, security and abuse prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service). Retention: server log files are deleted after at most 30 days unless needed longer to investigate a security incident.

Although servers and file storage are in the EU, data may also be transferred to the USA by Vercel itself, as Vercel is a US company and uses subprocessors. Vercel is certified under the EU-U.S. Data Privacy Framework; in addition we have concluded a data processing agreement with Standard Contractual Clauses with Vercel (see sections 15 and 16).

5. Cookies, local storage and analytics

We do not use advertising or tracking cookies, and no cookies from ad networks or social networks. We use the following cookies and entries in your browser's local storage (localStorage):

Legal basis: storing and reading this information on your device is based on Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) where it is strictly necessary to provide the service you explicitly requested (sign-in, language setting, application settings, the AI help's conversation). The subsequent processing is based on Art. 6(1)(b) GDPR (user agreement) or Art. 6(1)(f) GDPR.

Reach measurement, usage events and error logs

Website: we use Vercel Web Analytics and Vercel Speed Insights to measure reach and page speed. These services work without cookies and without cross-device profiles. They record pages visited, referrer, approximate country-level location, device type, browser and operating system, and load times; to distinguish visits, a hash derived from request data is used and discarded daily.

Application: which features are used when, we count with PostHog (PostHog Inc., EU cloud in Frankfurt). Each event carries a pseudonym of your account (a hash of the user ID, not reversible), the plan, a hash of the workspace, the event and its properties (e.g. “list created”, “enrichment started”, the number of rows) — never names, email addresses or the contents of your lists. PostHog sets no cookies for us and records no sessions. You can switch usage measurement off in your account settings; a workspace owner can switch it off for all members (workspace policy). Independently of that, we keep daily counters without any personal reference (how often a feature was used).

Error logs: the logs of our servers are kept by our host Vercel. When an error happens in your browser, we only count on which kind of page it happened (as a usage event at PostHog, see above) — without the error text; the error itself does not leave your browser.

Purpose: improving the website and application, error analysis. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in designing our service to meet demand and in running it reliably). Recipients: Vercel Inc., PostHog Inc. (see section 15).

Third-party content your browser loads

In a few places your browser loads content directly from third parties, which thereby learn your IP address: explainer videos on the application's start page from Wistia (only after a click), map tiles from OpenStreetMap in the contact view (with the coordinates of the company shown, not yours), icons from jsDelivr, and profile pictures of people directly from LinkedIn or the data provider. Legal basis: Art. 6(1)(f) GDPR.

Stripe and Link payment pages

When you subscribe to a plan or buy credits, you are redirected to a Stripe Managed Payments checkout page (checkout.stripe.com) on which Sold Through Link, LLC acts on our behalf as merchant of record (section 8); to manage the subscription we take you to the Stripe customer portal, and you can also manage orders at link.com. The privacy notices of Stripe and Link apply there; Stripe and Link set their own cookies there, among other things for fraud prevention.

6. Registration, sign-in and user account

To use ListPlus you create an account with your email address. You sign in with your email address and a one-time passcode we send you by email, or with “Sign in with Google”; we do not store a password. The sign-in service is operated for us by Hanko GmbH, Kiel, Germany (hosted in the EU); a session lasts 30 days. If you choose to sign in with Google, Google LLC (USA) confirms your identity and sends us your email address and your Google account ID; Google learns that you sign in to ListPlus (third-country safeguard: EU-U.S. Data Privacy Framework). We process your email address, optionally your name, an internal user ID, the sign-in method, the times of registration and sign-in, and technical session data.

Purpose: setting up and securing your account. Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual steps). Retention: for the duration of the user relationship; after the account is deleted, the data is deleted unless statutory retention obligations apply.

7. Providing the application and performing the contract

When you use ListPlus, we process your account data, your plan, your credit balance and its transactions (purchases, usage per action, refunds), settings, the lists, folders and saved contacts you create, API connections and their execution logs, as well as technical logs for error analysis and abuse detection.

Purpose: providing the contractual services, billing credits, security and abuse prevention (e.g. rate limits). Legal basis: Art. 6(1)(b) GDPR; for security and abuse prevention Art. 6(1)(f) GDPR.

For a fast working data store we use Redis Cloud (Redis EMEA Ltd., London), hosted in the Frankfurt region (AWS eu-central-1). For live status updates in the browser (e.g. “import finished”) we use the realtime service Pusher (Pusher Ltd.) (London; servers in Ireland); it transmits event and status information about your operations.

For managing your account, the following also applies:

• On sign-up, we add you to our CRM system Attio: your email address and your user ID. There we also note your plan and key events of your account — sign-up, first list, first enrichment, first flow, joining a workspace, buying a plan or credits, cancelling — and the progress they add up to (a stage and a score, e.g. “Enriched”, 40 of 100), so we see how far you use ListPlus. The contents of your lists never go there. The CRM system sends a welcome email.
• On a purchase, Stripe reports it to an interface of our service; we record the purchased plan or credits on your account.

Purpose: managing your account and plan, sending the welcome email to get you started, and looking after our customers (e.g. help getting started, questions about the plan or a cancellation). Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement); for the account events in the CRM Art. 6(1)(f) GDPR (legitimate interest in looking after our customers). When you delete your account, we delete these entries too; only your email address stays there on a suppression list so that we never contact you again (Art. 6(1)(f) GDPR). The welcome email is purely a greeting and onboarding message about your account, not advertising. We only send newsletters or promotional emails with your explicit consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Workspaces and invitations

You work in workspaces. Lists, Watchlist, Inbox, research runs, pipelines and connected systems belong to the workspace and every member sees them; plan and credits belong to the workspace owner. Whoever invites a member triggers an email to the invited address with the inviter's name and the workspace name, sent via Postmark (section 14) from notifications@listplus.ai; an invitation expires after 14 days. The owner can switch features and data providers off for all members in the workspace policy; the current policy can be viewed in the workspace settings and exported as a text file. Legal basis: Art. 6(1)(b) GDPR; for the invitation email to a person not yet registered, Art. 6(1)(f) GDPR (the inviter's interest in working together).

8. Payments and invoices

We sell plans and credit packs through Stripe Managed Payments. The sale is handled on our behalf by the merchant of record Sold Through Link, LLC (formerly Lemon Squeezy, LLC), 354 Oyster Point Boulevard, South San Francisco, California 94080, USA, a Stripe company; payments are processed in the EU by Stripe Technology Europe, Limited and in other regions by another Stripe group company. Link calculates, collects and remits VAT (or sales tax or GST), issues invoices, receipts and refund notices and sends them to you by email, handles requests about payments and refunds (support.link.com) and gives you your order history and management of subscription, payment method and billing address at link.com; Stripe handles payment disputes and screens payments for fraud.

Data: In the checkout you enter your name, email address, billing address and payment data directly with Stripe or Link; you can create a Link account or pay as a guest. We pass your email address, your user ID and the purchased product and price to Stripe. We do not receive full card or account details from Stripe, only customer and payment status information (customer and transaction IDs, email address, amount, currency, tax amount, status, plan) and invoice data.

Responsibility: Link and Stripe are independent controllers for the purchase, invoicing, tax, payment processing, fraud prevention and the Link account; the privacy notices of Link and Stripe apply. You can ask Stripe or Link to delete the data of your Managed Payments purchases and your Link account. We process the data we receive from Stripe to activate your plan and credits and to keep our accounts. Under its terms Stripe alone determines the purposes and means of this processing (Stripe Managed Payments Terms, section 6.1; Stripe's data processing agreement, “Stripe as controller”); there is no joint controllership. Privacy notices: stripe.com/privacy and link.com/privacy.

Third-country transfer: Sold Through Link, LLC and Stripe, LLC are based in the USA; the data of your purchase is therefore transferred to the USA. The basis is Stripe's Data Transfers Addendum: primarily the EU-U.S. Data Privacy Framework (Art. 45 GDPR; Stripe, LLC is certified), otherwise the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The addendum also covers Stripe's affiliates, including Sold Through Link, LLC.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (tax and commercial law obligations). Retention: we keep accounting records for the statutory periods (Section 147 AO, Section 257 HGB: 8 years for vouchers, 10 years for books and annual accounts); how long Link and Stripe keep data is set out in their privacy notices.

9. Support by email and AI help

When you contact us by email (support@listplus.ai), we process your message, your contact details and, where you have an account, your user ID, name and email address so we can match your account. There is no chat with staff in the application; questions are answered there by the AI help (see below), which can pass a conversation on to our support by email.

Legal basis: Art. 6(1)(b) GDPR where your request concerns the contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests). Retention: until the request is fully resolved, then 24 months for traceability, unless statutory retention obligations apply.

AI help (“Ask ListPlus”)

In the application's help window and via the “Questions about ListPlus?” button on our website you can ask questions about ListPlus. The answers are given by an AI model, not a person; it answers only from our help texts and our product description. When you ask a question, we transmit to our servers and from there to the AI provider OpenAI (section 12): your question, the latest messages of the current conversation, the interface language and the address of the page you are on (without search parameters). For signed-in users the workspace's plan and credit balance are added so that the answer fits, and — when you ask in an open list — counts of that list (e.g. the number of rows, of rows with an email address or a company, of duplicate or invalid email addresses). The contents of your lists — names, addresses or other values, including the list's name — are not transmitted. Please do not enter personal data of third parties into your questions.

The conversation is kept in your browser until you close the tab. In addition we store every question and its answer for 30 days, to check the quality of the answers and to improve our help texts. These entries contain the text of your question, the answer, the language, the page address and whether the question came from a signed-in user (with their plan) or a visitor — but no user ID, no email address and no IP address. We also count how many questions are asked and how they were answered (answered, nothing found, not about the product). To limit misuse we count the questions per day: for signed-in users under the user ID, for visitors without an account under a shortened hash of the IP address; these counters contain no question text and are deleted after two days at the latest.

If the AI help cannot help, signed-in users can send the conversation to our support with one click (“Send to support”). We then receive by email the conversation, what you add, your email address, workspace, plan, the page you were last on and the browser identifier; a copy goes to your account's email address. The email is sent via Postmark (section 14).

Legal basis: Art. 6(1)(b) GDPR (help as part of the application, or pre-contractual information at your request); for the counters that limit misuse and for storing questions and answers for 30 days Art. 6(1)(f) GDPR (legitimate interest in protecting the service and in improving the answers). The owner of a workspace can switch off the AI functions, and with them the AI help, for their workspace (workspace policies).

10. Connections to other systems

When you connect a CRM, spreadsheet or other tool (e.g. HubSpot, Salesforce, Pipedrive, Google Sheets, Airtable, Notion, Lemlist, Stripe, or as an import source Apollo, Phantombuster, Intercom, Zoom, Calendly), the connector service Pipedream, LLC (San Francisco, USA) manages the login credentials (OAuth) on our behalf; ListPlus itself does not store them. Requests to and transfers into the connected system run wholly or partly through Pipedream's proxy service; the transferred records pass through Pipedream's servers. Which data is transferred is determined by your actions (import, export, pipeline target); a reference list reloads from its source regularly at your request. Destinations you connect with your own API key (e.g. Instantly, Smartlead, your own webhook endpoint) we reach directly; we store the key encrypted. Legal basis: Art. 6(1)(b) GDPR; section 11 applies to the content.

Email drafts: When a customer sets up a pipeline with the target “Email draft”, ListPlus uses this connector service to create one draft per contact in the connected mailbox (Gmail or Outlook) of the person who sends (for automatic sending: the person who set up the pipeline): the contact's address and name, subject and text from the customer's template. ListPlus does not send any email; whether and when a draft is sent is decided by the user in their mail program. We read the sender's name from the connected mailbox. We store the draft's identifier and a link to it on the record (“Open in mailbox”) and, per pipeline, the email addresses a draft already went to, so that nobody gets two drafts of the same pipeline — until the pipeline is deleted. The content of the mailboxes is not read. The owner of a workspace can switch email drafts off for all members (workspace policy), independently of the other connected systems. Legal basis: Art. 6(1)(b) GDPR; section 11 applies to the contact data.

Your own AI: Agent API, MCP and research link

You can connect an AI system of your choice (e.g. ChatGPT, Claude or your own agents) to ListPlus through a connection per list (REST at listplus.ai/d/…, MCP at listplus.ai/mcp/…) or through a research link (listplus.ai/r/…). That AI system then reads and writes what the connection exposes (columns, sublists, permitted actions); every call is logged with action, rows, credits and duration (the last 50 calls per connection, deleted one day after the last call). The provider of that AI system is your recipient, not our service provider: which data it receives and how it treats it is determined by your choice of provider and the scope of the connection. The access key is part of the address path and therefore appears in the access logs of our hosting provider.

11. Customer data: ListPlus as processor

Personal data that customers process in ListPlus — such as lists from file imports, imports from LinkedIn or connected systems, enrichment results, saved contacts and Inbox entries — is processed by us on behalf of and on the instructions of the customer (Art. 28 GDPR). The customer is the controller of this data and of its use, for example for sales outreach. Data subjects should address their requests to the company using their data; if such a request reaches us, we forward it to the customer where possible.

The data processing agreement (DPA) at listplus.ai/dpa applies and is part of the user agreement for customers on every plan. A signed copy is available on request at support@listplus.ai.

Retention: lists are stored until the customer deletes them; deletion is immediate and permanent. Some areas are deliberately time-limited: Inbox entries are deleted 14 days after arrival, shared result links stop working 7 days after they were created, AI research runs are deleted 1 to 7 days after they start (the user's choice; a run that hands its hits to a list, 30 days), profiles that were only viewed (not saved or enriched) drop out of “Recently viewed” after 30 days without further activity, and a pipeline’s history (records sent to a destination the customer chose, with the destination’s response) is deleted 30 days after sending. Watchlist entries, contacts from the Outlook add-in and form submissions stay until the customer deletes them.

Deleting the account: you delete your account yourself in the settings (“Delete account”). We then delete your account, every workspace you own with all its lists, files, pipelines, inboxes, research runs and watchlists, your personal data in our database and your pseudonym at PostHog with its events; running subscriptions are cancelled. What remains: invoices and the customer record at Stripe (statutory retention), a Link account if you created one when buying (it belongs to Link; you request its deletion there), data you created in workspaces owned by others (it belongs to that workspace), logs at the hosting and logging providers until they expire (without user ID), the message history at the email service (45 days), and the cross-customer caches without personal reference. A 30-day marker prevents a still-valid sign-in session from recreating the account.

12. AI processing

ListPlus uses AI models to understand commands, check and judge data, fill AI columns, detect columns on import, recognise Inbox entries and webhook records, transcribe dictation, run research and — when the customer sets it up or clicks for it — write and check texts for email drafts and suggest the company knowledge from the customer's website. The calls are made exclusively from our servers, never from your browser; the AI provider receives the part of the data the task needs — for checks only distinct values, for the features named below also whole texts or records:

• Commands and questions: your text, column names and types, row count and sublist names; only when a command needs values, the distinct values of the columns involved (duplicates removed).
• AI checks and judge columns: only the distinct values or value combinations of the columns involved (e.g. job title, city and country); a verdict is cached for 30 days, without the value itself.
• AI text columns: the prompt you wrote with the values of the columns it names from the respective record (up to 2,000 characters), once per distinct combination.
• List webhooks and forms: unknown field names with one sample value each, so the column can be mapped; on request a spam check with up to 12 fields of 120 characters per record.
• Dictation: the audio recording of your voice input (up to 3 MB) to turn it into text.
• Column detection on import: column headers and a sample of example values (10% of the file, at least 50 and at most 200 rows).
• Inbox: To recognise people and companies in a longer entry, its text is sent to OpenAI: for forwarded emails, the email body and the text extracted from supported attachments (e.g. PDF), cut to at most about 24,000 characters. Structured entries (vCards, calendar invitations, CSV and JSON data) are read without AI extraction. Short entries (e.g. a signature line) and the recognised contact details (name, position, company, email address, location) are sent to Groq or to a model via the Vercel AI Gateway for classification and a plausibility check; to confirm a person or company, a Google search with name and company may be run (section 13).
• AI Research: your search description, or the known identity details of a person (name, company, job title, location), to search public web sources.
• AI help: your question to the help with the latest messages of the conversation, language and page address, for signed-in users plan and credit balance (section 9) — also from website visitors without an account.
• AI texts in email drafts: only when the customer puts an AI text into the template of an “Email draft” pipeline. Then the AI provider receives, for each draft, the template's instructions, the briefing, the workspace's company knowledge, the sender's name and the data of the record including its enrichment data (e.g. position, career, former employers, company data, each with its date) — without email addresses and phone numbers. Without an AI text in the template no contact data is sent to an AI provider. We keep the result for one day in the workspace so the same text is not generated twice.
• Check content: only on a click on “Check content”: subject, text and signature of the template with placeholders (no contact data), the briefing and the workspace's company knowledge.
• Company knowledge from the website: only on a click on “Suggest” in the settings (Company knowledge): ListPlus fetches the customer's website — the home page and up to four linked public pages, no legal or login pages — and sends their text for evaluation. We store the company knowledge (information about the customer's own company, its products, audiences and proof) in the workspace until the customer changes it or deletes the workspace.

Providers: OpenAI (language models and transcription; requests are sent with the “do not store” setting and, according to the provider, not used for training; contracting entity: OpenAI Ireland Ltd., Dublin; Standard Contractual Clauses), Groq UK Limited (London, processing in the USA; a fast model for short single calls) and TypeSafe AI (judgement model “Jev”, connected through the AI Gateway of Vercel Inc., without storage at the provider; TypeSafe AI, Inc., USA). Seat, data location and safeguard per provider are in section 15. A workspace owner can switch all AI features off for the workspace (workspace policy); no AI provider is called then. Legal basis: for customer data we act as processor (section 11); otherwise Art. 6(1)(b) GDPR. No automated decision-making with legal or similarly significant effects within the meaning of Art. 22 GDPR takes place; AI results (including judgements such as seniority or a “fit” score in research) are suggestions that the user reviews and applies. The research fit score describes how well a hit matches the customer's search description; a workspace owner can switch this rating off (workspace policy), after which no hit is rated.

13. Data providers and data enrichment (information under Art. 14 GDPR)

ListPlus lets customers search for, complete and verify business contact and company data. This data does not come from ListPlus itself — ListPlus owns no contact database of its own — but is retrieved at the moment of the request from specialised data providers or from publicly available sources. If your business contact data has been retrieved through ListPlus, this section informs you about the processing.

Categories of data

Name, job title and seniority, company and company data (industry, size, location, website, funding, technologies), business email address and its deliverability status, business phone number and, where applicable, mobile number, LinkedIn profile URL, location, and publicly visible profile details (e.g. career history, past employers) as well as public posts, comments or reactions where a customer retrieves them. In AI research, in addition: the source (URL), a short piece of evidence (e.g. the comment that led to the hit) and an estimate of how well the person matches the search description (“fit”, 0–100, with a reason).

Sources

The data comes from data providers that run their own databases of business contacts — Prospeo (contact database, email and phone), FullEnrich (email and phone), CompanyEnrich (company data), Crustdata (company identification by domain, funding rounds of watched companies; only the domain), MillionVerifier (deliverability), HarvestAPI and Enrich.so (publicly visible LinkedIn data), Serper (Google search results) — and from publicly accessible sources that a service reads at the customer's request: LinkedIn (search results, employee lists, posts, comments and reactions, profile search including by past employer), Crunchbase company pages, Reddit, X, Hacker News (search via Algolia, only the search term), Google Maps profiles, web traffic estimates and arbitrary websites, also to find contact details. These public sources are read by the data collection platform Apify (Prague) with third-party programs (“actors”); the platforms themselves are not our contracting partners. The complete, current list with seat, data transmitted and safeguard is at listplus.ai/en/subprocessors, Part B.

The data providers are responsible for their own data sets; information on their processing is available in their respective privacy notices. A workspace owner can switch individual providers and sources off for the workspace (workspace policy).

Purposes, recipients and legal basis

The data is retrieved when a customer triggers a specific search or enrichment and is provided only to that customer, who uses it for their own business purposes (e.g. sales, maintaining CRM data). We send the data provider only the search key needed for the lookup (e.g. email address, domain, LinkedIn URL, name and company, or search filters), never the rest of the customer's list. The legal basis is Art. 6(1)(f) GDPR: the legitimate interest of the customer and of ListPlus lies in finding business contacts and maintaining accurate business data; it is limited to data in a professional context. Personal enrichment results (email addresses, phone numbers, job titles) are not shared between customers. For retrievals a customer triggers, we act as that customer's processor and transmit the search key to the data provider on the customer's instruction; the data providers are controllers of their own databases (DPA § 2(3)).

Watchlist: monitoring contacts

This feature is switched off by default in every workspace; only the owner can switch it on, after a notice of their responsibility (the time is recorded). A customer can then have individual contacts on their Watchlist monitored: weekly or daily, ListPlus reads the person's public LinkedIn profile (via HarvestAPI) and checks whether position or employer changed or new posts appeared; an AI model classifies the kind of position. Events are stored in the customer's workspace and can be handed to a pipeline of the customer. This is a recurring observation of specific people; it happens only when the customer explicitly sets it up, the customer is the controller for it, and a workspace owner can switch it off. Anyone who objects to the monitoring (section “Your rights”) is no longer retrieved.

Outlook add-in

If a customer uses the Outlook add-in, it sends the name and email address of the correspondent currently opened to ListPlus, which retrieves data about them as in an enrichment and stores them in an “Outlook Contacts” list of the workspace until the customer deletes them.

Browser extension for Chrome

ListPlus browser extension for Chrome. The extension stores the people, companies and pages a user saves only locally in their browser (chrome.storage). Page content is read only on the user's click and processed with Chrome's built-in on-device AI model; it is not transferred to us. The extension reads details from LinkedIn pages only when the user turns this on. Only when the user hands entries over to ListPlus are the selected entries (name, profile address, role, company, location, contact data, notes if chosen) transferred to their ListPlus workspace and processed like other list data (section 11); if they request an enrichment, the providers named in this section apply. If the user hands entries over to their own endpoint, the extension sends them directly to the address the user entered; we do not receive this data. To sign in, the extension uses the existing ListPlus session in the browser. Legal basis: Art. 6(1)(b) GDPR (hand-over to ListPlus); local storage involves no transfer to us.

Retention

Results added to a customer's list are stored until the customer deletes them (section 11). Lookup results about people are cached only in the respective customer's workspace to avoid duplicate lookups: 30 days from the workspace's last lookup. Company data for a domain (name, industry, size, location, website, technologies, funding, address and phone of the headquarters — no details about people) is kept in a company cache shared across customers for 30 days from retrieval; a workspace can switch off contributing to this cache.

Your rights

You have the rights listed in section 18, in particular the right to object to the processing of your data at any time. To do so, contact support@listplus.ai. Where a customer processes your data in its own lists or contacts you, that customer is the controller; your objection to direct marketing should then be addressed to that customer. A short version of this information addressed to you is at listplus.ai/en/contact-data-notice. An objection is entered into a suppression list that applies to all customers: your data is then no longer retrieved through ListPlus.

14. Email receiving and sending (Postmark)

Users can forward emails to a personal address at @in.listplus.ai so that ListPlus recognises contact details in them (e.g. from signatures, vCards or calendar invitations). These emails are received via the Postmark service (ActiveCampaign, LLC, formerly Wildbit, USA). Postmark accepts the email and passes its content to us as structured data (JSON). We process sender, recipient, subject, body and supported attachments of the forwarded email; third-party data contained in it is processed by us as the user's processor (section 11). To recognise contacts, the content is sent to AI providers (section 12).

Through the same service we send, from notifications@listplus.ai, workspace invitations (the invitee's address, the inviter's name, the workspace name) and, when a customer sets up a pipeline with the “Email” target, digest mails to members of the workspace with the name, position and company of each entry and a link to its contact card (the links work for 30 days), as well as support requests from the AI help to our support. Sign-in codes are sent by the sign-in service (section 6), not by Postmark. A workspace owner can switch the Inbox address and pipeline emails off.

Legal basis: Art. 6(1)(b) GDPR (providing the feature the user uses). Third-country transfer: we base the transfer to Postmark in the USA on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Postmark is also certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); the data processing agreement is part of Postmark's terms of service. Retention: Postmark keeps messages for 45 days by default. Inbox entries are deleted automatically on our side 14 days after arrival; contacts the user saves or adds to a list are kept.

14a. List webhooks and forms

A customer can set up a webhook per list (an address at listplus.ai/i/…) to which other systems send records, and publish a form (listplus.ai/f/…) that visitors of the customer's website fill in. We process the data arriving this way as the customer's processor (section 11); the customer is the controller towards the data subjects and informs them. Records pass through the queues of our hosting provider; unknown field names and, on request, a spam check go to AI models (section 12); doubtful records can be held back in the customer's Inbox.

For a form we store, per submission, the page it is embedded in, with a consent checkbox the consent and its time, and for two minutes a shortened hash of the visitor's IP address to limit mass submissions; we serve the fonts ourselves, no third-party content is loaded. The form's consent text is a suggestion to the customer, not legal advice. Legal basis: Art. 6(1)(b) GDPR towards the customer; for abuse limitation Art. 6(1)(f) GDPR.

15. Recipients and subprocessors

We only pass on personal data where this is necessary for the purposes described. Within our company, only people who need access for their tasks have it. We use the following service providers:

Part A: Sub-processors

Part B: Data providers and sources

On a lookup these providers receive only the search key (e.g. e-mail address, domain, LinkedIn URL, name and company or search filters), never the rest of the list. They are controllers of their own data and not sub-processors; ListPlus transmits the search key on the customer's instruction (DPA § 2(3)). “Switch off” names the workspace policy switch with which the customer switches a provider off for its workspace.

Part C: Recipients chosen by the customer

Systems the customer transfers data to because it connects or names them itself. The customer is the controller of that transfer; they are listed for completeness.

We have concluded data processing agreements under Art. 28 GDPR with service providers acting on our behalf; for most of them it is part of the provider's terms of service. The current list with seat, data location and safeguard is published at listplus.ai/en/subprocessors; it is also Annex 3 of our data processing agreement. Beyond that, we only disclose data where we are legally obliged to (e.g. to authorities or tax advisers under statutory obligations).

16. Transfers to third countries

Some of the service providers listed are based outside the EU/EEA, in particular in the USA, or use subcontractors there. We host the application in the EU region Frankfurt but cannot rule out that data is transferred to third countries. Transfers only take place where there is an adequacy decision of the European Commission (e.g. for companies certified under the EU-U.S. Data Privacy Framework, Art. 45 GDPR) or appropriate safeguards are in place, in particular EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards at support@listplus.ai.

17. Retention at a glance

We have no feature to restore deleted data. The database is backed up daily; every backup is deleted after 7 days. Until then, deleted data may still be contained in a backup.

18. Your rights

You have the following rights towards us regarding your personal data:

• Right of access (Art. 15 GDPR), including any available information about the source of the data
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. Where your data is processed for direct marketing, you can object at any time without giving reasons; the data will then no longer be processed for that purpose.

To exercise your rights, a message to support@listplus.ai is enough. We respond without undue delay and at the latest within one month (Art. 12(3) GDPR).

Right to lodge a complaint (Art. 77 GDPR): you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

19. Obligation to provide data

Providing your email address is required for registration; without it we cannot set up an account. Payment details are required to subscribe to a paid plan or buy credits. Otherwise you are under no obligation to provide us with data.

20. Data security

Every transmission — between your browser and us, between our servers and the database, and to every service provider — is encrypted (TLS). Files are stored encrypted at our hosting provider; the database (Redis Cloud) is also encrypted at rest. API and AI keys are used on the server only; access keys customers store for their own destinations are stored encrypted. Access to lists requires sign-in and is limited to the members of the respective workspace. ListPlus itself holds no security certification of its own; our hosting provider Vercel is certified to ISO 27001:2022, among others, and has a SOC 2 Type 2 report.

21. Changes to this privacy policy

We update this privacy policy when our service or the legal situation changes. The version published on this page applies.